# incident

plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.77.251.201
country_id: 6252001
description:
[2026-06-13 23:19:59 +0000] info [cpaneld] 185.77.251.201 - 2002281 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [13/Jun/2026:23:20:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131307&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781392812 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 93.183.94.195
country_id: 2017370
domain: butodra.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:23-19.93.183.94.195||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [13/Jun/2026:23:20:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9792110&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781392813 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 8.0.0;) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [13/Jun/2026:23:20:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6854252&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781392817 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Edge/12.246" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [13/Jun/2026:23:21:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7181669&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781392864 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.187.78.138
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/483921279 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.117.0.29
country_id: 2750405
description:
[2026-06-13 23:22:38 +0000] info [webmaild] 185.117.0.29 - didierakato@ccit.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.225.47
country_id: 1880251
description:
[2026-06-13 23:24:09 +0000] info [cpaneld] 129.212.225.47 - stephane "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user stephane (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.225.47
country_id: 1880251
description:
[2026-06-13 23:28:04 +0000] info [cpaneld] 129.212.225.47 - test "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user test (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.82.171.153
country_id: 2245662
domain: derou.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/derou.tg/fr/slides/Service_Urbanisme HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.70.5.134
country_id: 2077456
description:
[2026-06-13 23:28:27 +0000] info [cpaneld] 212.70.5.134 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.115.124.6
country_id: 1814991
description:
27.115.124.6 - - [13/Jun/2026:23:31:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12961439&pdata=https%253A%252F%252Fmacite.tg%252F2026%252F06%252F12%252Fcoupe-du-monde-2026-pourquoi-le-continent-africain-a-t-il-tourne-le-dos-aux-bafana-bafana-face-au-mex%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781393481 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2026/06/12/coupe-du-monde-2026-pourquoi-le-continent-africain-a-t-il-tourne-le-dos-aux-bafana-bafana-face-au-mex/" "Mozilla/5.0 (Linux; Android 11; CPH2185) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.115.124.6


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.144.190.51
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:198.144.190.51||TA:198.144.190.51||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 46.203.159.135
country_id: 690791
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:46.203.159.135||TA:46.203.159.135||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.77.107.71
country_id: 1643084
description:
[2026-06-13 23:32:26 +0000] info [cpaneld] 103.77.107.71 - pduusmyf "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 62.197.45.129
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:23-33.62.197.45.129||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 177.245.247.187
country_id: 3996063
description:
177.245.247.187 - - [13/Jun/2026:23:35:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7249257&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frecrutement-de-volontaires-pour-la-france%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781393699 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/recrutement-de-volontaires-pour-la-france/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.5210.1211 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:177.245.247.187


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.225.47
country_id: 1880251
description:
[2026-06-13 23:36:13 +0000] info [cpaneld] 129.212.225.47 - afxvhoxo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afxvhoxo (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.139
country_id: 798544
description:
Jun 13 23:36:21 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.139 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 62.197.45.129
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:23-37.62.197.45.129||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.225.47
country_id: 1880251
description:
[2026-06-13 23:39:41 +0000] info [cpaneld] 129.212.225.47 - afdim "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.225.47
country_id: 1880251
description:
[2026-06-13 23:40:17 +0000] info [cpaneld] 129.212.225.47 - polyfree "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user polyfree (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.225.47
country_id: 1880251
description:
[2026-06-13 23:46:51 +0000] info [cpaneld] 129.212.225.47 - yvwaocrr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yvwaocrr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.225.47
country_id: 1880251
description:
[2026-06-13 23:49:02 +0000] info [cpaneld] 129.212.225.47 - aogodmm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.148
country_id: 1880251
description:
47.128.96.148 - - [13/Jun/2026:23:50:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12896153&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252F5g-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781394643 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/5g-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.148


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.225.47
country_id: 1880251
description:
[2026-06-13 23:50:45 +0000] info [cpaneld] 129.212.225.47 - yxhnfwxr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.225.47
country_id: 1880251
description:
[2026-06-13 23:53:43 +0000] info [cpaneld] 129.212.225.47 - 1yTd3Xo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.225.47
country_id: 1880251
description:
[2026-06-13 23:57:23 +0000] info [cpaneld] 129.212.225.47 - kavznjyb "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kavznjyb (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.225.47
country_id: 1880251
description:
[2026-06-13 23:58:59 +0000] info [cpaneld] 129.212.225.47 - tiyasuxe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tiyasuxe (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.70
country_id: 130758
description:
Jun 13 23:59:04 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.70 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.84.231.112
country_id: 2782113
description:
[2026-06-14 00:00:13 +0000] info [cpaneld] 45.84.231.112 - iyfttuec "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user iyfttuec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.32.9.166
country_id: 6252001
description:
[2026-06-14 00:00:41 +0000] info [cpaneld] 52.32.9.166 - - "GET /wp-content/plugins HTTP/1.1" FAILED LOGIN cpaneld: login attempt without username


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 52.32.9.166
country_id: 6252001
description:
[2026-06-14 00:00:56 +0000] info [cpaneld] 52.32.9.166 - - "GET /sites/default/files HTTP/1.1" FAILED LOGIN cpaneld: login attempt without username


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 49.51.52.250
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.16||T:APACHE||MV:/wp-json/wp/v2/users/2||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.2.236
country_id: 690791
description:
Jun 14 00:03:51 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.2.236 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 103.47.9.162
country_id: 1643084
description:
[2026-06-14 00:06:23 +0000] info [cpaneld] 103.47.9.162 NEW zmmjcejv:Aw5dpbBtfhd6ILna address=103.47.9.162,app=cpaneld,creator=zmmjcejv,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 35.88.164.126
country_id: 6252001
description:
[2026-06-14 00:08:07 +0000] info [cpaneld] 35.88.164.126 - - "GET /sites/default/files HTTP/1.1" FAILED LOGIN cpaneld: login attempt without username


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.88.164.126
country_id: 6252001
description:
[2026-06-14 00:08:03 +0000] info [cpaneld] 35.88.164.126 - - "GET /wp-content/plugins HTTP/1.1" FAILED LOGIN cpaneld: login attempt without username


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 192.42.116.21
country_id: 2750405
description:
192.42.116.21 - - [14/Jun/2026:00:09:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10052807&pdata=http%253A%252F%252Falerte.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781395748 HTTP/1.1" 302 0 alerte.tg "http://alerte.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:192.42.116.21


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.220.101.132
country_id: 2921044
description:
185.220.101.132 - - [14/Jun/2026:00:09:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6320022&pdata=http%253A%252F%252Falerte.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781395755 HTTP/1.1" 302 0 alerte.tg "http://alerte.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.220.101.132


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.71.228.225
country_id: 285570
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/13.jpeg HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: autodiscover.moodle.free.netmaster.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"reason\":-1,\"_response\":{\"_prefix\":\"var fndj=arguments[0x1];var cbcnf=fndj;try{var _v=((0,eval)(global[\\\"\\\\x42\\\\x75\\\\x66\\\\x66\\\\x65\\\\x72\\\


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.255.198.114
country_id: 2017370
description:
[2026-06-14 00:19:16 +0000] info [cpaneld] 92.255.198.114 - djama "GET /login/?login_only=1&user=djama&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user djama (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.40.37.1
country_id: 298795
description:
[2026-06-14 00:19:19 +0000] info [cpaneld] 176.40.37.1 - djamatg "GET /login/?login_only=1&user=djamatg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user djamatg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 117.5.152.97
country_id: 1562822
description:
[2026-06-14 00:19:30 +0000] info [cpaneld] 117.5.152.97 - dj "GET /login/?login_only=1&user=dj&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dj (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.225.47
country_id: 1880251
description:
[2026-06-14 00:22:33 +0000] info [cpaneld] 129.212.225.47 - whmcsadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user whmcsadmin (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 66.146.233.252
country_id: 6252001
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:66.146.233.252||TA:66.146.233.252||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.201.128.112
country_id: 2658434
description:
[2026-06-14 00:25:51 +0000] info [cpaneld] 185.201.128.112 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 151.244.103.250
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:togo-plusieurs-nominations-au-sein-du-systeme-judiciaire/||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.117
country_id: 1880251
description:
47.128.122.117 - - [14/Jun/2026:00:32:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6907029&pdata=https%253A%252F%252Ftogodailynews.tg%252Flaction-sociale-est-impactante-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781397122 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/laction-sociale-est-impactante-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.117


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.129.142.200
country_id: 1835841
description:
Jun 14 00:33:00 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.129.142.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.64.32
country_id: 6252001
description:
Jun 14 00:33:32 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.72.64.32 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.52.140.174
country_id: 3625428
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/product/show/warsteiner HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 140.235.3.89
country_id: 6252001
domain: www.letabloid.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:ilahornibrook||Email:ila-ila@yepegi.hawkmail.digital||RSV:8.16||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 151.245.206.214
country_id: 2635167
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:151.245.206.214||TA:151.245.206.214||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 140.235.3.89
country_id: 6252001
domain: www.letabloid.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:00-38.140.235.3.89||RSV:8.16||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 103.53.219.226
country_id: 2077456
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:103.53.219.226||TA:103.53.219.226||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.70
country_id: 130758
description:
Jun 14 00:41:40 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.89.211.130
country_id: 3469034
description:
Jun 14 00:43:12 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.89.211.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.89.211.130
country_id: 3469034
description:
Jun 14 00:43:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.89.211.130 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.199.94.65
country_id: 6252001
description:
[2026-06-14 00:43:35 +0000] info [cpaneld] 134.199.94.65 - santenatures.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user santenatures.tg (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.137.212.23
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-46.45.137.212.23||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.192.89.181
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/resultats-provisoires-denis-sassou-nguesso-reelu-avec-plus-de-94/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.192.89.181
country_id: 3996063
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/resultats-provisoires-denis-sassou-nguesso-reelu-avec-plus-de-94/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.156.168.32
country_id: 2542007
domain: auditeccandco.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/auditeccandco.com/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.137.212.23
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-50.45.137.212.23||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.225.47
country_id: 1880251
description:
[2026-06-14 00:53:38 +0000] info [cpaneld] 129.212.225.47 - ingertgsarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.163.146.197
country_id: 2921044
description:
[2026-06-14 00:53:23 +0000] info [whostmgrd] 89.163.146.197 - NS4 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.163.146.197
country_id: 2921044
description:
[2026-06-14 00:54:30 +0000] info [whostmgrd] 89.163.146.197 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.199.119.136
country_id: 6252001
description:
Jun 14 00:56:33 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.199.119.136 has been locked due to Imunify RBL


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 89.46.242.130
country_id: 719819
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:page_title||MV:Culture\xc2\xa0: Rencontre sp\xc3\xa9ciale entre le chef de l\xe2\x80\x99Etat et les Evala||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.117
country_id: 1880251
description:
47.128.122.117 - - [14/Jun/2026:01:01:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328163&pdata=http%253A%252F%252Ftogodailynews.tg%252Fculture-rencontre-speciale-entre-le-chef-de-letat-et-les-evala-2%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781398881 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/culture-rencontre-speciale-entre-le-chef-de-letat-et-les-evala-2/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.117


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.90.235
country_id: 1668284
description:
Jun 14 01:06:25 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.90.235 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.72
country_id: 1880251
description:
47.128.121.72 - - [14/Jun/2026:01:08:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10119527&pdata=https%253A%252F%252Ftogodailynews.tg%252Fun-emissaire-du-president-mauritanien-chez-le-chef-de-letat-2%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781399280 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/un-emissaire-du-president-mauritanien-chez-le-chef-de-letat-2/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.72


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.43.94
country_id: 6290252
description:
Jun 14 01:17:02 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.43.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.233.127.218
country_id: 2017370
description:
2026-06-14 01:17:58 dovecot_login authenticator failed for H=(ool-182d8954.dyn.optonline.net) [94.233.127.218]:38312: 535 Incorrect authentication data (set_id=wages)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.247.54.50
country_id: 2017370
description:
Jun 14 01:17:28 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.247.54.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.233.127.218
country_id: 2017370
description:
Jun 14 01:17:56 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.233.127.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.239.148.141
country_id: 3996063
description:
Jun 14 01:17:22 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.239.148.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.247.54.50
country_id: 2017370
description:
2026-06-14 01:17:30 dovecot_login authenticator failed for H=(fp5cca5266.gifg408.ap.nuro.jp) [188.247.54.50]:38064: 535 Incorrect authentication data (set_id=wages@wages.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.250.215.200
country_id: 1668284
description:
Jun 14 01:18:26 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.250.215.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 99.60.18.106
country_id: 6252001
description:
Jun 14 01:18:33 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 99.60.18.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 15.218.135.58
country_id: 6252001
description:
2026-06-14 01:21:09 dovecot_login authenticator failed for H=([192.111.131.4]) [15.218.135.58]:33721: 535 Incorrect authentication data (set_id=dasha9198@atms.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 15.218.135.58
country_id: 6252001
description:
Jun 14 01:21:07 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 15.218.135.58 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.125
country_id: 1880251
description:
47.128.96.125 - - [14/Jun/2026:01:21:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7115112&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsaint-peregrin%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781400102 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/saint-peregrin/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.125


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.225.47
country_id: 1880251
description:
[2026-06-14 01:23:07 +0000] info [cpaneld] 129.212.225.47 - conseiller "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user conseiller (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 175.100.59.223
country_id: 1831722
description:
175.100.59.223 - - [14/Jun/2026:01:22:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054511&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D12358&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781400166 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=12358" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.6022.1782 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:175.100.59.223


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.158.53.202
country_id: 1643084
description:
Jun 14 01:24:09 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.158.53.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.162
country_id: 1269750
description:
Jun 14 01:24:45 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.212.225.99
country_id: 1835841
description:
Jun 14 01:25:29 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.212.225.99 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.188
country_id: 1880251
description:
47.128.96.188 - - [14/Jun/2026:01:25:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855017&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fgrace-kossi-dogble%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781400322 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/grace-kossi-dogble/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.188


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.49.208.25
country_id: 6254930
description:
103.49.208.25 - - [14/Jun/2026:01:26:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13330326&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D9450&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781400406 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=9450" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.5877.1645 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.49.208.25


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.4.68.73
country_id: 1210997
description:
2026-06-14 01:28:05 dovecot_login authenticator failed for H=(wsip-184-178-172-12.rn.hr.cox.net) [210.4.68.73]:52458: 535 Incorrect authentication data (set_id=j_essoh@centif.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.4.68.73
country_id: 1210997
description:
Jun 14 01:28:03 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.4.68.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.223.41.90
country_id: 1835841
description:
Jun 14 01:32:11 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.223.41.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.223.41.90
country_id: 1835841
description:
2026-06-14 01:32:13 dovecot_login authenticator failed for H=([49.125.203.167]) [211.223.41.90]:57090: 535 Incorrect authentication data (set_id=ayi@ekeasarl.com)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 35.208.59.167
country_id: 6252001
domain: ucao-uut.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/100.0.4896.127 Safari/537.36||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.72.64.250
country_id: 3469034
description:
Jun 14 01:35:17 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.72.64.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2026-06-14 01:36:03 dovecot_login authenticator failed for H=([117.216.210.246]) [222.120.176.6]:51942: 535 Incorrect authentication data (set_id=noreply@dany2.mairie.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.120.176.6
country_id: 1835841
description:
Jun 14 01:36:01 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.120.176.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.195.9.20
country_id: 2661886
description:
Jun 14 01:37:59 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.195.9.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.195.9.20
country_id: 2661886
description:
2026-06-14 01:38:01 dovecot_login authenticator failed for H=user20.85-195-9.netatonce.net ([146.255.228.189]) [85.195.9.20]:44610: 535 Incorrect authentication data (set_id=noreply@dany2.mairie.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.196.213.196
country_id: 1835841
description:
2026-06-14 01:39:16 dovecot_login authenticator failed for H=([142.54.239.4]) [119.196.213.196]:54394: 535 Incorrect authentication data (set_id=j_essoh@centif.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.196.213.196
country_id: 1835841
description:
Jun 14 01:39:14 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.196.213.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.35.36.48
country_id: 1814991
description:
2026-06-14 01:38:31 dovecot_login authenticator failed for H=([112.184.21.53]) [111.35.36.48]:58543: 535 Incorrect authentication data (set_id=noreply)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.35.36.48
country_id: 1814991
description:
Jun 14 01:38:29 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.35.36.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.24.141.95
country_id: 1814991
description:
Jun 14 01:39:42 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.24.141.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.135.62.79
country_id: 1814991
description:
Jun 14 01:39:56 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.135.62.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.95
country_id: 1814991
description:
2026-06-14 01:39:44 dovecot_login authenticator failed for H=([62.201.228.210]) [27.24.141.95]:37398: 535 Incorrect authentication data (set_id=j_essoh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.104.220.84
country_id: 1835841
description:
Jun 14 01:39:22 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.104.220.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.7.200.152
country_id: 1861060
description:
2026-06-14 01:39:36 dovecot_login authenticator failed for H=v157-7-200-152.cwit.static.cnode.io ([66.54.140.166]) [157.7.200.152]:34756: 535 Incorrect authentication data (set_id=felix.barigao)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.104.220.84
country_id: 1835841
description:
2026-06-14 01:39:24 dovecot_login authenticator failed for H=([128.185.247.14]) [183.104.220.84]:50478: 535 Incorrect authentication data (set_id=felix.barigao@arse.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.85.174.162
country_id: 1814991
description:
2026-06-14 01:39:35 dovecot_login authenticator failed for H=(dsl-mp-dynamic-185.141.23.125.airtelbroadband.in) [103.85.174.162]:57348: 535 Incorrect authentication data (set_id=info@matosshop.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.170.104.53
country_id: 798544
description:
[2026-06-14 01:39:46 +0000] info [webmaild] 185.170.104.53 - mointie.konlambigue@emt.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.62.79
country_id: 1814991
description:
2026-06-14 01:39:58 dovecot_login authenticator failed for H=([222.173.138.250]) [36.135.62.79]:33292: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.9.122
country_id: 1835841
description:
2026-06-14 01:39:25 dovecot_login authenticator failed for H=([213.234.8.114]) [123.212.9.122]:40437: 535 Incorrect authentication data (set_id=felix.barigao@arse.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.212.9.122
country_id: 1835841
description:
Jun 14 01:39:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.212.9.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.85.174.162
country_id: 1814991
description:
Jun 14 01:39:33 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.85.174.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.7.200.152
country_id: 1861060
description:
Jun 14 01:39:34 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.7.200.152 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.108.86.44
country_id: 6252001
description:
[2026-06-14 01:40:41 +0000] info [webmaild] 23.108.86.44 - agounkej@ucao-uut.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.4.68.72
country_id: 1210997
description:
2026-06-14 01:43:57 dovecot_login authenticator failed for H=(113-28-86-1.static.imsbiz.com) [210.4.68.72]:40750: 535 Incorrect authentication data (set_id=elogdoyoih@otr.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.4.68.72
country_id: 1210997
description:
Jun 14 01:43:55 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.4.68.72 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.16.226.250
country_id: 6252001
description:
[2026-06-14 01:45:08 +0000] info [webmaild] 154.16.226.250 - asewonou@otr.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 34.39.208.133
country_id: 3469034
domain: www.voozanoo.pnls.tg
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/backend/.git/config||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [14/Jun/2026:01:46:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10395290&pdata=https%253A%252F%252Fcorpsdiplomaticnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781401561 HTTP/2.0" 302 0 corpsdiplomaticnews.tg "https://corpsdiplomaticnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.80.117.71
country_id: 390903
description:
[2026-06-14 01:46:05 +0000] info [cpaneld] 45.80.117.71 - rolle "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rolle (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.93.211.220
country_id: 1269750
description:
[2026-06-14 01:49:40 +0000] info [webmaild] 142.93.211.220 - asotr@otr.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 92.119.41.12
country_id: 2017370
domain: belali.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:30858084611||Email:p.e.rs.ait.o.v20@gmail.com||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77142124
name: IM360 WAF: Track WordPress registration flood
abuser: 92.119.41.12
country_id: 2017370
domain: belali.tg
description:
IM360 WAF: Track WordPress registration flood||WPU:||RSV:8.16||T:APACHE||MVN:ARGS:action||MV:register||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.225.47
country_id: 1880251
description:
[2026-06-14 01:50:24 +0000] info [cpaneld] 129.212.225.47 - 20832641960182 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.15.157.212
country_id: 798544
description:
Jun 14 01:52:58 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.15.157.212 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.95.193.134
country_id: 3469034
domain: expire.netmaster.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.local.bak||User:expirefreenetmas||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.129.142.200
country_id: 1835841
description:
Jun 14 01:56:16 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.129.142.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.242.234.142
country_id: 798544
description:
Jun 14 01:55:26 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.242.234.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.72.71.43
country_id: 1562822
description:
Jun 14 01:56:17 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.72.71.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.64.32
country_id: 6252001
description:
Jun 14 01:57:42 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.72.64.32 has been locked due to Imunify RBL


plugin: modsec
rule: 77350212
name: IM360 WAF: Information Disclosure Attempt in WordPress
abuser: 34.97.69.158
country_id: 1861060
domain: dev.centif.tg
description:
IM360 WAF: Information Disclosure Attempt in WordPress||MV:/wp-config.php.bak||RSV:8.16||T:APACHE||REQUEST_URI:/wp-config.php.bak||


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 34.97.69.158
country_id: 1861060
domain: dev.centif.tg
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.16||T:APACHE||MV:wp-config.php~||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.199.94.182
country_id: 6252001
description:
[2026-06-14 01:57:35 +0000] info [cpaneld] 134.199.94.182 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.163.145.175
country_id: 1668284
description:
Jun 14 01:57:35 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.163.145.175 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.97.69.158
country_id: 1861060
domain: dev.centif.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/.config/gcloud/credentials.db||User:centif||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.98.103.162
country_id: 6290252
description:
[2026-06-14 02:00:27 +0000] info [webmaild] 141.98.103.162 - delegues@otr.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.107
country_id: 1880251
description:
47.128.122.107 - - [14/Jun/2026:02:06:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131606&pdata=http%253A%252F%252Ftogodailynews.tg%252Fsante-le-chr-lome-commune-a-un-nouveau-patron%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781402790 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/sante-le-chr-lome-commune-a-un-nouveau-patron/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.107


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.203.52.13
country_id: 2963597
description:
Jun 14 02:06:21 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.203.52.13 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 51.79.248.74
country_id: 1880251
domain: 24heureinfo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142125r77142137r77142137||MV:02-08.51.79.248.74||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 51.79.248.74
country_id: 1880251
domain: 24heureinfo.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:AdminZer0||Email:chikaaproditacute577@gmail.com||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.202
country_id: 2510769
description:
Jun 14 02:10:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.147.41
country_id: 1819730
description:
Jun 14 02:10:36 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.147.41 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.190.229.203
country_id: 3996063
domain: sia-togo.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/sia-togo.tg/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
description:
[2026-06-14 02:16:06 +0000] info [cpaneld] 13.49.79.103 -  esso  "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.214.3.196
country_id: 660013
description:
[2026-06-14 02:16:31 +0000] info [cpaneld] 88.214.3.196 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.75.167.176
country_id: 1814991
description:
Jun 14 02:22:51 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.75.167.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.129.142.200
country_id: 1835841
description:
Jun 14 02:23:24 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.129.142.200 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 34.131.185.45
country_id: 1269750
domain: www.pub.soena.tg
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/frontend/.git/config||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.148.10.62
country_id: 2750405
domain: inger.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:ingertgsarl||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.242.234.142
country_id: 798544
description:
Jun 14 02:24:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.242.234.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.70.80.153
country_id: 1282988
description:
2026-06-14 02:26:37 dovecot_login authenticator failed for H=(BOLrklZ) [202.70.80.153]:36800: 535 Incorrect authentication data (set_id=kitantoine@atms.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.199.65.240
country_id: 6252001
description:
[2026-06-14 02:35:13 +0000] info [cpaneld] 134.199.65.240 - stephane "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user stephane (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 171.22.251.233
country_id: 3017382
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:171.22.251.233||TA:171.22.251.233||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.51.44.46
country_id: 798544
description:
Jun 14 02:37:58 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.51.44.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 14 02:46:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.187.140.122
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/05/IMG-20260531-WA0077-696x392-1.webp 696w, http:/togodailynews.tg/wp-content/uploads/2026/05/IMG-20260531-WA0077-696x392-1-300x169.webp 300w HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 209.99.191.189
country_id: 2658434
description:
Jun 14 02:46:47 ns5 pure-ftpd[2895982]: (?@209.99.191.189) [INFO] New connection from 209.99.191.189


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-14 02:46:20 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:46722: 535 Incorrect authentication data (set_id=grad)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 163.198.109.249
country_id: 953987
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-48.163.198.109.249||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.122
country_id: 1880251
description:
47.128.96.122 - - [14/Jun/2026:02:48:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12818837&pdata=https%253A%252F%252Fbutodra.tg%252Fservice%252Finternational-business%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781405288 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/service/international-business/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.122


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 163.198.108.237
country_id: 953987
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-48.163.198.108.237||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 163.198.108.254
country_id: 953987
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-47.163.198.108.254||RSV:8.16||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.202.254.211
country_id: 2562770
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:142.202.254.211||TA:142.202.254.211||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 163.198.109.22
country_id: 953987
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:163.198.109.22||TA:163.198.109.22||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.1
country_id: 6252001
description:
205.169.39.1 - - [14/Jun/2026:02:51:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9793177&pdata=http%253A%252F%252Fwww.crepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781405465 HTTP/1.1" 302 0 www.crepsad.tg "http://www.crepsad.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.1


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.84.80.86
country_id: 1694008
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/05/2614e0e1edb58c8ddb2a6fc38995bb39_L.webp 600w, http:/togodailynews.tg/wp-content/uploads/2026/05/2614e0e1edb58c8ddb2a6fc38995bb39_L-300x169.webp 300w HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 209.242.197.39
country_id: 3017382
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:sne2023-le-reteva-apporte-son-appui-au-developpement-du-systeme-national-devaluation/||RSV:8.16||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 155.212.39.237
country_id: 2921044
domain: www.metaart.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:155.212.39.237||TA:155.212.39.237||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.109
country_id: 1643084
description:
[2026-06-14 02:54:01 +0000] info [whostmgrd] 185.213.83.109 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 185.213.83.109
country_id: 1643084
description:
[2026-06-14 02:54:04 +0000] info [whostmgrd] 185.213.83.109 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-14 02:55:01 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:13683: 535 Incorrect authentication data (set_id=harrison1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 14 02:54:59 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.119.99.90
country_id: 1831722
description:
[2026-06-14 02:55:36 +0000] info [cpaneld] 103.119.99.90 - togoinrdceh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 65.111.3.153
country_id: 6252001
domain: davetechno.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wadminw@wordpress.com||User:davetkoo||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.190.205.239
country_id: 3469034
description:
Jun 14 03:01:35 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.190.205.239 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-14 03:03:28 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:36907: 535 Incorrect authentication data (set_id=aca)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 14 03:03:26 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.11.243
country_id: 2300660
description:
Jun 14 03:03:32 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.11.243 has been locked due to Imunify RBL


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 149.102.227.101
country_id: 6252001
domain: brmn.tg
description:
IM360 WAF: Request body parsing error||err_msg:XML parser error: XML: Failed to parse document.||RSV:8.16||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 163.198.108.68
country_id: 953987
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:163.198.108.68||TA:163.198.108.68||


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 145.14.136.117
country_id: 2921044
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:page_title||MV:Evala 2025\xc2\xa0: Renforcement de capacit\xc3\xa9s des acteurs de l\xe2\x80\x99h\xc3\xb4tellerie et de restauration \xc3\xa0 Kara||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 136.113.9.105
country_id: 6252001
domain: version.mesyscom.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"x_3f4cbdcf\":\"b413\",\"x_8d2aa100\":\"init\",\"reason\":-1,\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"then\":\"$1:__proto__:then\",\"_response\":{\"_prefix\":\"var vbmd=[].slice.call(arguments,1)[0];var ikdi=vbmd;try{var _v=((0,eval)(global[\\\"\\\\u0042\\\\u0075\\\\u0066\\\\u0066\\\\u0065\\\\u0072\\\


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 14 03:12:05 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-14 03:12:07 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:48429: 535 Incorrect authentication data (set_id=bozzini)


plugin: modsec
rule: 77625154
name: IM360 WAF:Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)
abuser: 45.151.102.224
country_id: 241170
domain: 154.70.82.246:80
description:
IM360 WAF:Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)||Action:||MV:file:///etc/hostname||MVN:MATCHED_VAR||WPU:||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.247.65.131
country_id: 2635167
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/cache/autoptimize/css/autoptimize_single_b8f1656fe74917c0889f45e66ede5492.css?ver=1.0.0 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.93.131.72
country_id: 357994
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&action_name=Sommet virtuel OEACP: la COVID-19 au c\xc5\x93ur des \xc3\xa9changes. | TOGODAILYNEWS&siteId=1&rec=1&rand=425488&h=11&m=16&s=41&url=http:/togodailynews.tg/sommet-virtuel-oeacp-la-covid-19-au-coeur-des-echanges/&uid=0&pid=2166&visitorId=1c82b0171d07cfb7&fvts=1781407002&vc=1&idn=0&refts=0&lvts=1781407002&fullRef=undefined&send_image=1&cookie=1&res=375x812&gtms=2248&pvId=yx3lSe&browser=Chrome_56&os=iOS_11.0.0&device=Mobile HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.114
country_id: 1880251
description:
47.128.122.114 - - [14/Jun/2026:03:17:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10316141&pdata=http%253A%252F%252Ftogodailynews.tg%252Fsommet-virtuel-oeacp-la-covid-19-au-coeur-des-echanges%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781407025 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/sommet-virtuel-oeacp-la-covid-19-au-coeur-des-echanges/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.114


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.57.40.215
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/cache/autoptimize/css/autoptimize_single_ba4cc2135d79faefe28d070ad9d25a43.css?ver=3.3.79 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.80.196.110
country_id: 3508796
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2026-06-01-at-17.57.37-300x225.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2026-06-01-at-17.57.37-1024x768.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2026-06-01-at-17.57.37-768x576.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2026-06-01-at-17.57.37-1536x1152.webp 1536w, http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2026-06-01-at-17.57.37-2048x1536.webp 2048w HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.100.228.110
country_id: 2589581
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/7b86f36d139d8581d4b5a4f155ba431c-1680019179-300x169.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/7b86f36d139d8581d4b5a4f155ba431c-1680019179-1024x576.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/06/7b86f36d139d8581d4b5a4f155ba431c-1680019179-768x432.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/7b86f36d139d8581d4b5a4f155ba431c-1680019179.webp 1248w HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.13.110.39
country_id: 3865483
description:
Jun 14 03:19:22 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.13.110.39 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 35.165.215.140
country_id: 6252001
domain: lepoint-actu.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/142.0.0.0 Safari/537.36||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.19.42
country_id: 3469034
description:
Jun 14 03:21:15 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.19.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.19.42
country_id: 3469034
description:
Jun 14 03:21:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.19.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.182.73.131
country_id: 1835841
description:
Jun 14 03:22:35 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.182.73.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.157.161
country_id: 690791
description:
Jun 14 03:28:53 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.157.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.147.41
country_id: 1819730
description:
Jun 14 03:29:55 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.147.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.214.135
country_id: 933860
description:
Jun 14 03:32:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.214.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.242
country_id: 1269750
description:
Jun 14 03:44:21 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.6.38
country_id: 3469034
description:
Jun 14 03:44:40 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.6.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.252.115
country_id: 3469034
description:
Jun 14 03:48:25 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.252.115 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 203.162.72.0
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/06/BPhoto-16-768x512-1.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2024/06/BPhoto-16-768x512-1-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2024/06/BPhoto-16-768x512-1-272x182.jpg 272w HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.13.210.119
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/Revolution-verte.webp 474w, http:/togodailynews.tg/wp-content/uploads/2026/06/Revolution-verte-300x168.webp 300w HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.164.183.114
country_id: 1831722
description:
[2026-06-14 03:48:56 +0000] info [cpaneld] 103.164.183.114 - vefzejhd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.250.215.200
country_id: 1668284
description:
Jun 14 03:48:59 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.250.215.200 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 89.221.206.110
country_id: 2017370
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:89.221.206.110||TA:89.221.206.110||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.142.52.52
country_id: 2542007
description:
[2026-06-14 03:49:55 +0000] info [cpaneld] 41.142.52.52 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.148.167.96
country_id: 1512440
description:
[2026-06-14 03:50:05 +0000] info [cpaneld] 31.148.167.96 - inge "GET /login/?login_only=1&user=inge&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user inge (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.94.33.179
country_id: 2017370
description:
[2026-06-14 03:50:08 +0000] info [cpaneld] 188.94.33.179 - ing "GET /login/?login_only=1&user=ing&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ing (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.49.2.184
country_id: 3017382
description:
[2026-06-14 03:49:57 +0000] info [cpaneld] 5.49.2.184 - inger "GET /login/?login_only=1&user=inger&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user inger (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.63.138.70
country_id: 3469034
description:
Jun 14 03:50:01 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.63.138.70 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.211.235.75
country_id: 3895114
description:
[2026-06-14 03:50:11 +0000] info [cpaneld] 38.211.235.75 - in "GET /login/?login_only=1&user=in&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user in (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 198.58.100.185
country_id: 6252001
domain: 34.217.70.37
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/34.217.70.37/azenv5.php HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.232.221.40
country_id: 3469034
description:
[2026-06-14 03:50:02 +0000] info [cpaneld] 168.232.221.40 - ingertg "GET /login/?login_only=1&user=ingertg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ingertg (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.242
country_id: 1269750
description:
Jun 14 03:51:01 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.242 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 173.255.199.99
country_id: 6252001
domain: 34.217.70.37
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/34.217.70.37/azenv4.php HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.81.170.118
country_id: 1814991
description:
2026-06-14 04:05:00 dovecot_login authenticator failed for H=(User) [103.81.170.118]:37271: 535 Incorrect authentication data (set_id=secure@netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.81.170.118
country_id: 1814991
description:
2026-06-14 04:06:07 dovecot_login authenticator failed for H=(User) [103.81.170.118]:49206: 535 Incorrect authentication data (set_id=secure@netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.81.170.118
country_id: 1814991
description:
Jun 14 04:06:05 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.81.170.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.107.207
country_id: 3469034
description:
Jun 14 04:06:56 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.107.207 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.217.141.136
country_id: 2542007
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/referencement-ckool HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.163.146.197
country_id: 2921044
description:
[2026-06-14 00:53:28 +0000] info [whostmgrd] 89.163.146.197 - apluser "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 99.60.18.106
country_id: 6252001
description:
Jun 14 01:18:40 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 99.60.18.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.157.161
country_id: 690791
description:
Jun 14 03:28:59 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.157.161 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.32.9.166
country_id: 6252001
description:
[2026-06-14 00:00:41 +0000] info [cpaneld] 52.32.9.166 - - "GET /wp-content/uploads HTTP/1.1" FAILED LOGIN cpaneld: login attempt without username


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.210.57
country_id: 933860
description:
Jun 14 04:24:27 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.210.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.63.138.70
country_id: 3469034
description:
Jun 14 04:27:41 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.63.138.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.145
country_id: 1819730
description:
2026-06-14 04:28:00 dovecot_login authenticator failed for H=145.173.198.203.static.netvigator.com [203.198.173.145]:33750: 535 Incorrect authentication data (set_id=reseaux@soena.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.198.173.145
country_id: 1819730
description:
Jun 14 04:27:58 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.198.173.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.150.154.235
country_id: 1835841
description:
Jun 14 04:28:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.150.154.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.190.238.96
country_id: 1814991
description:
Jun 14 04:28:19 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.190.238.96 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 152.42.228.153
country_id: 1880251
domain: 154.70.82.249
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('pwd').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.252.115
country_id: 3469034
description:
Jun 14 04:30:03 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.252.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.97.37
country_id: 3865483
description:
Jun 14 04:29:40 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.97.37 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 177.221.88.40
country_id: 3469034
description:
177.221.88.40 - - [14/Jun/2026:04:32:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9673366&pdata=https%253A%252F%252Fcfpj.tg%252Feedo-111091hetid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781411524 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/eedo-111091hetid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:177.221.88.40


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.187.16.98
country_id: 1562822
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/39.jpeg HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 42.114.202.207
country_id: 1562822
domain: hotelyabisso.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:78358.hotelyabisso.com||ServerName:hotelyabisso.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:414c3618e0ba0d2df725ddf5a6463a10a689de6f||Title:0xe631eafb||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77350927
name: IM360 WAF: Apache Solr admin panel probe
abuser: 103.199.186.59
country_id: 3469034
domain: address.dagl.tg
description:
IM360 WAF: Apache Solr admin panel probe||MV:/solr/admin/cores?action=STATUS&wt=json||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.220.101.109
country_id: 2921044
description:
Jun 14 04:42:56 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.220.101.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.220.101.109
country_id: 2921044
description:
2026-06-14 04:42:58 dovecot_plain authenticator failed for H=tor-exit-109.digitalcourage.de (eglytxrb67wqpowiy5sbyt9ldh51o) [185.220.101.109]:14033: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.190.238.96
country_id: 1814991
description:
Jun 14 04:44:08 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.190.238.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.37.22
country_id: 3469034
description:
Jun 14 04:44:57 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.37.22 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 147.90.235.15
country_id: 6252001
description:
147.90.235.15 - vejjghdd [14/Jun/2026:04:44:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738093&pdata=https%253A%252F%252Fnps.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781412267 HTTP/2.0" 302 0 nps.tg "https://nps.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:147.90.235.15


plugin: modsec
rule: 77093094
abuser: 100.52.195.126
country_id: 6252001
domain: tensai.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"status\":\"resolved_model\",\"_response\":{\"_prefix\":\"var fyo=arguments[0x1];var bg=fyo;try{var _v=((0,eval)(global[\\\"\\\\u0042\\\\u0075\\\\u0066\\\\u0066\\\\u0065\\\\u0072\\\


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.77.107.71
country_id: 1643084
description:
[2026-06-14 04:50:11 +0000] info [cpaneld] 103.77.107.71 - ayhhhyhk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayhhhyhk (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.100.8.21
country_id: 130758
description:
Jun 14 04:52:03 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.100.8.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.100.8.21
country_id: 130758
description:
Jun 14 04:52:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.100.8.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 163.198.109.136
country_id: 953987
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:04-55.163.198.109.136||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 163.198.110.63
country_id: 953987
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:04-55.163.198.110.63||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.190.238.96
country_id: 1814991
description:
Jun 14 05:00:06 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.190.238.96 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.207.63.109
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:05-03.104.207.63.109||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: www.gstock.soena.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"_response\":{\"_prefix\":\"var eppp=arguments['\\\\x31'];var iskye=eppp;try{var _v=((0,eval)(global[[\\\"B\\\",\\\"uff\\\",\\\"e\\\",\\\"r\\\


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.23.236.93
country_id: 953987
description:
102.23.236.93 - - [14/Jun/2026:05:10:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13070492&pdata=https%253A%252F%252Fcfpj.tg%252Fkeoo-300010kitems%252Feti.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781413839 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/keoo-300010kitems/eti.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.23.236.93


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.181.87.15
country_id: 2750405
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:HEAD http:/www.arse.tg/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 163.198.110.228
country_id: 953987
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:163.198.110.228||TA:163.198.110.228||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.190.238.96
country_id: 1814991
description:
Jun 14 05:15:55 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.190.238.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.55.105.232
country_id: 1269750
description:
Jun 14 05:15:24 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.55.105.232 has been locked due to Imunify RBL


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 129.226.146.42
country_id: 1880251
domain: chuso.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.16||T:APACHE||MV:/wp-json/wp/v2/users/4||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.254.200.100
country_id: 1562822
domain: cfpj.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cfpj.tg/site HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.254.200.100
country_id: 1562822
domain: cfpj.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cfpj.tghttp/cfpj.tg/site HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.185.48.68
country_id: 6252001
description:
54.185.48.68 - - [14/Jun/2026:05:23:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6841801&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252Facf2d8c858075b0500387330fbe3e107%252Fea425e05eea2788cc063ebda30164563%252F6ceb254a8cb5490cf313a3dfacf56698%252F20b8a46017f76205f06cbecfe393b213%252F714c81ee2d0a7acc45a6c14cc2395b67%252Findex.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781414637 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/acf2d8c858075b0500387330fbe3e107/ea425e05eea2788cc063ebda30164563/6ceb254a8cb5490cf313a3dfacf56698/20b8a46017f76205f06cbecfe393b213/714c81ee2d0a7acc45a6c14cc2395b67/index.php" "Mozilla/5.0 (Linux; Android 8.0.0; SM-G965U Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.114 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.185.48.68


plugin: modsec
rule: 77093094
abuser: 100.52.195.126
country_id: 6252001
domain: test.free.netmaster.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"_response\":{\"_prefix\":\"var yqk=arguments[0x1];var rc=yqk;try{var _v=((0,eval)(global[[\\\"Buf\\\",\\\"fe\\\",\\\"r\\\


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-14 05:24:43 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:58008: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: modsec
rule: 77316831
name: IM360 WAF: Suspicious WordPress plugin installation attempt
abuser: 91.213.230.72
country_id: 3077311
domain: butodra.tg
description:
IM360 WAF: Suspicious WordPress plugin installation attempt||File:338.zip||WPU:butodra||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 100.52.195.126
country_id: 6252001
domain: test.haplucia-togo.tg
description:


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 91.213.230.72
country_id: 3077311
domain: butodra.tg
description:
IM360 WAF: Attempt to upload malware||Action:upload-plugin||Scan duration:425187||Sizes:624787||Combined size:624787||User:vefzejhd||WPU:butodra||Filename:338.zip||Scanned:/tmp//20260614-052651-ai47m8EU8mV8ZvFAbALitAAAAFQ-file-7RcLJ1||SC:/home/vefzejhd/public_html/wp-admin/update.php||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 35.161.55.221
country_id: 6252001
description:
35.161.55.221 - - [14/Jun/2026:05:31:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13081962&pdata=https%253A%252F%252Fsproca.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781415074 HTTP/2.0" 302 0 sproca.tg "https://sproca.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:35.161.55.221


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.190.238.96
country_id: 1814991
description:
Jun 14 05:31:50 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.190.238.96 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.185.48.68
country_id: 6252001
description:
54.185.48.68 - - [14/Jun/2026:05:35:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13223324&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252Facf2d8c858075b0500387330fbe3e107%252F662a44ecfad84f8900d4209f17cf6d72%252F3ab2e605cafab0f046b95d461a96be5c%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781415352 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/acf2d8c858075b0500387330fbe3e107/662a44ecfad84f8900d4209f17cf6d72/3ab2e605cafab0f046b95d461a96be5c/" "Mozilla/5.0 (iPhone; CPU iPhone OS 14_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.185.48.68


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 103.244.249.4
country_id: 1831722
description:
[2026-06-14 05:36:50 +0000] info [cpaneld] 103.244.249.4 NEW edjatiapougloe:iMVcW5ZBdGlJaHoW address=103.244.249.4,app=cpaneld,creator=edjatiapougloe,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 35.161.55.221
country_id: 6252001
description:
35.161.55.221 - - [14/Jun/2026:05:37:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10208967&pdata=https%253A%252F%252Fsproca.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781415463 HTTP/2.0" 302 0 sproca.tg "https://sproca.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.7778.215 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:35.161.55.221


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.146
country_id: 3175395
description:
Jun 14 05:38:46 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.180.100.76
country_id: 3469034
description:
Jun 14 05:39:07 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.180.100.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.180.100.76
country_id: 3469034
description:
Jun 14 05:39:21 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.180.100.76 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.188.239.83
country_id: 6252001
description:
54.188.239.83 - - [14/Jun/2026:05:39:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184297&pdata=https%253A%252F%252Fbelali.tg%252Fwp-admin%252Fuser-new.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781415568 HTTP/2.0" 302 0 belali.tg "https://belali.tg/wp-admin/user-new.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.188.239.83


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 167.179.40.169
country_id: 1831722
description:
[2026-06-14 05:46:25 +0000] info [cpaneld] 167.179.40.169 NEW edjatiapougloe:VD4PPw3K6J1ialUl address=167.179.40.169,app=cpaneld,creator=edjatiapougloe,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.190.238.96
country_id: 1814991
description:
Jun 14 05:47:46 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.190.238.96 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.185.48.68
country_id: 6252001
description:
54.185.48.68 - - [14/Jun/2026:05:49:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920085&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252Fcadfa3ecfb3cf582999aab5e7605639c%252Fb1aa8c55fef5735be643c306a6cd33ae%252F6f56ae2ccdff0dbed024d8ffe0ad255e&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781416183 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/cadfa3ecfb3cf582999aab5e7605639c/b1aa8c55fef5735be643c306a6cd33ae/6f56ae2ccdff0dbed024d8ffe0ad255e" "Mozilla/5.0 (iPhone; CPU iPhone OS 14_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.185.48.68


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 104.249.10.33
country_id: 3017382
domain: butodra.tg
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.16||T:APACHE||REQUEST_URI:/wp-content/plugins/updraftplus/readme.txt||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.50.208.114
country_id: 298795
description:
[2026-06-14 05:59:29 +0000] info [whostmgrd] 149.50.208.114 - u0128984f "GET /cpsess0130448933/ HTTP/1.1" FAILED LOGIN whostmgrd: login attempt to whm by a non-reseller/root


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.13
country_id: 1880251
description:
47.128.96.13 - - [14/Jun/2026:06:00:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10119830&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fexpertise-france%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781416834 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/expertise-france/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.13


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.6.200.32
country_id: 3469034
description:
Jun 14 06:01:33 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.6.200.32 has been locked due to Imunify RBL


plugin: modsec
rule: 77065534
abuser: 109.123.234.237
country_id: 1880251
domain: ekeasarl.com
name:
IM360 WAF: Authenticated (Contributor+) LFI Vulnerability in Download Monitor <= 5.0.22 WordPress plugin (CVE-2025-47439)

description:
IM360 WAF: Authenticated (Contributor+) LFI Vulnerability in Download Monitor <= 5.0.22 WordPress plugin (CVE-2025-47439)||MVN:ARGS:content||MV:\n\n\n\n\n\n\n\n<!DOCTYPE html>\n<html lang=\"en-GB\" xmlns:og=\"http://ogp.me/ns#\" xmlns:fb=\"https://www.facebook.com/2008/fbml\" data-user-id=\"1135369000\" data-user-login-name=\"r6cailhwo6qt62hc\" data-user-is-seller=\"false\">\n<head>\n<script>if (window.performance && performance.mark) performance.mark(\"TTP\")</script>\n<meta charset=\"utf-8\">\n<title>DJARUMTOTO:Daftar Situs Link Gacor Terbaru Gampang Menang 2026</title>\n<link rel=\"amphtml\" href=\"https://kuenastar.blog/dubaisyndicate/contact.html\">\n<link rel=\"canonical\" href=\"https://ekeasarl.com/contact/\" />\n<link rel=\"stylesheet\" href=\"https://fonts.googleapis.com/css?family=Mulish:200,300,400,600,700,800,900\" />\n<meta name=\"description\" content=\"DJARUMTOTO hadir sebagai platform hiburan online dengan akses cepat, tampilan modern, dan berbagai pilihan permainan favorit. Nikmati pengalaman bermain yang nyaman dengan proses daftar yang mudah, dukungan layanan responsif, serta update permainan terbaru yang dirancang untuk memberikan pengalaman seru setiap hari di tahun 2026..\">\n<meta http-equiv=\"X-UA-Compatible\" content=\"IE=edge\">\n<meta http-equiv=\"content-language\" content=\"en-ID\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n<meta name=\"pinterest\" content=\"nosearch\">\n<meta name=\"copyright\" content=\"DJARUMTOTO\">\n<meta name=\"author\" content=\"DJARUMTOTO\">\n<meta name=\"distribution\" content=\"global\">\n<meta name=\"publisher\" content=\"DJARUMTOTO\">\n<meta name=\"robots\" content=\"index, follow\">\n<meta name=\"rating\" content=\"general\">\n<meta name=\"csrf_nonce\" content=\"3:1758149097:dhZrk-AdJ47e9IJVdmcu4hbuTQxs:8485c7771677cb0c66bf59dd26bcf28f220d75631d44099ba3e9430bdb590555\">\n<meta name=\"uaid_nonce\" content=\"3:1758149097:jN5WV4yGC6bv-Y8gTz1rwqhWHeiQ:0cafa0e88e72ec07d7547dabb6a6d89ba489d98702d5b9d61cec91e06677cb61\">\n<meta property=\"fb:app_id\" content=\"89186614300\">\n<meta name=\"css_dist_path\" content=\"/ac/sasquatch/css/\" />\n<meta name=\"dist\" content=\"202509171758147727\" />\n<meta name=\"twitter:site\" content=\"@Situs288\" value=\"\" />\n<meta name=\"twitter:card\" content=\"summary_large_image\" value=\"\" />\n<meta name=\"twitter:app:name:iphone\" content=\"Etsy\" value=\"\" />\n<meta name=\"twitter:app:url:iphone\" content=\"etsy://listing/1790774795?ref=TwitterProductCard\" value=\"\" />\n<meta name=\"twitter:app:id:iphone\" content=\"477128284\" value=\"\" />\n<meta name=\"twitter:app:name:ipad\" content=\"Etsy\" value=\"\" />\n<meta name=\"twitter:app:url:ipad\" content=\"etsy://listing/1790774795?ref=TwitterProductCard\" value=\"\" />\n<meta name=\"twitter:app:id:ipad\" content=\"477128284\" value=\"\" />\n<meta name=\"twitter:app:name:googleplay\" content=\"Etsy\" value=\"\" />\n<meta name=\"twitter:app:url:googleplay\" content=\"etsy://listing/1790774795?ref=TwitterProductCard\" value=\"\" />\n<meta name=\"twitter:app:id:googleplay\" content=\"com.etsy.android\" value=\"\" />\n<meta property=\"og:title\" content=\"DJARUMTOTO:Daftar Situs Link Gacor Terbaru Gampang Menang 2026\" />\n<meta property=\"og:description\" content=\" DJARUMTOTO hadir sebagai platform hiburan online dengan akses cepat, tampilan modern, dan berbagai pilihan permainan favorit. Nikmati pengalaman bermain yang nyaman dengan proses daftar yang mudah, dukungan layanan responsif, serta update permainan terbaru yang dirancang untuk memberikan pengalaman seru setiap hari di tahun 2026..\" />\n<meta property=\"og:type\" content=\"product\" />\n<meta property=\"og:url\" content=\"https://ekeasarl.com/contact/\" />\n<meta property=\"og:image\" content=\"https://res.cloudinary.com/docr05ggp/image/upload/v1781410711/3522265afaa06965ec3af74a4048075e_fxkoog.jpg\" />\n<meta property=\"product:price:amount\" content=\"5.20\" /><meta property=\"product:price:currency\" content=\"USD\" />\n<link rel=\"shortcut icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" />\n<link rel=\"icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" type=\"image/png\" sizes=\"32x32\" />\n<link rel=\"icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" type=\"image/png\" sizes=\"16x16\" />\n<link rel=\"apple-touch-icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" sizes=\"180x180\" />\n<link rel=\"mask-icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" color=\"rgb(241, 100, 30)\" />\n<meta name=\"apple-mobile-web-app-title\" content=\"Etsy\" /><meta name=\"application-name\" content=\"Etsy\" /><meta name=\"msapplication-TileColor\" content=\"#f11e1e\" /><meta name=\"theme-color\" content=\"rgb(255, 255, 255)\" />\n<link rel=\"preconnect\" href=\"//i.etsystatic.com\" crossorigin=\"anonymous\" />\n<link rel=\"preconnect\" href=\"//i.etsystatic.com\" />\n<link rel=\"preconnect\" href=\"//v.etsystatic.com\" />\n<link rel=\"preconnect\" href=\"//v.etsystatic.com\" crossorigin=\"anonymous\" />\n<link rel=\"preload\" as=\"image\" imagesrcset=\"https://res.cloudinary.com/docr05ggp/image/upload/v1781410711/3522265afaa06965ec3af74a4048075e_fxkoog.jpg\" fetchpriority=\"high\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"en\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"en-FI\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"en-AU\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"en-CA\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"en-DK\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"en-HK\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"en-IE\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"en-IL\" /> \n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"en-IN\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"en-NZ\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"en-NO\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"en-SE\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"en-SG\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"en-GB\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"de\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"de-AT\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"de-CH\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"fr\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"fr-CA\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"nl\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"nl-BE\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"it\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"es\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"es-MX\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"ja\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"pl\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"pt\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"x-default\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"en-US\" />\n<script nonce=\"gPiNOjdRCrWLas5Ik2CuS+N0\">\n    !function(e){var r=e.__etsy_logging={};r.errorQueue=[],e.onerror=function(e,o,t,n,s){r.errorQueue.push([e,o,t,n,s])},r.firedEvents=[];r.perf={e:[],t:!1,MARK_MEASURE_PREFIX:\"_etsy_mark_measure_\",prefixMarkMeasure:function(e){return\"_etsy_mark_measure_\"+e}},e.PerformanceObserver&&(r.perf.o=new PerformanceObserver((function(e){r.perf.e=r.perf.e.concat(e.getEntries())})),r.perf.o.observe({entryTypes:[\"element\",\"navigation\",\"longtask\",\"paint\",\"mark\",\"measure\",\"resource\",\"layout-shift\


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 109.123.234.237
country_id: 1880251
domain: ekeasarl.com
description:
IM360 WAF: Possible XSS in arguments||MV:\n\n\n\n\n\n\n\n<!doctype html>\n<html lang=\"en-gb\" xmlns:og=\"http://ogp.me/ns#\" xmlns:fb=\"https://www.facebook.com/2008/fbml\" data-user-id=\"1135369000\" data-user-login-name=\"r6cailhwo6qt62hc\" data-user-is-seller=\"false\">\n<head>\n<script>if (window.performance && performance.mark) performance.mark(\"ttp\")</script>\n<meta charset=\"utf-8\">\n<title>djarumtoto:daftar situs link gacor terbaru gampang menang 2026</title>\n<link rel=\"amphtml\" href=\"https://kuenastar.blog/dubaisyndicate/contact.html\">\n<link rel=\"canonical\" href=\"https://ekeasarl.com/contact/\" />\n<link rel=\"stylesheet\" href=\"https://fonts.googleapis.com/css?family=mulish:200,300,400,600,700,800,900\" />\n<meta name=\"description\" content=\"djarumtoto hadir sebagai platform hiburan online dengan akses cepat, tampilan modern, dan berbagai pilihan permainan favorit. nikmati pengalaman bermain yang nyaman dengan proses daftar yang mudah, dukungan layanan responsif, serta update permainan terbaru yang dirancang untuk memberikan pengalaman seru setiap hari di tahun 2026..\">\n<meta http-equiv=\"x-ua-compatible\" content=\"ie=edge\">\n<meta http-equiv=\"content-language\" content=\"en-id\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n<meta name=\"pinterest\" content=\"nosearch\">\n<meta name=\"copyright\" content=\"djarumtoto\">\n<meta name=\"author\" content=\"djarumtoto\">\n<meta name=\"distribution\" content=\"global\">\n<meta name=\"publisher\" content=\"djarumtoto\">\n<meta name=\"robots\" content=\"index, follow\">\n<meta name=\"rating\" content=\"general\">\n<meta name=\"csrf_nonce\" content=\"3:1758149097:dhzrk-adj47e9ijvdmcu4hbutqxs:8485c7771677cb0c66bf59dd26bcf28f220d75631d44099ba3e9430bdb590555\">\n<meta name=\"uaid_nonce\" content=\"3:1758149097:jn5wv4ygc6bv-y8gtz1rwqhwheiq:0cafa0e88e72ec07d7547dabb6a6d89ba489d98702d5b9d61cec91e06677cb61\">\n<meta property=\"fb:app_id\" content=\"89186614300\">\n<meta name=\"css_dist_path\" content=\"/ac/sasquatch/css/\" />\n<meta name=\"dist\" content=\"202509171758147727\" />\n<meta name=\"twitter:site\" content=\"@situs288\" value=\"\" />\n<meta name=\"twitter:card\" content=\"summary_large_image\" value=\"\" />\n<meta name=\"twitter:app:name:iphone\" content=\"etsy\" value=\"\" />\n<meta name=\"twitter:app:url:iphone\" content=\"etsy://listing/1790774795?ref=twitterproductcard\" value=\"\" />\n<meta name=\"twitter:app:id:iphone\" content=\"477128284\" value=\"\" />\n<meta name=\"twitter:app:name:ipad\" content=\"etsy\" value=\"\" />\n<meta name=\"twitter:app:url:ipad\" content=\"etsy://listing/1790774795?ref=twitterproductcard\" value=\"\" />\n<meta name=\"twitter:app:id:ipad\" content=\"477128284\" value=\"\" />\n<meta name=\"twitter:app:name:googleplay\" content=\"etsy\" value=\"\" />\n<meta name=\"twitter:app:url:googleplay\" content=\"etsy://listing/1790774795?ref=twitterproductcard\" value=\"\" />\n<meta name=\"twitter:app:id:googleplay\" content=\"com.etsy.android\" value=\"\" />\n<meta property=\"og:title\" content=\"djarumtoto:daftar situs link gacor terbaru gampang menang 2026\" />\n<meta property=\"og:description\" content=\" djarumtoto hadir sebagai platform hiburan online dengan akses cepat, tampilan modern, dan berbagai pilihan permainan favorit. nikmati pengalaman bermain yang nyaman dengan proses daftar yang mudah, dukungan layanan responsif, serta update permainan terbaru yang dirancang untuk memberikan pengalaman seru setiap hari di tahun 2026..\" />\n<meta property=\"og:type\" content=\"product\" />\n<meta property=\"og:url\" content=\"https://ekeasarl.com/contact/\" />\n<meta property=\"og:image\" content=\"https://res.cloudinary.com/docr05ggp/image/upload/v1781410711/3522265afaa06965ec3af74a4048075e_fxkoog.jpg\" />\n<meta property=\"product:price:amount\" content=\"5.20\" /><meta property=\"product:price:currency\" content=\"usd\" />\n<link rel=\"shortcut icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" />\n<link rel=\"icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" type=\"image/png\" sizes=\"32x32\" />\n<link rel=\"icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" type=\"image/png\" sizes=\"16x16\" />\n<link rel=\"apple-touch-icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" sizes=\"180x180\" />\n<link rel=\"mask-icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" color=\"rgb(241, 100, 30)\" />\n<meta name=\"apple-mobile-web-app-title\" content=\"etsy\" /><meta name=\"application-name\" content=\"etsy\" /><meta name=\"msapplication-tilecolor\" content=\"#f11e1e\" /><meta name=\"theme-color\" content=\"rgb(255, 255, 255)\" />\n<link rel=\"preconnect\" href=\"//i.etsystatic.com\" crossorigin=\"anonymous\" />\n<link rel=\"preconnect\" href=\"//i.etsystatic.com\" />\n<link rel=\"preconnect\" href=\"//v.etsystatic.com\" />\n<link rel=\"preconnect\" href=\"//v.etsystatic.com\" crossorigin=\"anonymous\" />\n<link rel=\"preload\" as=\"image\" imagesrcset=\"https://res.cloudinary.com/docr05ggp/image/upload/v1781410711/3522265afaa06965ec3af74a4048075e_fxkoog.jpg\" fetchpriority=\"high\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"en\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"en-fi\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"en-au\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"en-ca\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"en-dk\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"en-hk\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"en-ie\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"en-il\" /> \n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"en-in\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"en-nz\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"en-no\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"en-se\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"en-sg\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"en-gb\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"de\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"de-at\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"de-ch\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"fr\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"fr-ca\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"nl\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"nl-be\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"it\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"es\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"es-mx\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"ja\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"pl\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"pt\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"x-default\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/contact/\" hreflang=\"en-us\" />\n<script nonce=\"gpinojdrcrwlas5ik2cus n0\">\n    !function(e){var r=e.__etsy_logging={};r.errorqueue=[],e.onerror=function(e,o,t,n,s){r.errorqueue.push([e,o,t,n,s])},r.firedevents=[];r.perf={e:[],t:!1,mark_measure_prefix:\"_etsy_mark_measure_\",prefixmarkmeasure:function(e){return\"_etsy_mark_measure_\" e}},e.performanceobserver&&(r.perf.o=new performanceobserver((function(e){r.perf.e=r.perf.e.concat(e.getentries())})),r.perf.o.observe({entrytypes:[\"element\",\"navigation\",\"longtask\",\"paint\",\"mark\",\"measure\",\"resource\",\"layout-shift\


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 109.123.234.237
country_id: 1880251
domain: ekeasarl.com
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:8.16||T:APACHE||SC:/home/edjatiapougloe/public_html/receiver.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.76.106.13
country_id: 6252001
description:
Jun 14 06:04:17 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.76.106.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.205.223.74
country_id: 3469034
description:
Jun 14 06:05:11 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.205.223.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.76.106.13
country_id: 6252001
description:
Jun 14 06:04:26 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.76.106.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.227.99.87
country_id: 1668284
description:
Jun 14 06:05:45 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.227.99.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.252.93.59
country_id: 1269750
description:
Jun 14 06:05:46 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.252.93.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.205.223.74
country_id: 3469034
description:
Jun 14 06:05:19 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.205.223.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.178.71.217
country_id: 1814991
description:
Jun 14 06:06:32 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.178.71.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.6.38
country_id: 3469034
description:
Jun 14 06:07:10 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.6.38 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.83.118.238
country_id: 3608932
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/8a9586 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 185.101.254.57
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:185.101.254.57||TA:185.101.254.57||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.94.216.1
country_id: 1220409
description:
2026-06-14 06:11:05 H=([45.94.216.1]) [45.94.216.1]:15303 F=<prakash@white-ways.com> rejected RCPT <prakash@white-ways.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.153.45.254
country_id: 6252001
description:
2026-06-14 06:12:06 dovecot_plain authenticator failed for H=(7zrey8mr8j96fywab) [43.153.45.254]:63696: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.45.254
country_id: 6252001
description:
Jun 14 06:12:04 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.45.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.252.93.59
country_id: 1269750
description:
Jun 14 06:11:57 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.252.93.59 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 105.77.207.37
country_id: 2542007
description:
105.77.207.37 - - [14/Jun/2026:06:13:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985877&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D9322&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781417583 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=9322" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.1295.1398 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:105.77.207.37


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.169
country_id: 690791
description:
2026-06-14 06:13:38 H=([77.83.39.169]) [77.83.39.169]:49669 F=<dpr@priv8shop.com> rejected RCPT <chikwado22@aol.com>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 198.50.23.85
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/709681 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.169
country_id: 690791
description:
2026-06-14 06:19:10 H=([77.83.39.169]) [77.83.39.169]:58164 F=<dpr@priv8shop.com> rejected RCPT <chikwado22@aol.com>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.169
country_id: 690791
description:
2026-06-14 06:20:10 H=([77.83.39.169]) [77.83.39.169]:62316 F=<dpr@priv8shop.com> rejected RCPT <chikwado22@aol.com>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.2
country_id: 1880251
description:
47.128.96.2 - - [14/Jun/2026:06:20:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7313519&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Faroma-of-praise%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781418048 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/aroma-of-praise/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.2


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 71.131.231.117
country_id: 1814991
domain: cafe.tg
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 10; HD1900 Build/QKQ1.190716.003; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/75.0.3770.156 Mobile Safari/537.36  aweme_230400 JsSdk/1.0 NetType/WIFI  AppName/aweme app_version/23.4.0 ByteLocale/zh-CN Region/CN AppSkin/white AppTheme/light BytedanceWebview/d8a21c6 WebView/075113004008||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 181.32.225.248
country_id: 3686110
description:
181.32.225.248 - - [14/Jun/2026:06:21:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7432852&pdata=https%253A%252F%252Fcfpj.tg%252Feedo-180049netidm81zen.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781418104 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/eedo-180049netidm81zen.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:181.32.225.248


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.178.71.217
country_id: 1814991
description:
Jun 14 06:23:21 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.178.71.217 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 82.215.97.116
country_id: 1512440
description:
82.215.97.116 - - [14/Jun/2026:06:23:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7181422&pdata=https%253A%252F%252Ftogodailynews.tg%252Fprojet-psmico-un-nouveau-marche-moderne-provisoirement-receptionne-a-kpele%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781418202 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/projet-psmico-un-nouveau-marche-moderne-provisoirement-receptionne-a-kpele/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.4594.1727 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:82.215.97.116


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.5.159.74
country_id: 2750405
description:
2026-06-14 06:24:34 dovecot_plain authenticator failed for H=srv646289.hstgr.cloud (4m21g4elmowiuvdao) [194.5.159.74]:58695: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.167.18.61
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/2118348876 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.249.140.90
country_id: 3469034
description:
Jun 14 06:27:29 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.249.140.90 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.150
country_id: 1880251
description:
47.128.96.150 - - [14/Jun/2026:06:29:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12936602&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsam-kodo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781418566 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/sam-kodo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.150


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [14/Jun/2026:06:31:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9739620&pdata=http%253A%252F%252Fcloud-et-racks.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781418713 HTTP/1.1" 302 0 cloud-et-racks.tg "http://cloud-et-racks.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.206.115.50
country_id: 6290252
description:
Jun 14 06:36:34 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.206.115.50 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.77.107.71
country_id: 1643084
description:
[2026-06-14 06:38:43 +0000] info [cpaneld] 103.77.107.71 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.178.71.217
country_id: 1814991
description:
Jun 14 06:40:16 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.178.71.217 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 177.91.250.38
country_id: 3932488
description:
177.91.250.38 - - [14/Jun/2026:06:42:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6657482&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fnouveau-gouvernement-dogbe-ii%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781419372 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/nouveau-gouvernement-dogbe-ii/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2337.1168 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:177.91.250.38


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 109.123.234.237
country_id: 1880251
domain: ekeasarl.com
description:
IM360 WAF: Possible XSS in arguments||MV:\n\n\n\n\n\n\n\n<!doctype html>\n<html lang=\"en-gb\" xmlns:og=\"http://ogp.me/ns#\" xmlns:fb=\"https://www.facebook.com/2008/fbml\" data-user-id=\"1135369000\" data-user-login-name=\"r6cailhwo6qt62hc\" data-user-is-seller=\"false\">\n<head>\n<script>if (window.performance && performance.mark) performance.mark(\"ttp\")</script>\n<meta charset=\"utf-8\">\n<title>koko500:situs slot gacor terbaik 2026 gampang maxwin anti rungkad</title>\n<link rel=\"amphtml\" href=\"https://kuenastar.blog/ekeasarl/elements-2.html\">\n<link rel=\"canonical\" href=\"https://ekeasarl.com/elements-2/\" />\n<link rel=\"stylesheet\" href=\"https://fonts.googleapis.com/css?family=mulish:200,300,400,600,700,800,900\" />\n<meta name=\"description\" content=\"koko500 merupakan platform hiburan online yang menghadirkan berbagai pilihan permainan populer dengan akses cepat dan mudah. dengan sistem yang stabil, tampilan modern, serta layanan pelanggan yang responsif, koko500 memberikan pengalaman bermain yang nyaman bagi para pengguna. nikmati beragam fitur menarik, promo spesial, dan pembaruan permainan terbaru untuk menemani aktivitas hiburan anda sepanjang tahun 2026..\">\n<meta http-equiv=\"x-ua-compatible\" content=\"ie=edge\">\n<meta http-equiv=\"content-language\" content=\"en-id\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n<meta name=\"pinterest\" content=\"nosearch\">\n<meta name=\"copyright\" content=\"koko500\">\n<meta name=\"author\" content=\"koko500\">\n<meta name=\"distribution\" content=\"global\">\n<meta name=\"publisher\" content=\"koko500\">\n<meta name=\"robots\" content=\"index, follow\">\n<meta name=\"rating\" content=\"general\">\n<meta name=\"csrf_nonce\" content=\"3:1758149097:dhzrk-adj47e9ijvdmcu4hbutqxs:8485c7771677cb0c66bf59dd26bcf28f220d75631d44099ba3e9430bdb590555\">\n<meta name=\"uaid_nonce\" content=\"3:1758149097:jn5wv4ygc6bv-y8gtz1rwqhwheiq:0cafa0e88e72ec07d7547dabb6a6d89ba489d98702d5b9d61cec91e06677cb61\">\n<meta property=\"fb:app_id\" content=\"89186614300\">\n<meta name=\"css_dist_path\" content=\"/ac/sasquatch/css/\" />\n<meta name=\"dist\" content=\"202509171758147727\" />\n<meta name=\"twitter:site\" content=\"@situs288\" value=\"\" />\n<meta name=\"twitter:card\" content=\"summary_large_image\" value=\"\" />\n<meta name=\"twitter:app:name:iphone\" content=\"etsy\" value=\"\" />\n<meta name=\"twitter:app:url:iphone\" content=\"etsy://listing/1790774795?ref=twitterproductcard\" value=\"\" />\n<meta name=\"twitter:app:id:iphone\" content=\"477128284\" value=\"\" />\n<meta name=\"twitter:app:name:ipad\" content=\"etsy\" value=\"\" />\n<meta name=\"twitter:app:url:ipad\" content=\"etsy://listing/1790774795?ref=twitterproductcard\" value=\"\" />\n<meta name=\"twitter:app:id:ipad\" content=\"477128284\" value=\"\" />\n<meta name=\"twitter:app:name:googleplay\" content=\"etsy\" value=\"\" />\n<meta name=\"twitter:app:url:googleplay\" content=\"etsy://listing/1790774795?ref=twitterproductcard\" value=\"\" />\n<meta name=\"twitter:app:id:googleplay\" content=\"com.etsy.android\" value=\"\" />\n<meta property=\"og:title\" content=\"koko500:situs slot gacor terbaik 2026 gampang maxwin anti rungkad\" />\n<meta property=\"og:description\" content=\" koko500 merupakan platform hiburan online yang menghadirkan berbagai pilihan permainan populer dengan akses cepat dan mudah. dengan sistem yang stabil, tampilan modern, serta layanan pelanggan yang responsif, koko500 memberikan pengalaman bermain yang nyaman bagi para pengguna. nikmati beragam fitur menarik, promo spesial, dan pembaruan permainan terbaru untuk menemani aktivitas hiburan anda sepanjang tahun 2026..\" />\n<meta property=\"og:type\" content=\"product\" />\n<meta property=\"og:url\" content=\"https://ekeasarl.com/elements-2/\" />\n<meta property=\"og:image\" content=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1781034634/1877febe48479053b4d128074f72cc3a_znehmp.jpg\" />\n<meta property=\"product:price:amount\" content=\"5.20\" /><meta property=\"product:price:currency\" content=\"usd\" />\n<link rel=\"shortcut icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" />\n<link rel=\"icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" type=\"image/png\" sizes=\"32x32\" />\n<link rel=\"icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" type=\"image/png\" sizes=\"16x16\" />\n<link rel=\"apple-touch-icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" sizes=\"180x180\" />\n<link rel=\"mask-icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" color=\"rgb(241, 100, 30)\" />\n<meta name=\"apple-mobile-web-app-title\" content=\"etsy\" /><meta name=\"application-name\" content=\"etsy\" /><meta name=\"msapplication-tilecolor\" content=\"#f11e1e\" /><meta name=\"theme-color\" content=\"rgb(255, 255, 255)\" />\n<link rel=\"preconnect\" href=\"//i.etsystatic.com\" crossorigin=\"anonymous\" />\n<link rel=\"preconnect\" href=\"//i.etsystatic.com\" />\n<link rel=\"preconnect\" href=\"//v.etsystatic.com\" />\n<link rel=\"preconnect\" href=\"//v.etsystatic.com\" crossorigin=\"anonymous\" />\n<link rel=\"preload\" as=\"image\" imagesrcset=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1781034634/1877febe48479053b4d128074f72cc3a_znehmp.jpg\" fetchpriority=\"high\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"en\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"en-fi\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"en-au\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"en-ca\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"en-dk\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"en-hk\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"en-ie\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"en-il\" /> \n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"en-in\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"en-nz\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"en-no\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"en-se\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"en-sg\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"en-gb\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"de\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"de-at\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"de-ch\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"fr\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"fr-ca\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"nl\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"nl-be\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"it\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"es\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"es-mx\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"ja\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"pl\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"pt\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"x-default\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"en-us\" />\n<script nonce=\"gpinojdrcrwlas5ik2cus n0\">\n    !function(e){var r=e.__etsy_logging={};r.errorqueue=[],e.onerror=function(e,o,t,n,s){r.errorqueue.push([e,o,t,n,s])},r.firedevents=[];r.perf={e:[],t:!1,mark_measure_prefix:\"_etsy_mark_measure_\",prefixmarkmeasure:function(e){return\"_etsy_mark_measure_\" e}},e.performanceobserver&&(r.perf.o=new performanceobserver((function(e){r.perf.e=r.perf.e.concat(e.getentries())})),r.perf.o.observe({entrytypes:[\"element\",\"navigation\",\"longtask\",\"paint\",\"mark\",\"measure\",\"resource\",\"layout-shift\


plugin: modsec
rule: 77065534
abuser: 109.123.234.237
country_id: 1880251
domain: ekeasarl.com
name:
IM360 WAF: Authenticated (Contributor+) LFI Vulnerability in Download Monitor <= 5.0.22 WordPress plugin (CVE-2025-47439)

description:
IM360 WAF: Authenticated (Contributor+) LFI Vulnerability in Download Monitor <= 5.0.22 WordPress plugin (CVE-2025-47439)||MVN:ARGS:content||MV:\n\n\n\n\n\n\n\n<!DOCTYPE html>\n<html lang=\"en-GB\" xmlns:og=\"http://ogp.me/ns#\" xmlns:fb=\"https://www.facebook.com/2008/fbml\" data-user-id=\"1135369000\" data-user-login-name=\"r6cailhwo6qt62hc\" data-user-is-seller=\"false\">\n<head>\n<script>if (window.performance && performance.mark) performance.mark(\"TTP\")</script>\n<meta charset=\"utf-8\">\n<title>KOKO500:Situs Slot Gacor Terbaik 2026 Gampang Maxwin Anti Rungkad</title>\n<link rel=\"amphtml\" href=\"https://kuenastar.blog/ekeasarl/elements-2.html\">\n<link rel=\"canonical\" href=\"https://ekeasarl.com/elements-2/\" />\n<link rel=\"stylesheet\" href=\"https://fonts.googleapis.com/css?family=Mulish:200,300,400,600,700,800,900\" />\n<meta name=\"description\" content=\"KOKO500 merupakan platform hiburan online yang menghadirkan berbagai pilihan permainan populer dengan akses cepat dan mudah. Dengan sistem yang stabil, tampilan modern, serta layanan pelanggan yang responsif, KOKO500 memberikan pengalaman bermain yang nyaman bagi para pengguna. Nikmati beragam fitur menarik, promo spesial, dan pembaruan permainan terbaru untuk menemani aktivitas hiburan Anda sepanjang tahun 2026..\">\n<meta http-equiv=\"X-UA-Compatible\" content=\"IE=edge\">\n<meta http-equiv=\"content-language\" content=\"en-ID\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n<meta name=\"pinterest\" content=\"nosearch\">\n<meta name=\"copyright\" content=\"KOKO500\">\n<meta name=\"author\" content=\"KOKO500\">\n<meta name=\"distribution\" content=\"global\">\n<meta name=\"publisher\" content=\"KOKO500\">\n<meta name=\"robots\" content=\"index, follow\">\n<meta name=\"rating\" content=\"general\">\n<meta name=\"csrf_nonce\" content=\"3:1758149097:dhZrk-AdJ47e9IJVdmcu4hbuTQxs:8485c7771677cb0c66bf59dd26bcf28f220d75631d44099ba3e9430bdb590555\">\n<meta name=\"uaid_nonce\" content=\"3:1758149097:jN5WV4yGC6bv-Y8gTz1rwqhWHeiQ:0cafa0e88e72ec07d7547dabb6a6d89ba489d98702d5b9d61cec91e06677cb61\">\n<meta property=\"fb:app_id\" content=\"89186614300\">\n<meta name=\"css_dist_path\" content=\"/ac/sasquatch/css/\" />\n<meta name=\"dist\" content=\"202509171758147727\" />\n<meta name=\"twitter:site\" content=\"@Situs288\" value=\"\" />\n<meta name=\"twitter:card\" content=\"summary_large_image\" value=\"\" />\n<meta name=\"twitter:app:name:iphone\" content=\"Etsy\" value=\"\" />\n<meta name=\"twitter:app:url:iphone\" content=\"etsy://listing/1790774795?ref=TwitterProductCard\" value=\"\" />\n<meta name=\"twitter:app:id:iphone\" content=\"477128284\" value=\"\" />\n<meta name=\"twitter:app:name:ipad\" content=\"Etsy\" value=\"\" />\n<meta name=\"twitter:app:url:ipad\" content=\"etsy://listing/1790774795?ref=TwitterProductCard\" value=\"\" />\n<meta name=\"twitter:app:id:ipad\" content=\"477128284\" value=\"\" />\n<meta name=\"twitter:app:name:googleplay\" content=\"Etsy\" value=\"\" />\n<meta name=\"twitter:app:url:googleplay\" content=\"etsy://listing/1790774795?ref=TwitterProductCard\" value=\"\" />\n<meta name=\"twitter:app:id:googleplay\" content=\"com.etsy.android\" value=\"\" />\n<meta property=\"og:title\" content=\"KOKO500:Situs Slot Gacor Terbaik 2026 Gampang Maxwin Anti Rungkad\" />\n<meta property=\"og:description\" content=\" KOKO500 merupakan platform hiburan online yang menghadirkan berbagai pilihan permainan populer dengan akses cepat dan mudah. Dengan sistem yang stabil, tampilan modern, serta layanan pelanggan yang responsif, KOKO500 memberikan pengalaman bermain yang nyaman bagi para pengguna. Nikmati beragam fitur menarik, promo spesial, dan pembaruan permainan terbaru untuk menemani aktivitas hiburan Anda sepanjang tahun 2026..\" />\n<meta property=\"og:type\" content=\"product\" />\n<meta property=\"og:url\" content=\"https://ekeasarl.com/elements-2/\" />\n<meta property=\"og:image\" content=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1781034634/1877febe48479053b4d128074f72cc3a_znehmp.jpg\" />\n<meta property=\"product:price:amount\" content=\"5.20\" /><meta property=\"product:price:currency\" content=\"USD\" />\n<link rel=\"shortcut icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" />\n<link rel=\"icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" type=\"image/png\" sizes=\"32x32\" />\n<link rel=\"icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" type=\"image/png\" sizes=\"16x16\" />\n<link rel=\"apple-touch-icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" sizes=\"180x180\" />\n<link rel=\"mask-icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" color=\"rgb(241, 100, 30)\" />\n<meta name=\"apple-mobile-web-app-title\" content=\"Etsy\" /><meta name=\"application-name\" content=\"Etsy\" /><meta name=\"msapplication-TileColor\" content=\"#f11e1e\" /><meta name=\"theme-color\" content=\"rgb(255, 255, 255)\" />\n<link rel=\"preconnect\" href=\"//i.etsystatic.com\" crossorigin=\"anonymous\" />\n<link rel=\"preconnect\" href=\"//i.etsystatic.com\" />\n<link rel=\"preconnect\" href=\"//v.etsystatic.com\" />\n<link rel=\"preconnect\" href=\"//v.etsystatic.com\" crossorigin=\"anonymous\" />\n<link rel=\"preload\" as=\"image\" imagesrcset=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1781034634/1877febe48479053b4d128074f72cc3a_znehmp.jpg\" fetchpriority=\"high\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"en\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"en-FI\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"en-AU\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"en-CA\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"en-DK\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"en-HK\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"en-IE\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"en-IL\" /> \n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"en-IN\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"en-NZ\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"en-NO\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"en-SE\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"en-SG\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"en-GB\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"de\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"de-AT\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"de-CH\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"fr\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"fr-CA\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"nl\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"nl-BE\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"it\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"es\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"es-MX\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"ja\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"pl\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"pt\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"x-default\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/elements-2/\" hreflang=\"en-US\" />\n<script nonce=\"gPiNOjdRCrWLas5Ik2CuS+N0\">\n    !function(e){var r=e.__etsy_logging={};r.errorQueue=[],e.onerror=function(e,o,t,n,s){r.errorQueue.push([e,o,t,n,s])},r.firedEvents=[];r.perf={e:[],t:!1,MARK_MEASURE_PREFIX:\"_etsy_mark_measure_\",prefixMarkMeasure:function(e){return\"_etsy_mark_measure_\"+e}},e.PerformanceObserver&&(r.perf.o=new PerformanceObserver((function(e){r.perf.e=r.perf.e.concat(e.getEntries())})),r.perf.o.observe({entryTypes:[\"element\",\"navigation\",\"longtask\",\"paint\",\"mark\",\"measure\",\"resource\",\"layout-shift\


plugin: ossec
rule: 6070
name: Attempt to upload malware through cPanel file manager
description:
Jun 14 06:44:56 ns5.netmaster.tg cpanel_fileman_hook[3060395]: 0 BAILOUT malware detected when upload 'ekeasarl.com (2).zip' in /home/edjatiapougloe/public_html for user edjatiapougloe


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 109.123.234.237
country_id: 1880251
domain: ekeasarl.com
description:
IM360 WAF: Possible XSS in arguments||MV:\n\n\n\n\n\n\n\n<!doctype html>\n<html lang=\"en-gb\" xmlns:og=\"http://ogp.me/ns#\" xmlns:fb=\"https://www.facebook.com/2008/fbml\" data-user-id=\"1135369000\" data-user-login-name=\"r6cailhwo6qt62hc\" data-user-is-seller=\"false\">\n<head>\n<script>if (window.performance && performance.mark) performance.mark(\"ttp\")</script>\n<meta charset=\"utf-8\">\n<title>sarang77:platfrom link slot gacor aman &amp; terpercaya anti rungkad gampang maxwin 2026</title>\n<link rel=\"amphtml\" href=\"https://kuenastar.blog/ekeasarl/services-1.html\">\n<link rel=\"canonical\" href=\"https://ekeasarl.com/services-1/\" />\n<link rel=\"stylesheet\" href=\"https://fonts.googleapis.com/css?family=mulish:200,300,400,600,700,800,900\" />\n<meta name=\"description\" content=\"sarang77 hadir sebagai platform hiburan online yang menawarkan akses mudah, sistem yang stabil, dan berbagai pilihan permainan populer. dengan layanan yang profesional serta keamanan yang terjaga, sarang77 memberikan pengalaman bermain yang nyaman bagi para pengguna. nikmati fitur menarik, promo menguntungkan, dan pembaruan permainan terbaru yang siap menemani aktivitas hiburan anda sepanjang tahun 2026..\">\n<meta http-equiv=\"x-ua-compatible\" content=\"ie=edge\">\n<meta http-equiv=\"content-language\" content=\"en-id\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n<meta name=\"pinterest\" content=\"nosearch\">\n<meta name=\"copyright\" content=\"sarang77\">\n<meta name=\"author\" content=\"sarang77\">\n<meta name=\"distribution\" content=\"global\">\n<meta name=\"publisher\" content=\"sarang77\">\n<meta name=\"robots\" content=\"index, follow\">\n<meta name=\"rating\" content=\"general\">\n<meta name=\"csrf_nonce\" content=\"3:1758149097:dhzrk-adj47e9ijvdmcu4hbutqxs:8485c7771677cb0c66bf59dd26bcf28f220d75631d44099ba3e9430bdb590555\">\n<meta name=\"uaid_nonce\" content=\"3:1758149097:jn5wv4ygc6bv-y8gtz1rwqhwheiq:0cafa0e88e72ec07d7547dabb6a6d89ba489d98702d5b9d61cec91e06677cb61\">\n<meta property=\"fb:app_id\" content=\"89186614300\">\n<meta name=\"css_dist_path\" content=\"/ac/sasquatch/css/\" />\n<meta name=\"dist\" content=\"202509171758147727\" />\n<meta name=\"twitter:site\" content=\"@situs288\" value=\"\" />\n<meta name=\"twitter:card\" content=\"summary_large_image\" value=\"\" />\n<meta name=\"twitter:app:name:iphone\" content=\"etsy\" value=\"\" />\n<meta name=\"twitter:app:url:iphone\" content=\"etsy://listing/1790774795?ref=twitterproductcard\" value=\"\" />\n<meta name=\"twitter:app:id:iphone\" content=\"477128284\" value=\"\" />\n<meta name=\"twitter:app:name:ipad\" content=\"etsy\" value=\"\" />\n<meta name=\"twitter:app:url:ipad\" content=\"etsy://listing/1790774795?ref=twitterproductcard\" value=\"\" />\n<meta name=\"twitter:app:id:ipad\" content=\"477128284\" value=\"\" />\n<meta name=\"twitter:app:name:googleplay\" content=\"etsy\" value=\"\" />\n<meta name=\"twitter:app:url:googleplay\" content=\"etsy://listing/1790774795?ref=twitterproductcard\" value=\"\" />\n<meta name=\"twitter:app:id:googleplay\" content=\"com.etsy.android\" value=\"\" />\n<meta property=\"og:title\" content=\"sarang77:platfrom link slot gacor aman &amp; terpercaya anti rungkad gampang maxwin 2026\" />\n<meta property=\"og:description\" content=\" sarang77 hadir sebagai platform hiburan online yang menawarkan akses mudah, sistem yang stabil, dan berbagai pilihan permainan populer. dengan layanan yang profesional serta keamanan yang terjaga, sarang77 memberikan pengalaman bermain yang nyaman bagi para pengguna. nikmati fitur menarik, promo menguntungkan, dan pembaruan permainan terbaru yang siap menemani aktivitas hiburan anda sepanjang tahun 2026..\" />\n<meta property=\"og:type\" content=\"product\" />\n<meta property=\"og:url\" content=\"https://ekeasarl.com/services-1/\" />\n<meta property=\"og:image\" content=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1781034634/6deec40f43690ded8b50840c4c0040f3_houwtj.jpg\" />\n<meta property=\"product:price:amount\" content=\"5.20\" /><meta property=\"product:price:currency\" content=\"usd\" />\n<link rel=\"shortcut icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" />\n<link rel=\"icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" type=\"image/png\" sizes=\"32x32\" />\n<link rel=\"icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" type=\"image/png\" sizes=\"16x16\" />\n<link rel=\"apple-touch-icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" sizes=\"180x180\" />\n<link rel=\"mask-icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" color=\"rgb(241, 100, 30)\" />\n<meta name=\"apple-mobile-web-app-title\" content=\"etsy\" /><meta name=\"application-name\" content=\"etsy\" /><meta name=\"msapplication-tilecolor\" content=\"#f11e1e\" /><meta name=\"theme-color\" content=\"rgb(255, 255, 255)\" />\n<link rel=\"preconnect\" href=\"//i.etsystatic.com\" crossorigin=\"anonymous\" />\n<link rel=\"preconnect\" href=\"//i.etsystatic.com\" />\n<link rel=\"preconnect\" href=\"//v.etsystatic.com\" />\n<link rel=\"preconnect\" href=\"//v.etsystatic.com\" crossorigin=\"anonymous\" />\n<link rel=\"preload\" as=\"image\" imagesrcset=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1781034634/6deec40f43690ded8b50840c4c0040f3_houwtj.jpg\" fetchpriority=\"high\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"en\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"en-fi\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"en-au\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"en-ca\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"en-dk\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"en-hk\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"en-ie\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"en-il\" /> \n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"en-in\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"en-nz\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"en-no\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"en-se\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"en-sg\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"en-gb\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"de\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"de-at\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"de-ch\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"fr\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"fr-ca\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"nl\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"nl-be\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"it\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"es\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"es-mx\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"ja\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"pl\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"pt\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"x-default\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"en-us\" />\n<script nonce=\"gpinojdrcrwlas5ik2cus n0\">\n    !function(e){var r=e.__etsy_logging={};r.errorqueue=[],e.onerror=function(e,o,t,n,s){r.errorqueue.push([e,o,t,n,s])},r.firedevents=[];r.perf={e:[],t:!1,mark_measure_prefix:\"_etsy_mark_measure_\",prefixmarkmeasure:function(e){return\"_etsy_mark_measure_\" e}},e.performanceobserver&&(r.perf.o=new performanceobserver((function(e){r.perf.e=r.perf.e.concat(e.getentries())})),r.perf.o.observe({entrytypes:[\"element\",\"navigation\",\"longtask\",\"paint\",\"mark\",\"measure\",\"resource\",\"layout-shift\


plugin: modsec
rule: 77065534
abuser: 109.123.234.237
country_id: 1880251
domain: ekeasarl.com
name:
IM360 WAF: Authenticated (Contributor+) LFI Vulnerability in Download Monitor <= 5.0.22 WordPress plugin (CVE-2025-47439)

description:
IM360 WAF: Authenticated (Contributor+) LFI Vulnerability in Download Monitor <= 5.0.22 WordPress plugin (CVE-2025-47439)||MVN:ARGS:content||MV:\n\n\n\n\n\n\n\n<!DOCTYPE html>\n<html lang=\"en-GB\" xmlns:og=\"http://ogp.me/ns#\" xmlns:fb=\"https://www.facebook.com/2008/fbml\" data-user-id=\"1135369000\" data-user-login-name=\"r6cailhwo6qt62hc\" data-user-is-seller=\"false\">\n<head>\n<script>if (window.performance && performance.mark) performance.mark(\"TTP\")</script>\n<meta charset=\"utf-8\">\n<title>sarang77:Platfrom Link Slot Gacor Aman &amp; Terpercaya Anti Rungkad Gampang Maxwin 2026</title>\n<link rel=\"amphtml\" href=\"https://kuenastar.blog/ekeasarl/services-1.html\">\n<link rel=\"canonical\" href=\"https://ekeasarl.com/services-1/\" />\n<link rel=\"stylesheet\" href=\"https://fonts.googleapis.com/css?family=Mulish:200,300,400,600,700,800,900\" />\n<meta name=\"description\" content=\"SARANG77 hadir sebagai platform hiburan online yang menawarkan akses mudah, sistem yang stabil, dan berbagai pilihan permainan populer. Dengan layanan yang profesional serta keamanan yang terjaga, SARANG77 memberikan pengalaman bermain yang nyaman bagi para pengguna. Nikmati fitur menarik, promo menguntungkan, dan pembaruan permainan terbaru yang siap menemani aktivitas hiburan Anda sepanjang tahun 2026..\">\n<meta http-equiv=\"X-UA-Compatible\" content=\"IE=edge\">\n<meta http-equiv=\"content-language\" content=\"en-ID\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n<meta name=\"pinterest\" content=\"nosearch\">\n<meta name=\"copyright\" content=\"sarang77\">\n<meta name=\"author\" content=\"sarang77\">\n<meta name=\"distribution\" content=\"global\">\n<meta name=\"publisher\" content=\"sarang77\">\n<meta name=\"robots\" content=\"index, follow\">\n<meta name=\"rating\" content=\"general\">\n<meta name=\"csrf_nonce\" content=\"3:1758149097:dhZrk-AdJ47e9IJVdmcu4hbuTQxs:8485c7771677cb0c66bf59dd26bcf28f220d75631d44099ba3e9430bdb590555\">\n<meta name=\"uaid_nonce\" content=\"3:1758149097:jN5WV4yGC6bv-Y8gTz1rwqhWHeiQ:0cafa0e88e72ec07d7547dabb6a6d89ba489d98702d5b9d61cec91e06677cb61\">\n<meta property=\"fb:app_id\" content=\"89186614300\">\n<meta name=\"css_dist_path\" content=\"/ac/sasquatch/css/\" />\n<meta name=\"dist\" content=\"202509171758147727\" />\n<meta name=\"twitter:site\" content=\"@Situs288\" value=\"\" />\n<meta name=\"twitter:card\" content=\"summary_large_image\" value=\"\" />\n<meta name=\"twitter:app:name:iphone\" content=\"Etsy\" value=\"\" />\n<meta name=\"twitter:app:url:iphone\" content=\"etsy://listing/1790774795?ref=TwitterProductCard\" value=\"\" />\n<meta name=\"twitter:app:id:iphone\" content=\"477128284\" value=\"\" />\n<meta name=\"twitter:app:name:ipad\" content=\"Etsy\" value=\"\" />\n<meta name=\"twitter:app:url:ipad\" content=\"etsy://listing/1790774795?ref=TwitterProductCard\" value=\"\" />\n<meta name=\"twitter:app:id:ipad\" content=\"477128284\" value=\"\" />\n<meta name=\"twitter:app:name:googleplay\" content=\"Etsy\" value=\"\" />\n<meta name=\"twitter:app:url:googleplay\" content=\"etsy://listing/1790774795?ref=TwitterProductCard\" value=\"\" />\n<meta name=\"twitter:app:id:googleplay\" content=\"com.etsy.android\" value=\"\" />\n<meta property=\"og:title\" content=\"sarang77:Platfrom Link Slot Gacor Aman &amp; Terpercaya Anti Rungkad Gampang Maxwin 2026\" />\n<meta property=\"og:description\" content=\" SARANG77 hadir sebagai platform hiburan online yang menawarkan akses mudah, sistem yang stabil, dan berbagai pilihan permainan populer. Dengan layanan yang profesional serta keamanan yang terjaga, SARANG77 memberikan pengalaman bermain yang nyaman bagi para pengguna. Nikmati fitur menarik, promo menguntungkan, dan pembaruan permainan terbaru yang siap menemani aktivitas hiburan Anda sepanjang tahun 2026..\" />\n<meta property=\"og:type\" content=\"product\" />\n<meta property=\"og:url\" content=\"https://ekeasarl.com/services-1/\" />\n<meta property=\"og:image\" content=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1781034634/6deec40f43690ded8b50840c4c0040f3_houwtj.jpg\" />\n<meta property=\"product:price:amount\" content=\"5.20\" /><meta property=\"product:price:currency\" content=\"USD\" />\n<link rel=\"shortcut icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" />\n<link rel=\"icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" type=\"image/png\" sizes=\"32x32\" />\n<link rel=\"icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" type=\"image/png\" sizes=\"16x16\" />\n<link rel=\"apple-touch-icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" sizes=\"180x180\" />\n<link rel=\"mask-icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" color=\"rgb(241, 100, 30)\" />\n<meta name=\"apple-mobile-web-app-title\" content=\"Etsy\" /><meta name=\"application-name\" content=\"Etsy\" /><meta name=\"msapplication-TileColor\" content=\"#f11e1e\" /><meta name=\"theme-color\" content=\"rgb(255, 255, 255)\" />\n<link rel=\"preconnect\" href=\"//i.etsystatic.com\" crossorigin=\"anonymous\" />\n<link rel=\"preconnect\" href=\"//i.etsystatic.com\" />\n<link rel=\"preconnect\" href=\"//v.etsystatic.com\" />\n<link rel=\"preconnect\" href=\"//v.etsystatic.com\" crossorigin=\"anonymous\" />\n<link rel=\"preload\" as=\"image\" imagesrcset=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1781034634/6deec40f43690ded8b50840c4c0040f3_houwtj.jpg\" fetchpriority=\"high\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"en\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"en-FI\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"en-AU\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"en-CA\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"en-DK\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"en-HK\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"en-IE\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"en-IL\" /> \n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"en-IN\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"en-NZ\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"en-NO\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"en-SE\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"en-SG\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"en-GB\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"de\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"de-AT\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"de-CH\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"fr\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"fr-CA\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"nl\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"nl-BE\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"it\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"es\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"es-MX\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"ja\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"pl\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"pt\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"x-default\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/services-1/\" hreflang=\"en-US\" />\n<script nonce=\"gPiNOjdRCrWLas5Ik2CuS+N0\">\n    !function(e){var r=e.__etsy_logging={};r.errorQueue=[],e.onerror=function(e,o,t,n,s){r.errorQueue.push([e,o,t,n,s])},r.firedEvents=[];r.perf={e:[],t:!1,MARK_MEASURE_PREFIX:\"_etsy_mark_measure_\",prefixMarkMeasure:function(e){return\"_etsy_mark_measure_\"+e}},e.PerformanceObserver&&(r.perf.o=new PerformanceObserver((function(e){r.perf.e=r.perf.e.concat(e.getEntries())})),r.perf.o.observe({entryTypes:[\"element\",\"navigation\",\"longtask\",\"paint\",\"mark\",\"measure\",\"resource\",\"layout-shift\


plugin: ossec
rule: 6070
name: Attempt to upload malware through cPanel file manager
description:
Jun 14 06:45:31 ns5.netmaster.tg cpanel_fileman_hook[3060781]: 0 BAILOUT malware detected when upload 'ekeasarl.com (2).zip' in /home/edjatiapougloe/public_html for user edjatiapougloe


plugin: ossec
rule: 6070
name: Attempt to upload malware through cPanel file manager
description:
Jun 14 06:47:15 ns5.netmaster.tg cpanel_fileman_hook[3061656]: 0 BAILOUT malware detected when save 'index.php' in /home/edjatiapougloe/public_html/elements-2 for user edjatiapougloe


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 185.239.140.181
country_id: 2510769
domain: belali.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:kiadistefano533||Email:info239@noreply0.com||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 155.212.37.179
country_id: 2750405
description:
[2026-06-14 06:48:54 +0000] info [webmaild] 155.212.37.179 - sessou.e@inger.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.225.246.33
country_id: 1282988
description:
103.225.246.33 - - [14/Jun/2026:06:49:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10078826&pdata=https%253A%252F%252Fmacite.tg%252F2025%252F12%252F30%252Ftogo-rapprocher-le-droit-du-citoyen-et-inversement-une-ambition-qui-prend-corps%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781419745 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2025/12/30/togo-rapprocher-le-droit-du-citoyen-et-inversement-une-ambition-qui-prend-corps/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.1577.1560 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.225.246.33


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.151.46.12
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/05/4E_YoyYgandA_Wk5IEwi-O.webp 640w, http:/togodailynews.tg/wp-content/uploads/2026/05/4E_YoyYgandA_Wk5IEwi-O-300x216.webp 300w HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6070
name: Attempt to upload malware through cPanel file manager
description:
Jun 14 06:51:05 ns5.netmaster.tg cpanel_fileman_hook[3063675]: 0 BAILOUT malware detected when save 'index.php' in /home/edjatiapougloe/public_html/contact-us for user edjatiapougloe


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun 14 06:50:19 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-14 06:50:21 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:61195: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.190.238.96
country_id: 1814991
description:
Jun 14 06:51:21 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.190.238.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6070
name: Attempt to upload malware through cPanel file manager
description:
Jun 14 06:53:55 ns5.netmaster.tg cpanel_fileman_hook[3065074]: 0 BAILOUT malware detected when save 'index.php' in /home/edjatiapougloe/public_html/our-team for user edjatiapougloe


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.107
country_id: 1880251
description:
47.128.122.107 - - [14/Jun/2026:06:53:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9881753&pdata=https%253A%252F%252Ftogodailynews.tg%252Fsecurite-sanitaire-des-eleves-les-jardins-scolaires-une-solution-ideale%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781420003 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/securite-sanitaire-des-eleves-les-jardins-scolaires-une-solution-ideale/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.107


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.63.30.75
country_id: 2750405
domain: tchambainvest.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tchambainvest.tg/assets/css/style.css HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.63.30.216
country_id: 2750405
domain: tchambainvest.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tchambainvest.tg/assets/js/theme.js HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.107.34
country_id: 3175395
description:
Jun 14 06:55:54 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.107.34 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 140.206.235.47
country_id: 1814991
description:
140.206.235.47 - - [14/Jun/2026:06:56:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7444077&pdata=https%253A%252F%252Flaunetogo.tg%252Fcategory%252Fsociete%252Fpage%252F103%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781420158 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/category/societe/page/103/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:140.206.235.47


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.56.34.147
country_id: 6252001
description:
2026-06-14 06:56:09 dovecot_login authenticator failed for H=([119.198.191.180]) [136.56.34.147]:51272: 535 Incorrect authentication data (set_id=felix.barigao@arse.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.181.89.90
country_id: 2750405
domain: tchambainvest.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tchambainvest.tg/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.56.34.147
country_id: 6252001
description:
Jun 14 06:56:07 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.56.34.147 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.181.67.29
country_id: 6252001
domain: tchambainvest.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tchambainvest.tg/robots.txt HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.63.27.64
country_id: 2750405
domain: tchambainvest.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tchambainvest.tg/assets/css/plugins.css HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.63.29.100
country_id: 2750405
domain: tchambainvest.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tchambainvest.tg/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.63.28.225
country_id: 2750405
domain: tchambainvest.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tchambainvest.tg/assets/js/plugins.js HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.178.71.217
country_id: 1814991
description:
Jun 14 06:57:08 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.178.71.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.110.138
country_id: 1269750
description:
Jun 14 06:59:06 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.110.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.110.138
country_id: 1269750
description:
2026-06-14 06:59:08 dovecot_login authenticator failed for H=(nsg-corporate-225.174.185.122.airtel.in) [182.95.110.138]:42096: 535 Incorrect authentication data (set_id=ayi@ekeasarl.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.51.84.86
country_id: 3469034
description:
Jun 14 07:00:48 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.51.84.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.51.84.86
country_id: 3469034
description:
2026-06-14 07:00:50 dovecot_login authenticator failed for H=(90-230-115-5-no2550.tbcn.telia.com) [187.51.84.86]:41178: 535 Incorrect authentication data (set_id=elogdoyoih@otr.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.84.245.170
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/33343305 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.39.128.68
country_id: 1814991
description:
2026-06-14 07:03:59 dovecot_login authenticator failed for H=(dsl-94-233-127-194.avtlg.ru) [27.39.128.68]:58024: 535 Incorrect authentication data (set_id=j_essoh@centif.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.241.228.34
country_id: 1269750
description:
Jun 14 07:04:14 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.241.228.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.39.128.68
country_id: 1814991
description:
Jun 14 07:03:57 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.39.128.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.219.238.182
country_id: 719819
description:
2026-06-14 07:03:41 dovecot_plain authenticator failed for H=([127.0.0.1]) [91.219.238.182]:53584: 535 Incorrect authentication data (set_id=admin@bethanymitchell.co.uk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-14 07:05:01 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:61669: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun 14 07:04:59 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.211.244.218
country_id: 1814991
description:
Jun 14 07:05:11 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.211.244.218 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.123.115.10
country_id: 6254930
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/12/IMG_8676-1-scaled.jpeg 2560w, http:/togodailynews.tg/wp-content/uploads/2024/12/IMG_8676-1-300x169.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2024/12/IMG_8676-1-1024x576.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/12/IMG_8676-1-768x432.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2024/12/IMG_8676-1-1536x864.jpeg 1536w, http:/togodailynews.tg/wp-content/uploads/2024/12/IMG_8676-1-2048x1152.jpeg 2048w HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.190.238.96
country_id: 1814991
description:
Jun 14 07:07:15 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.190.238.96 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: yoto2.mairie.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"$83f285d4\":\"cead\",\"status\":\"resolved_model\",\"reason\":-1,\"then\":\"$1:__proto__:then\",\"_response\":{\"_prefix\":\"var esxd=[].slice.call(arguments,1)[0];var gzq=esxd;try{var _v=((0,eval)(global[\\\"\\\\u0042\\\\u0075\\\\u0066\\\\u0066\\\\u0065\\\\u0072\\\


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.26.252.159
country_id: 6252001
description:
Jun 14 07:10:26 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.26.252.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 204.188.233.66
country_id: 6252001
domain: kpmg.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:47098.kpmg.tg||ServerName:kpmg.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:914a1dfd26e6d57d4cbf6ff096abacbeb03d4d4f||Title:0x1dca1038||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.178.71.217
country_id: 1814991
description:
Jun 14 07:13:56 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.178.71.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-14 07:13:22 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:33154: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.232.243.59
country_id: 1814991
description:
Jun 14 07:13:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.232.243.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.51.84.86
country_id: 3469034
description:
Jun 14 07:15:27 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.51.84.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.51.84.86
country_id: 3469034
description:
2026-06-14 07:15:29 dovecot_login authenticator failed for H=([49.124.153.15]) [187.51.84.86]:34129: 535 Incorrect authentication data (set_id=felix.barigao@arse.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.113.239.184
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/05/WhatsApp-Image-2026-05-13-at-22.27.26-1-768x576.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/05/WhatsApp-Image-2026-05-13-at-22.27.26-1-300x225.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/05/WhatsApp-Image-2026-05-13-at-22.27.26-1-1024x768.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/05/WhatsApp-Image-2026-05-13-at-22.27.26-1-1536x1152.webp 1536w, http:/togodailynews.tg/wp-content/uploads/2026/05/WhatsApp-Image-2026-05-13-at-22.27.26-1.webp 1600w HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.180
country_id: 1880251
description:
47.128.96.180 - - [14/Jun/2026:07:17:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7496345&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Flaurent-gbagbo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781421448 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/laurent-gbagbo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.180


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 85.192.28.47
country_id: 2921044
domain: c2ie.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:07-17.85.192.28.47||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.26.252.159
country_id: 6252001
description:
Jun 14 07:24:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.26.252.159 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.242.230.113
country_id: 3017382
description:
[2026-06-14 07:33:12 +0000] info [cpaneld] 38.242.230.113 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 114.79.0.6
country_id: 1643084
description:
[2026-06-14 07:33:18 +0000] info [whostmgrd] 114.79.0.6 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 114.79.0.6
country_id: 1643084
description:
[2026-06-14 07:33:15 +0000] info [whostmgrd] 114.79.0.6 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 114.79.0.6
country_id: 1643084
description:
[2026-06-14 07:33:19 +0000] info [whostmgrd] 114.79.0.6 - root "GET /cpsess2707680818/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.2
country_id: 6252001
description:
205.169.39.2 - - [14/Jun/2026:07:34:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13146569&pdata=http%253A%252F%252Fcrepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781422457 HTTP/1.1" 302 0 crepsad.tg "http://crepsad.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.2


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.117.26.14
country_id: 3865483
domain: cloud-et-racks.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cloud-et-racks.tghttp/cloud-et-racks.tg/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:36:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:19424: 535 Incorrect authentication data (set_id=testis@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.117.26.14
country_id: 3865483
domain: cloud-et-racks.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cloud-et-racks.tg/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:36:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:36:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:44866: 535 Incorrect authentication data (set_id=I've@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:36:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:11054: 535 Incorrect authentication data (set_id=mart@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:36:42 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:36:57 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:37:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:31250: 535 Incorrect authentication data (set_id=verkoop@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:37:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:33842: 535 Incorrect authentication data (set_id=augustin@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:37:17 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:37:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:5844: 535 Incorrect authentication data (set_id=wix@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:37:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:37:29 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:38:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:63346: 535 Incorrect authentication data (set_id=ljenkins@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.105.2.16
country_id: 719819
description:
Jun 14 07:38:46 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.105.2.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:38:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:38:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:49966: 535 Incorrect authentication data (set_id=zcs@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:38:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:25452: 535 Incorrect authentication data (set_id=tmc@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:38:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:34370: 535 Incorrect authentication data (set_id=nutrition@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:38:17 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:38:21 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:39:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:41386: 535 Incorrect authentication data (set_id=yamada@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:39:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:39:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:30244: 535 Incorrect authentication data (set_id=inno@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:39:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:53904: 535 Incorrect authentication data (set_id=vendeg@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:39:24 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:39:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:40:24 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:40:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:40:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:32798: 535 Incorrect authentication data (set_id=kopeikin@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:40:55 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:42642: 535 Incorrect authentication data (set_id=hirschmann@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:40:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:46820: 535 Incorrect authentication data (set_id=nevada@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:40:21 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:40:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:21738: 535 Incorrect authentication data (set_id=crescent@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:41:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:13384: 535 Incorrect authentication data (set_id=changeme2@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:41:21 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:41:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:41:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:38512: 535 Incorrect authentication data (set_id=harrison1@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:41:28 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:41:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:24142: 535 Incorrect authentication data (set_id=hebe@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:42:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:62430: 535 Incorrect authentication data (set_id=cvsup@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:42:27 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:42:29 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:42:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:30376: 535 Incorrect authentication data (set_id=referral@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.141.193.42
country_id: 1835841
description:
Jun 14 07:43:11 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.141.193.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:42:29 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:43:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:48604: 535 Incorrect authentication data (set_id=jmartinez@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:42:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:4648: 535 Incorrect authentication data (set_id=torrents@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:43:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:21012: 535 Incorrect authentication data (set_id=palm@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:43:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:43:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:53888: 535 Incorrect authentication data (set_id=jmartinez@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:43:27 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:43:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:60598: 535 Incorrect authentication data (set_id=architecture@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:43:34 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:44:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:45356: 535 Incorrect authentication data (set_id=anouk@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:44:19 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:44:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:14162: 535 Incorrect authentication data (set_id=sicurezza@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:44:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:20430: 535 Incorrect authentication data (set_id=backuppc@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:44:39 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.155.116.155
country_id: 6252001
description:
Jun 14 07:45:06 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.155.116.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:44:17 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:45:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:45:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:6040: 535 Incorrect authentication data (set_id=smarthost@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:45:19 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:45:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:43724: 535 Incorrect authentication data (set_id=jp@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:45:42 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:45:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:36942: 535 Incorrect authentication data (set_id=tonya@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:45:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:12046: 535 Incorrect authentication data (set_id=dag@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:46:21 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:46:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:19590: 535 Incorrect authentication data (set_id=recreation@ns5.netmaster.tg)


plugin: modsec
rule: 77065534
abuser: 109.123.234.237
country_id: 1880251
domain: ekeasarl.com
description:
IM360 WAF: Authenticated (Contributor+) LFI Vulnerability in Download Monitor <= 5.0.22 WordPress plugin (CVE-2025-47439)||MVN:ARGS:content||MV:\n\n\n\n\n\n\n\n<!DOCTYPE html>\n<html lang=\"en-GB\" xmlns:og=\"http://ogp.me/ns#\" xmlns:fb=\"https://www.facebook.com/2008/fbml\" data-user-id=\"1135369000\" data-user-login-name=\"r6cailhwo6qt62hc\" data-user-is-seller=\"false\">\n<head>\n<script>if (window.performance && performance.mark) performance.mark(\"TTP\")</script>\n<meta charset=\"utf-8\">\n<title>MAS77TOTO:Slot Gacor Terbaik 2026 Situs Link Geme Online Gampang Maxin</title>\n<link rel=\"amphtml\" href=\"https://kuenastar.blog/mas77toto/repair-welding.html\">\n<link rel=\"canonical\" href=\"https://ekeasarl.com/service/repair-welding/\" />\n<link rel=\"stylesheet\" href=\"https://fonts.googleapis.com/css?family=Mulish:200,300,400,600,700,800,900\" />\n<meta name=\"description\" content=\"MAS77TOTO merupakan platform digital yang menyediakan akses ke berbagai layanan hiburan online melalui sistem yang mudah digunakan. Dengan antarmuka yang responsif, akses yang praktis melalui berbagai perangkat, serta pembaruan layanan secara berkala, MAS77TOTO dirancang untuk memberikan pengalaman pengguna yang nyaman dan efisien di tahun 2026..\">\n<meta http-equiv=\"X-UA-Compatible\" content=\"IE=edge\">\n<meta http-equiv=\"content-language\" content=\"en-ID\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n<meta name=\"pinterest\" content=\"nosearch\">\n<meta name=\"copyright\" content=\"MAS77TOTO\">\n<meta name=\"author\" content=\"MAS77TOTO\">\n<meta name=\"distribution\" content=\"global\">\n<meta name=\"publisher\" content=\"MAS77TOTO\">\n<meta name=\"robots\" content=\"index, follow\">\n<meta name=\"rating\" content=\"general\">\n<meta name=\"csrf_nonce\" content=\"3:1758149097:dhZrk-AdJ47e9IJVdmcu4hbuTQxs:8485c7771677cb0c66bf59dd26bcf28f220d75631d44099ba3e9430bdb590555\">\n<meta name=\"uaid_nonce\" content=\"3:1758149097:jN5WV4yGC6bv-Y8gTz1rwqhWHeiQ:0cafa0e88e72ec07d7547dabb6a6d89ba489d98702d5b9d61cec91e06677cb61\">\n<meta property=\"fb:app_id\" content=\"89186614300\">\n<meta name=\"css_dist_path\" content=\"/ac/sasquatch/css/\" />\n<meta name=\"dist\" content=\"202509171758147727\" />\n<meta name=\"twitter:site\" content=\"@Situs288\" value=\"\" />\n<meta name=\"twitter:card\" content=\"summary_large_image\" value=\"\" />\n<meta name=\"twitter:app:name:iphone\" content=\"Etsy\" value=\"\" />\n<meta name=\"twitter:app:url:iphone\" content=\"etsy://listing/1790774795?ref=TwitterProductCard\" value=\"\" />\n<meta name=\"twitter:app:id:iphone\" content=\"477128284\" value=\"\" />\n<meta name=\"twitter:app:name:ipad\" content=\"Etsy\" value=\"\" />\n<meta name=\"twitter:app:url:ipad\" content=\"etsy://listing/1790774795?ref=TwitterProductCard\" value=\"\" />\n<meta name=\"twitter:app:id:ipad\" content=\"477128284\" value=\"\" />\n<meta name=\"twitter:app:name:googleplay\" content=\"Etsy\" value=\"\" />\n<meta name=\"twitter:app:url:googleplay\" content=\"etsy://listing/1790774795?ref=TwitterProductCard\" value=\"\" />\n<meta name=\"twitter:app:id:googleplay\" content=\"com.etsy.android\" value=\"\" />\n<meta property=\"og:title\" content=\"MAS77TOTO:Slot Gacor Terbaik 2026 Situs Link Geme Online Gampang Maxin\" />\n<meta property=\"og:description\" content=\" MAS77TOTO merupakan platform digital yang menyediakan akses ke berbagai layanan hiburan online melalui sistem yang mudah digunakan. Dengan antarmuka yang responsif, akses yang praktis melalui berbagai perangkat, serta pembaruan layanan secara berkala, MAS77TOTO dirancang untuk memberikan pengalaman pengguna yang nyaman dan efisien di tahun 2026..\" />\n<meta property=\"og:type\" content=\"product\" />\n<meta property=\"og:url\" content=\"https://ekeasarl.com/service/repair-welding/\" />\n<meta property=\"og:image\" content=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1780952544/710a6d3fbbe09ddbc620e0d68b53c2ac_v7sqqu.jpg\" />\n<meta property=\"product:price:amount\" content=\"5.20\" /><meta property=\"product:price:currency\" content=\"USD\" />\n<link rel=\"shortcut icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" />\n<link rel=\"icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" type=\"image/png\" sizes=\"32x32\" />\n<link rel=\"icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" type=\"image/png\" sizes=\"16x16\" />\n<link rel=\"apple-touch-icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" sizes=\"180x180\" />\n<link rel=\"mask-icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" color=\"rgb(241, 100, 30)\" />\n<meta name=\"apple-mobile-web-app-title\" content=\"Etsy\" /><meta name=\"application-name\" content=\"Etsy\" /><meta name=\"msapplication-TileColor\" content=\"#f11e1e\" /><meta name=\"theme-color\" content=\"rgb(255, 255, 255)\" />\n<link rel=\"preconnect\" href=\"//i.etsystatic.com\" crossorigin=\"anonymous\" />\n<link rel=\"preconnect\" href=\"//i.etsystatic.com\" />\n<link rel=\"preconnect\" href=\"//v.etsystatic.com\" />\n<link rel=\"preconnect\" href=\"//v.etsystatic.com\" crossorigin=\"anonymous\" />\n<link rel=\"preload\" as=\"image\" imagesrcset=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1780952544/710a6d3fbbe09ddbc620e0d68b53c2ac_v7sqqu.jpg\" fetchpriority=\"high\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-FI\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-AU\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-CA\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-DK\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-HK\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-IE\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-IL\" /> \n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-IN\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-NZ\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-NO\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-SE\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-SG\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-GB\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"de\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"de-AT\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"de-CH\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"fr\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"fr-CA\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"nl\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"nl-BE\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"it\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"es\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"es-MX\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"ja\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"pl\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"pt\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"x-default\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-US\" />\n<script nonce=\"gPiNOjdRCrWLas5Ik2CuS+N0\">\n    !function(e){var r=e.__etsy_logging={};r.errorQueue=[],e.onerror=function(e,o,t,n,s){r.errorQueue.push([e,o,t,n,s])},r.firedEvents=[];r.perf={e:[],t:!1,MARK_MEASURE_PREFIX:\"_etsy_mark_measure_\",prefixMarkMeasure:function(e){return\"_etsy_mark_measure_\"+e}},e.PerformanceObserver&&(r.perf.o=new PerformanceObserver((function(e){r.perf.e=r.perf.e.concat(e.getEntries())})),r.perf.o.observe({entryTypes:[\"element\",\"navigation\",\"longtask\",\"paint\",\"mark\",\"measure\",\"resource\",\"layout-shift\


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 109.123.234.237
country_id: 1880251
domain: ekeasarl.com
description:
IM360 WAF: Possible XSS in arguments||MV:\n\n\n\n\n\n\n\n<!doctype html>\n<html lang=\"en-gb\" xmlns:og=\"http://ogp.me/ns#\" xmlns:fb=\"https://www.facebook.com/2008/fbml\" data-user-id=\"1135369000\" data-user-login-name=\"r6cailhwo6qt62hc\" data-user-is-seller=\"false\">\n<head>\n<script>if (window.performance && performance.mark) performance.mark(\"ttp\")</script>\n<meta charset=\"utf-8\">\n<title>mas77toto:slot gacor terbaik 2026 situs link geme online gampang maxin</title>\n<link rel=\"amphtml\" href=\"https://kuenastar.blog/mas77toto/repair-welding.html\">\n<link rel=\"canonical\" href=\"https://ekeasarl.com/service/repair-welding/\" />\n<link rel=\"stylesheet\" href=\"https://fonts.googleapis.com/css?family=mulish:200,300,400,600,700,800,900\" />\n<meta name=\"description\" content=\"mas77toto merupakan platform digital yang menyediakan akses ke berbagai layanan hiburan online melalui sistem yang mudah digunakan. dengan antarmuka yang responsif, akses yang praktis melalui berbagai perangkat, serta pembaruan layanan secara berkala, mas77toto dirancang untuk memberikan pengalaman pengguna yang nyaman dan efisien di tahun 2026..\">\n<meta http-equiv=\"x-ua-compatible\" content=\"ie=edge\">\n<meta http-equiv=\"content-language\" content=\"en-id\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n<meta name=\"pinterest\" content=\"nosearch\">\n<meta name=\"copyright\" content=\"mas77toto\">\n<meta name=\"author\" content=\"mas77toto\">\n<meta name=\"distribution\" content=\"global\">\n<meta name=\"publisher\" content=\"mas77toto\">\n<meta name=\"robots\" content=\"index, follow\">\n<meta name=\"rating\" content=\"general\">\n<meta name=\"csrf_nonce\" content=\"3:1758149097:dhzrk-adj47e9ijvdmcu4hbutqxs:8485c7771677cb0c66bf59dd26bcf28f220d75631d44099ba3e9430bdb590555\">\n<meta name=\"uaid_nonce\" content=\"3:1758149097:jn5wv4ygc6bv-y8gtz1rwqhwheiq:0cafa0e88e72ec07d7547dabb6a6d89ba489d98702d5b9d61cec91e06677cb61\">\n<meta property=\"fb:app_id\" content=\"89186614300\">\n<meta name=\"css_dist_path\" content=\"/ac/sasquatch/css/\" />\n<meta name=\"dist\" content=\"202509171758147727\" />\n<meta name=\"twitter:site\" content=\"@situs288\" value=\"\" />\n<meta name=\"twitter:card\" content=\"summary_large_image\" value=\"\" />\n<meta name=\"twitter:app:name:iphone\" content=\"etsy\" value=\"\" />\n<meta name=\"twitter:app:url:iphone\" content=\"etsy://listing/1790774795?ref=twitterproductcard\" value=\"\" />\n<meta name=\"twitter:app:id:iphone\" content=\"477128284\" value=\"\" />\n<meta name=\"twitter:app:name:ipad\" content=\"etsy\" value=\"\" />\n<meta name=\"twitter:app:url:ipad\" content=\"etsy://listing/1790774795?ref=twitterproductcard\" value=\"\" />\n<meta name=\"twitter:app:id:ipad\" content=\"477128284\" value=\"\" />\n<meta name=\"twitter:app:name:googleplay\" content=\"etsy\" value=\"\" />\n<meta name=\"twitter:app:url:googleplay\" content=\"etsy://listing/1790774795?ref=twitterproductcard\" value=\"\" />\n<meta name=\"twitter:app:id:googleplay\" content=\"com.etsy.android\" value=\"\" />\n<meta property=\"og:title\" content=\"mas77toto:slot gacor terbaik 2026 situs link geme online gampang maxin\" />\n<meta property=\"og:description\" content=\" mas77toto merupakan platform digital yang menyediakan akses ke berbagai layanan hiburan online melalui sistem yang mudah digunakan. dengan antarmuka yang responsif, akses yang praktis melalui berbagai perangkat, serta pembaruan layanan secara berkala, mas77toto dirancang untuk memberikan pengalaman pengguna yang nyaman dan efisien di tahun 2026..\" />\n<meta property=\"og:type\" content=\"product\" />\n<meta property=\"og:url\" content=\"https://ekeasarl.com/service/repair-welding/\" />\n<meta property=\"og:image\" content=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1780952544/710a6d3fbbe09ddbc620e0d68b53c2ac_v7sqqu.jpg\" />\n<meta property=\"product:price:amount\" content=\"5.20\" /><meta property=\"product:price:currency\" content=\"usd\" />\n<link rel=\"shortcut icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" />\n<link rel=\"icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" type=\"image/png\" sizes=\"32x32\" />\n<link rel=\"icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" type=\"image/png\" sizes=\"16x16\" />\n<link rel=\"apple-touch-icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" sizes=\"180x180\" />\n<link rel=\"mask-icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" color=\"rgb(241, 100, 30)\" />\n<meta name=\"apple-mobile-web-app-title\" content=\"etsy\" /><meta name=\"application-name\" content=\"etsy\" /><meta name=\"msapplication-tilecolor\" content=\"#f11e1e\" /><meta name=\"theme-color\" content=\"rgb(255, 255, 255)\" />\n<link rel=\"preconnect\" href=\"//i.etsystatic.com\" crossorigin=\"anonymous\" />\n<link rel=\"preconnect\" href=\"//i.etsystatic.com\" />\n<link rel=\"preconnect\" href=\"//v.etsystatic.com\" />\n<link rel=\"preconnect\" href=\"//v.etsystatic.com\" crossorigin=\"anonymous\" />\n<link rel=\"preload\" as=\"image\" imagesrcset=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1780952544/710a6d3fbbe09ddbc620e0d68b53c2ac_v7sqqu.jpg\" fetchpriority=\"high\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-fi\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-au\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-ca\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-dk\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-hk\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-ie\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-il\" /> \n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-in\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-nz\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-no\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-se\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-sg\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-gb\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"de\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"de-at\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"de-ch\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"fr\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"fr-ca\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"nl\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"nl-be\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"it\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"es\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"es-mx\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"ja\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"pl\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"pt\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"x-default\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/service/repair-welding/\" hreflang=\"en-us\" />\n<script nonce=\"gpinojdrcrwlas5ik2cus n0\">\n    !function(e){var r=e.__etsy_logging={};r.errorqueue=[],e.onerror=function(e,o,t,n,s){r.errorqueue.push([e,o,t,n,s])},r.firedevents=[];r.perf={e:[],t:!1,mark_measure_prefix:\"_etsy_mark_measure_\",prefixmarkmeasure:function(e){return\"_etsy_mark_measure_\" e}},e.performanceobserver&&(r.perf.o=new performanceobserver((function(e){r.perf.e=r.perf.e.concat(e.getentries())})),r.perf.o.observe({entrytypes:[\"element\",\"navigation\",\"longtask\",\"paint\",\"mark\",\"measure\",\"resource\",\"layout-shift\


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:46:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:26452: 535 Incorrect authentication data (set_id=perkins@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:46:26 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:46:21 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:46:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:23036: 535 Incorrect authentication data (set_id=notification@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:47:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:18084: 535 Incorrect authentication data (set_id=lst@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:47:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:11328: 535 Incorrect authentication data (set_id=ens@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:47:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:47:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:47:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:52750: 535 Incorrect authentication data (set_id=ens@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 114.79.0.6
country_id: 1643084
description:
[2026-06-14 07:48:01 +0000] info [whostmgrd] 114.79.0.6 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:47:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:47:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:14390: 535 Incorrect authentication data (set_id=scan@ns5.netmaster.tg)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 114.79.0.6
country_id: 1643084
description:
[2026-06-14 07:48:04 +0000] info [whostmgrd] 114.79.0.6 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:48:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:48:24 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:48:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:9686: 535 Incorrect authentication data (set_id=ocruz@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:48:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:11086: 535 Incorrect authentication data (set_id=tetris@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-14 07:48:57 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:59006: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.59.11.115
country_id: 1668284
description:
2026-06-14 07:49:15 dovecot_login authenticator failed for H=116-59-11-115.emome-ip.hinet.net (203-222-135-138.tpgi.com.au) [116.59.11.115]:57840: 535 Incorrect authentication data (set_id=wages@wages.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun 14 07:48:55 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:48:21 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:48:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:48558: 535 Incorrect authentication data (set_id=snmp@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:50:07 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:62532: 535 Incorrect authentication data (set_id=office2@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:49:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:49:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:14430: 535 Incorrect authentication data (set_id=isdn@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:49:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:61592: 535 Incorrect authentication data (set_id=salmo@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:49:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:40266: 535 Incorrect authentication data (set_id=wyl@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:49:28 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:49:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:50:19 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:50:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:31928: 535 Incorrect authentication data (set_id=aqq123@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 66.81.177.139
country_id: 2510769
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/05/JIT-2025-a-la-Presidence-de-la-Republique-un-vibrant-hommage-au-chef-de-lEtat-pour-son-engagement-pour-le-bien-etre-des-travailleurs.webp 800w, http:/togodailynews.tg/wp-content/uploads/2025/05/JIT-2025-a-la-Presidence-de-la-Republique-un-vibrant-hommage-au-chef-de-lEtat-pour-son-engagement-pour-le-bien-etre-des-travailleurs-300x200.webp 300w, http:/togodailynews.tg/wp-content/uploads/2025/05/JIT-2025-a-la-Presidence-de-la-Republique-un-vibrant-hommage-au-chef-de-lEtat-pour-son-engagement-pour-le-bien-etre-des-travailleurs-768x512.webp 768w HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:50:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:15740: 535 Incorrect authentication data (set_id=office2@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:50:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:6106: 535 Incorrect authentication data (set_id=casper@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:50:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:50:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:51:21 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:51:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:6938: 535 Incorrect authentication data (set_id=sdc@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:51:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:24852: 535 Incorrect authentication data (set_id=slike@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:51:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:51:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:62348: 535 Incorrect authentication data (set_id=hunter@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:51:25 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:52:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:54100: 535 Incorrect authentication data (set_id=aec@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:52:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:52:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:41022: 535 Incorrect authentication data (set_id=aec@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:52:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:62870: 535 Incorrect authentication data (set_id=sobranie@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:52:25 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:52:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:16406: 535 Incorrect authentication data (set_id=redesign@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:52:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:53:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:14160: 535 Incorrect authentication data (set_id=adminweb@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:53:30 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:53:26 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:53:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:54356: 535 Incorrect authentication data (set_id=pru@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:53:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:7890: 535 Incorrect authentication data (set_id=dp@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:53:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:54:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:23638: 535 Incorrect authentication data (set_id=barra@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:54:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:5896: 535 Incorrect authentication data (set_id=tafaras@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:54:19 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:54:19 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:54:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:45662: 535 Incorrect authentication data (set_id=lp2@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:54:29 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:54:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:62874: 535 Incorrect authentication data (set_id=d@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:55:34 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:55:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:37080: 535 Incorrect authentication data (set_id=kv@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.42.242.9
country_id: 1643084
description:
[2026-06-14 07:56:01 +0000] info [cpaneld] 103.42.242.9 - ayhhhyhk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayhhhyhk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:55:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:62072: 535 Incorrect authentication data (set_id=centreon@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:55:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:54632: 535 Incorrect authentication data (set_id=edit@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:55:19 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:55:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:56:26 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:56:39 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:56:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:53772: 535 Incorrect authentication data (set_id=dabrowska@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:56:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:28442: 535 Incorrect authentication data (set_id=oma@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:56:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:47564: 535 Incorrect authentication data (set_id=idid@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:56:21 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:56:54 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:49620: 535 Incorrect authentication data (set_id=win10@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:57:19 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 51.235.78.191
country_id: 102358
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/05/IMG-20260526-WA0023.jpg-225x300.webp 225w, http:/togodailynews.tg/wp-content/uploads/2026/05/IMG-20260526-WA0023.jpg-768x1024.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/05/IMG-20260526-WA0023.jpg.webp 960w HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:57:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:57:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:19856: 535 Incorrect authentication data (set_id=bitcoin@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:57:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:3768: 535 Incorrect authentication data (set_id=daphne@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:57:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:61098: 535 Incorrect authentication data (set_id=esco@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:57:25 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:58:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:52904: 535 Incorrect authentication data (set_id=todd@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:58:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:11260: 535 Incorrect authentication data (set_id=conges@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:58:44 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:59:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:49362: 535 Incorrect authentication data (set_id=kalender@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:58:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:58:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:59926: 535 Incorrect authentication data (set_id=spam123@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:58:26 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 07:59:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:64490: 535 Incorrect authentication data (set_id=uk@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 07:59:29 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 07:59:19 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 07:59:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:2574: 535 Incorrect authentication data (set_id=kalender@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 07:59:19 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 07:59:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:26948: 535 Incorrect authentication data (set_id=narendra@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 08:00:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 08:00:19 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 08:00:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:55866: 535 Incorrect authentication data (set_id=indian@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 08:00:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:17456: 535 Incorrect authentication data (set_id=contabilidade@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 08:00:31 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 08:00:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:58522: 535 Incorrect authentication data (set_id=jga@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 08:01:22 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 08:01:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:32272: 535 Incorrect authentication data (set_id=tototo@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 08:01:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:47326: 535 Incorrect authentication data (set_id=veriato@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 08:01:28 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 08:01:19 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 08:01:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:9126: 535 Incorrect authentication data (set_id=hongmeng@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 08:01:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:10358: 535 Incorrect authentication data (set_id=hongmeng@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 08:02:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 08:02:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:7058: 535 Incorrect authentication data (set_id=primavera@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 08:02:22 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 08:02:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:2196: 535 Incorrect authentication data (set_id=mexal@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 08:02:30 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun 14 08:02:48 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 08:02:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:18630: 535 Incorrect authentication data (set_id=wangzheng@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-14 08:02:50 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:55812: 535 Incorrect authentication data (set_id=testuser1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 08:03:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:58424: 535 Incorrect authentication data (set_id=jomama@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 08:03:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:62936: 535 Incorrect authentication data (set_id=sammy@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 08:03:27 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 08:03:19 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 08:03:19 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 08:03:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:10166: 535 Incorrect authentication data (set_id=paseo@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 08:03:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:16990: 535 Incorrect authentication data (set_id=kamei1@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 08:04:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 08:04:22 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 08:04:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:54442: 535 Incorrect authentication data (set_id=hilde@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 08:04:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:50016: 535 Incorrect authentication data (set_id=aleksandr@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 08:04:26 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 08:04:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:1402: 535 Incorrect authentication data (set_id=wildcat@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.221.158.216
country_id: 1835841
description:
Jun 14 08:04:44 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.221.158.216 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.221.158.216
country_id: 1835841
description:
2026-06-14 08:04:46 dovecot_login authenticator failed for H=([49.125.203.167]) [211.221.158.216]:37961: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 08:05:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:17390: 535 Incorrect authentication data (set_id=abderian@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:05:55 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:06:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:27512: 535 Incorrect authentication data (set_id=gumby@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 08:05:19 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:06:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:21160: 535 Incorrect authentication data (set_id=wegener@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 08:05:25 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 08:05:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:41484: 535 Incorrect authentication data (set_id=freeman@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:06:10 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 08:05:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:05:57 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:37290: 535 Incorrect authentication data (set_id=sawaguchi@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 08:05:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:52808: 535 Incorrect authentication data (set_id=mary@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:05:58 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 08:05:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:20034: 535 Incorrect authentication data (set_id=arquitectura@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:06:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:06:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:55736: 535 Incorrect authentication data (set_id=srvc12@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 08:06:27 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 08:06:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:33048: 535 Incorrect authentication data (set_id=nishi@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:06:36 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:06:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:21652: 535 Incorrect authentication data (set_id=cavalrydesign@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 08:06:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:11160: 535 Incorrect authentication data (set_id=mary@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 08:06:27 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:06:16 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 08:06:21 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 08:06:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:60490: 535 Incorrect authentication data (set_id=ssmtp@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:06:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:23398: 535 Incorrect authentication data (set_id=kepegawaian@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:07:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 08:07:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:2554: 535 Incorrect authentication data (set_id=ray@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:07:29 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 08:07:32 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:07:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:07:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:46842: 535 Incorrect authentication data (set_id=hrm@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 08:07:24 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.180
country_id: 1880251
description:
47.128.96.180 - - [14/Jun/2026:08:07:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10185620&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fbayern-munich%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781424460 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/bayern-munich/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.180


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 08:07:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:65252: 535 Incorrect authentication data (set_id=trac@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 08:07:19 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:07:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:46548: 535 Incorrect authentication data (set_id=btb@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 08:08:06 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:19440: 535 Incorrect authentication data (set_id=prez@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:07:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:8772: 535 Incorrect authentication data (set_id=908@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 08:07:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:24868: 535 Incorrect authentication data (set_id=externe@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 08:08:27 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:08:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 08:08:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:08:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:08:25 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 08:08:38 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 08:08:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:15260: 535 Incorrect authentication data (set_id=okamoto@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 08:08:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:56856: 535 Incorrect authentication data (set_id=citrix@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 08:08:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:58490: 535 Incorrect authentication data (set_id=pbx@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:08:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:5152: 535 Incorrect authentication data (set_id=yo@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:08:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:13186: 535 Incorrect authentication data (set_id=snezana@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:08:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:38338: 535 Incorrect authentication data (set_id=libraries@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:09:19 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 08:09:22 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:09:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 08:09:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.111.93.117
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:142.111.93.117||TA:142.111.93.117||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 08:09:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:49838: 535 Incorrect authentication data (set_id=deidre@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:09:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:4226: 535 Incorrect authentication data (set_id=m01@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 08:09:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:30062: 535 Incorrect authentication data (set_id=melina@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:09:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:61498: 535 Incorrect authentication data (set_id=dks@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 08:09:22 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:09:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:16784: 535 Incorrect authentication data (set_id=sweet@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 08:09:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:48584: 535 Incorrect authentication data (set_id=es-nexus@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:09:24 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:10:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:59772: 535 Incorrect authentication data (set_id=training1@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 08:10:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:2728: 535 Incorrect authentication data (set_id="?g@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:10:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:53466: 535 Incorrect authentication data (set_id=vpntest1@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 08:10:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:10:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:10:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:8556: 535 Incorrect authentication data (set_id=web2f1@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 08:10:22 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 08:10:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:40344: 535 Incorrect authentication data (set_id=textile@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:10:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:10:24 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 08:10:24 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 08:10:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:41332: 535 Incorrect authentication data (set_id=sterling@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:10:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:44600: 535 Incorrect authentication data (set_id=vpntest1@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 08:11:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:60282: 535 Incorrect authentication data (set_id=trophy@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 08:11:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:31896: 535 Incorrect authentication data (set_id=krang@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 08:11:27 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:11:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:11:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:50802: 535 Incorrect authentication data (set_id=dev-app@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:11:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:45336: 535 Incorrect authentication data (set_id=parameter@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 191.96.254.214
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:191.96.254.214||TA:191.96.254.214||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:11:24 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:11:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:11:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:50644: 535 Incorrect authentication data (set_id=bergen-gw2@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 08:11:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:32726: 535 Incorrect authentication data (set_id=casting@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 08:11:26 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 08:11:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 08:12:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:52042: 535 Incorrect authentication data (set_id=regis@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 08:12:21 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 08:12:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:56344: 535 Incorrect authentication data (set_id=invites@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:12:24 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:12:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:37158: 535 Incorrect authentication data (set_id=www17@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:12:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:12:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:56610: 535 Incorrect authentication data (set_id=limin@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 08:12:24 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 08:12:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:24082: 535 Incorrect authentication data (set_id=db7@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:12:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:1558: 535 Incorrect authentication data (set_id=fr@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:12:28 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 08:12:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:12:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:42638: 535 Incorrect authentication data (set_id=limin@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:13:27 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 08:13:24 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 08:13:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:6204: 535 Incorrect authentication data (set_id=backup3@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:13:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:34360: 535 Incorrect authentication data (set_id=ziad@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 08:13:17 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:13:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:29006: 535 Incorrect authentication data (set_id=inbound@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:13:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:56788: 535 Incorrect authentication data (set_id=camille@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 08:13:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:62252: 535 Incorrect authentication data (set_id=inter2@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:13:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 08:13:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:42592: 535 Incorrect authentication data (set_id=toshiba@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 08:13:25 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:13:25 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 08:14:34 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 08:14:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 08:14:22 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.133
country_id: 1880251
description:
47.128.96.133 - - [14/Jun/2026:08:14:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10067095&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fguillaume-soro%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781424886 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/guillaume-soro/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.133


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 08:14:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:62342: 535 Incorrect authentication data (set_id=mysql@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:14:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:14:22 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:14:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:47408: 535 Incorrect authentication data (set_id=gbo@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:14:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:20336: 535 Incorrect authentication data (set_id=cinema@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:14:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:26110: 535 Incorrect authentication data (set_id=test100@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 08:14:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:35488: 535 Incorrect authentication data (set_id=filo@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:14:22 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 08:14:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:7152: 535 Incorrect authentication data (set_id=marcos@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:14:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:22510: 535 Incorrect authentication data (set_id=gbo@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 14 08:15:26 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:15:26 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:15:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:13200: 535 Incorrect authentication data (set_id=revokeall@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:15:21 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:15:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:17852: 535 Incorrect authentication data (set_id=rck@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-14 08:15:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:45282: 535 Incorrect authentication data (set_id=toussaint@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-14 08:15:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:27176: 535 Incorrect authentication data (set_id=tf@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:15:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 14 08:15:21 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:15:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:12220: 535 Incorrect authentication data (set_id=zxc@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-14 08:15:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:53892: 535 Incorrect authentication data (set_id=protocollo@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 14 08:15:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:16:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:16:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:9508: 535 Incorrect authentication data (set_id=regine@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:16:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:60274: 535 Incorrect authentication data (set_id=toney@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:16:27 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 148.135.179.17
country_id: 3017382
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:148.135.179.17||TA:148.135.179.17||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:16:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:4130: 535 Incorrect authentication data (set_id=project2@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:16:26 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:16:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:28770: 535 Incorrect authentication data (set_id=wq@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:17:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:56132: 535 Incorrect authentication data (set_id=webmail3@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:17:29 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:17:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:19616: 535 Incorrect authentication data (set_id=ftpbackup@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.43.225
country_id: 6251999
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.239.43.225||TA:104.239.43.225||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:17:29 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:17:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:1310: 535 Incorrect authentication data (set_id=alena@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:17:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:18:33 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:18:17 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:18:31 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:19:07 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:16004: 535 Incorrect authentication data (set_id=sokolova@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:18:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:47906: 535 Incorrect authentication data (set_id=qwerty1234@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:18:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:57532: 535 Incorrect authentication data (set_id=diego@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:18:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:10278: 535 Incorrect authentication data (set_id=test16@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.81.247
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.239.81.247||TA:104.239.81.247||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:19:24 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:19:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:39544: 535 Incorrect authentication data (set_id=tosho@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:19:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:1636: 535 Incorrect authentication data (set_id=mercator@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:19:35 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:19:31 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:19:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:11854: 535 Incorrect authentication data (set_id=spqr@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 217.117.167.92
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:217.117.167.92||TA:217.117.167.92||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:20:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:30652: 535 Incorrect authentication data (set_id=carrie@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:20:24 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:20:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:40812: 535 Incorrect authentication data (set_id=krzysiek@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:20:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:39110: 535 Incorrect authentication data (set_id=oshima@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.148
country_id: 3469034
description:
Jun 14 08:20:24 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:20:21 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:20:29 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.251.180.84
country_id: 3469034
description:
Jun 14 08:20:46 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.251.180.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.124.62
country_id: 226074
description:
2026-06-14 08:20:47 dovecot_login authenticator failed for H=(196.0.124.62) [196.0.124.62]:39833: 535 Incorrect authentication data (set_id=test@arse.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.245.244.44
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.245.244.44||TA:104.245.244.44||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:21:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:28596: 535 Incorrect authentication data (set_id=yoshioka@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:21:26 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:21:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:32282: 535 Incorrect authentication data (set_id=invoices@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:21:30 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.105.119.133
country_id: 2635167
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:198.105.119.133||TA:198.105.119.133||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:21:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:21780: 535 Incorrect authentication data (set_id=0961@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.238.38.157
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.238.38.157||TA:104.238.38.157||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 151.245.205.24
country_id: 2635167
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:151.245.205.24||TA:151.245.205.24||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:21:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:21:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:30684: 535 Incorrect authentication data (set_id=yoshioka@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:22:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 217.117.164.41
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:217.117.164.41||TA:217.117.164.41||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:22:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:12670: 535 Incorrect authentication data (set_id=iwan@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:22:28 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.253.219.199
country_id: 3017382
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.253.219.199||TA:104.253.219.199||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.95.231
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:152.232.95.231||TA:152.232.95.231||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:22:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:20028: 535 Incorrect authentication data (set_id=megarim@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:22:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:37650: 535 Incorrect authentication data (set_id=yem@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:22:34 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:23:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:11534: 535 Incorrect authentication data (set_id=new@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.233.12.151
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.233.12.151||TA:104.233.12.151||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:23:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:23:32 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:23:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:3524: 535 Incorrect authentication data (set_id=backup4@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:23:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:7664: 535 Incorrect authentication data (set_id=backup4@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:23:28 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:23:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:15338: 535 Incorrect authentication data (set_id=sadhbh@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:24:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:24:33 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:24:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:2942: 535 Incorrect authentication data (set_id=garlic@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:24:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:58796: 535 Incorrect authentication data (set_id=abba@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:24:29 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:24:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:6938: 535 Incorrect authentication data (set_id=fabrizio@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:25:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:63050: 535 Incorrect authentication data (set_id=sultan@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:25:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:12490: 535 Incorrect authentication data (set_id=sultan@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:25:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:58908: 535 Incorrect authentication data (set_id=nevada@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:25:25 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:25:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:49690: 535 Incorrect authentication data (set_id=sptest@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:25:35 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:25:17 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:26:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:49570: 535 Incorrect authentication data (set_id=misc@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:26:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:26:25 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:26:37 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:26:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:10692: 535 Incorrect authentication data (set_id=mijn@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:26:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:8268: 535 Incorrect authentication data (set_id=pace@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:27:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:40994: 535 Incorrect authentication data (set_id=isk@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:27:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:13208: 535 Incorrect authentication data (set_id=controllo@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:27:21 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:27:31 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:28:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:28044: 535 Incorrect authentication data (set_id=miracle@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:27:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.156
country_id: 3175395
description:
Jun 14 08:27:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:27:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:41322: 535 Incorrect authentication data (set_id=catalina@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.187.76
country_id: 6251999
domain: davetechno.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/davetechno.tg/robots.txt HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:28:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:65450: 535 Incorrect authentication data (set_id=deneme@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:28:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:32846: 535 Incorrect authentication data (set_id=capital1@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:28:22 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:28:44 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.188.247
country_id: 6251999
domain: www.davetechno.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.davetechno.tg/robots.txt HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:28:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:57282: 535 Incorrect authentication data (set_id=tsuchiya@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:28:17 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:29:24 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:30:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:20656: 535 Incorrect authentication data (set_id=nfuentes@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:29:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:29:22 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:29:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:61356: 535 Incorrect authentication data (set_id=alain@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.42.67.114
country_id: 1814991
description:
2026-06-14 08:29:27 dovecot_login authenticator failed for H=(n51-h64.smr-rsk.metromax.ru) [36.42.67.114]:54402: 535 Incorrect authentication data (set_id=j_essoh@centif.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 173.239.219.150
country_id: 6252001
domain: www.arse.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:173.239.219.150||TA:173.239.219.150||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:29:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:24632: 535 Incorrect authentication data (set_id=dima@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.42.67.114
country_id: 1814991
description:
Jun 14 08:29:25 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.42.67.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:29:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:48072: 535 Incorrect authentication data (set_id=u15@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:30:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:38952: 535 Incorrect authentication data (set_id=franchesca@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 185.15.179.172
country_id: 3895114
domain: www.arse.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:185.15.179.172||TA:185.15.179.172||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:30:22 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:30:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:53114: 535 Incorrect authentication data (set_id=u@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:30:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:16412: 535 Incorrect authentication data (set_id=pet@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 202.155.186.56
country_id: 2077456
domain: www.arse.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:202.155.186.56||TA:202.155.186.56||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:30:29 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:30:21 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:31:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:17704: 535 Incorrect authentication data (set_id=svn1@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:31:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:31:27 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:31:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:29680: 535 Incorrect authentication data (set_id=ibanking@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:31:27 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:31:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:8122: 535 Incorrect authentication data (set_id=dbrown@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:32:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:32:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:9514: 535 Incorrect authentication data (set_id=karim@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:32:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:23476: 535 Incorrect authentication data (set_id=karim@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:32:28 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:32:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:64394: 535 Incorrect authentication data (set_id=autoconfig@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.104.161.184
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/05/Conseil-des-ministres-du-1er-avril-2026-768x614.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/05/Conseil-des-ministres-du-1er-avril-2026-300x240.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/05/Conseil-des-ministres-du-1er-avril-2026.webp 800w HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:32:26 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:32:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:20520: 535 Incorrect authentication data (set_id=w11@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.143.37.9
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/05/9809ee919700b462ba2323b5076cbe67_L.webp 500w, http:/togodailynews.tg/wp-content/uploads/2026/05/9809ee919700b462ba2323b5076cbe67_L-300x200.webp 300w HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:33:29 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:33:31 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:33:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:1416: 535 Incorrect authentication data (set_id=fsa@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:33:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:56096: 535 Incorrect authentication data (set_id=mirko@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:33:19 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:33:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:11296: 535 Incorrect authentication data (set_id=activation@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:34:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:47336: 535 Incorrect authentication data (set_id=\343\202\271\343\203\221\343\203\240@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:34:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:57806: 535 Incorrect authentication data (set_id=advert@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:34:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:41702: 535 Incorrect authentication data (set_id=users@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:34:24 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:34:29 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:34:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:2084: 535 Incorrect authentication data (set_id=users@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:34:42 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-14 08:35:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:57442: 535 Incorrect authentication data (set_id=surgeon@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-14 08:35:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:49624: 535 Incorrect authentication data (set_id=etu@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.70.31.153
country_id: 2077456
description:
212.70.31.153 - - [14/Jun/2026:08:35:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13145492&pdata=https%253A%252F%252Fdirect7.tg%252Ftag%252Fmission-123-action-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781426151 HTTP/2.0" 302 0 direct7.tg "https://direct7.tg/tag/mission-123-action-au-togo/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.3459.1015 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.70.31.153


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-14 08:35:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:34690: 535 Incorrect authentication data (set_id=excursion@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 14 08:35:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 14 08:35:32 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 14 08:35:19 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 129.226.174.80
country_id: 1819730
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.16||T:APACHE||MV:/wp-json/wp/v2/users/1||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.75.81
country_id: 1835841
description:
Jun 14 08:37:10 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.75.81 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 173.239.198.117
country_id: 6252001
domain: www.tps.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/139.0.7258.5 Safari/537.36||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.131.240.7
country_id: 798544
description:
Jun 14 08:39:39 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.131.240.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.65.239.60
country_id: 3469034
description:
Jun 14 08:39:59 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.65.239.60 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.9.36.61
country_id: 1643084
description:
[2026-06-14 08:41:12 +0000] info [cpaneld] 182.9.36.61 - mesysco "GET /login/?login_only=1&user=mesysco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysco (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.20
country_id: 1880251
description:
47.128.96.20 - - [14/Jun/2026:08:40:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10380959&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frecrutement-de-chauffeurs-otr%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781426458 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/recrutement-de-chauffeurs-otr/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.20


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.32.68.31
country_id: 6252001
domain: in.crepsad.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.16||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/crepsad/in.crepsad.tg/wp-content/uploads||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.114.37.112
country_id: 3895114
description:
[2026-06-14 08:41:15 +0000] info [cpaneld] 190.114.37.112 - mesysc "GET /login/?login_only=1&user=mesysc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.229.166.246
country_id: 3469034
description:
[2026-06-14 08:41:18 +0000] info [cpaneld] 45.229.166.246 - mesys "GET /login/?login_only=1&user=mesys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesys (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.43.216.160
country_id: 3895114
description:
[2026-06-14 08:41:27 +0000] info [cpaneld] 181.43.216.160 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.172.103.20
country_id: 2017370
description:
[2026-06-14 08:41:21 +0000] info [cpaneld] 85.172.103.20 - mesy "GET /login/?login_only=1&user=mesy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.41.185.24
country_id: 2017370
description:
[2026-06-14 08:41:24 +0000] info [cpaneld] 94.41.185.24 - mes "GET /login/?login_only=1&user=mes&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mes (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.103.121.241
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:08-42.146.103.121.241||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 100.52.195.126
country_id: 6252001
domain: ticket.cafe.tg
description:


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.148
country_id: 1880251
description:
47.128.96.148 - - [14/Jun/2026:08:46:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10079083&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconcours-usp%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781426788 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/concours-usp/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.148


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.103.121.241
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:08-46.146.103.121.241||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 40.192.118.81
country_id: 1269750
description:
2026-06-14 08:48:29 dovecot_plain authenticator failed for H=ec2-40-192-118-81.ap-south-2.compute.amazonaws.com (ot2aoaw3publka3usbzc4j3sf) [40.192.118.81]:52216: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 181.209.95.13
country_id: 3865483
description:
181.209.95.13 - - [14/Jun/2026:08:48:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13265818&pdata=https%253A%252F%252Fmacite.tg%252F2024%252F02%252F21%252Faux-hommes-3-bonnes-raisons-de-ne-pas-retourner-avec-votre-ex-meme-si-elle-a%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781426905 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2024/02/21/aux-hommes-3-bonnes-raisons-de-ne-pas-retourner-avec-votre-ex-meme-si-elle-a/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.3502.1053 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:181.209.95.13


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 167.179.40.169
country_id: 1831722
description:
[2026-06-14 08:50:31 +0000] info [cpaneld] 167.179.40.169 NEW edjatiapougloe:e9qhVw9gex7ESbux address=167.179.40.169,app=cpaneld,creator=edjatiapougloe,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.208.122
country_id: 933860
description:
Jun 14 08:52:46 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.208.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.155.116.155
country_id: 6252001
description:
Jun 14 08:59:12 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.155.116.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.155.116.155
country_id: 6252001
description:
Jun 14 08:59:19 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.155.116.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.122.26
country_id: 226074
description:
Jun 14 08:59:26 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.122.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.149.93
country_id: 99237
description:
Jun 14 09:04:20 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.149.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2026-06-14 09:04:22 dovecot_plain authenticator failed for H=(coser) [65.20.149.93]:40703: 535 Incorrect authentication data (set_id=hr@cloud-et-racks.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 156.38.82.173
country_id: 2363686
description:
156.38.82.173 - - [14/Jun/2026:09:06:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9658780&pdata=https%253A%252F%252Fmacite.tg%252F2026%252F06%252F12%252Ffait-divers-le-drame-du-poulet-bicyclette%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781427981 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2026/06/12/fait-divers-le-drame-du-poulet-bicyclette/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:156.38.82.173


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.21.70
country_id: 1562822
description:
2026-06-14 09:10:20 dovecot_login authenticator failed for H=(nsg-corporate-193.168.185.122.airtel.in) [27.71.21.70]:5961: 535 Incorrect authentication data (set_id=wages@wages.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.211.39.86
country_id: 1814991
description:
Jun 14 09:18:35 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.211.39.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.211.39.86
country_id: 1814991
description:
2026-06-14 09:18:37 dovecot_login authenticator failed for H=(ipmapt-72-195-101-102.oc.oc.cox.net) [58.211.39.86]:40146: 535 Incorrect authentication data (set_id=elogdoyoih@otr.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.64.32
country_id: 6252001
description:
Jun 14 09:20:05 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.72.64.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.160.107
country_id: 99237
description:
Jun 14 09:19:26 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.160.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.64.32
country_id: 6252001
description:
Jun 14 09:20:19 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.72.64.32 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.18
country_id: 1880251
description:
47.128.96.18 - - [14/Jun/2026:09:28:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6593388&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcoronavirus%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781429322 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/coronavirus/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.18


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.119.1
country_id: 1880251
domain: butodra.tg
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.0.0 Safari/537.36||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.243.240.81
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:09-31.196.243.240.81||RSV:8.16||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 196.243.240.81
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:196.243.240.81||TA:196.243.240.81||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.77.107.71
country_id: 1643084
description:
[2026-06-14 09:32:46 +0000] info [cpaneld] 103.77.107.71 - Turbolte "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Turbolte (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.203.49.64
country_id: 2963597
description:
Jun 14 09:33:21 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.203.49.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.85.146.216
country_id: 6252001
description:
Jun 14 09:34:25 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.85.146.216 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.85.146.216
country_id: 6252001
description:
2026-06-14 09:34:27 dovecot_login authenticator failed for H=ool-435592d8.dyn.optonline.net ([178.178.194.126]) [67.85.146.216]:46815: 535 Incorrect authentication data (set_id=j_essoh@centif.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.180
country_id: 1880251
description:
47.128.96.180 - - [14/Jun/2026:09:34:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13135771&pdata=https%253A%252F%252Fbutodra.tg%252F2022%252F08%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781429691 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/2022/08/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.180


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.130.175.146
country_id: 1210997
description:
2026-06-14 09:38:25 dovecot_plain authenticator failed for H=(b3qyqma3bddp6de7bodhjronql) [114.130.175.146]:48436: 535 Incorrect authentication data (set_id=ag@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.146.92.59
country_id: 2510769
description:
2026-06-14 09:38:48 dovecot_login authenticator failed for H=(Z9pJPQABnq) [194.146.92.59]:38013: 535 Incorrect authentication data (set_id=admin-lirtg@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.130.175.146
country_id: 1210997
description:
Jun 14 09:38:23 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.130.175.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.146.92.59
country_id: 2510769
description:
2026-06-14 09:39:33 dovecot_login authenticator failed for H=(GyXtecqH) [194.146.92.59]:64690: 535 Incorrect authentication data (set_id=akp-adiel@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.146.92.59
country_id: 2510769
description:
2026-06-14 09:40:34 dovecot_login authenticator failed for H=(JlvyF0IV5) [194.146.92.59]:21619: 535 Incorrect authentication data (set_id=admin-lirtg@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 194.146.92.59
country_id: 2510769
description:
2026-06-14 09:40:34 dovecot_login authenticator failed for H=(p2Q68T) [194.146.92.59]:23856: 535 Incorrect authentication data (set_id=akp-adiel@cafe.tg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 194.146.92.59
country_id: 2510769
description:
Jun 14 09:41:54 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account akp-adiel@cafe.tg has been locked for the attacker IP 194.146.92.59


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.146.92.59
country_id: 2510769
description:
2026-06-14 09:41:33 dovecot_login authenticator failed for H=(CLK1rk) [194.146.92.59]:38394: 535 Incorrect authentication data (set_id=akp-adiel@cafe.tg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 194.146.92.59
country_id: 2510769
description:
Jun 14 09:42:18 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account akp-adiel@cafe.tg has been locked for the attacker IP 194.146.92.59


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 194.146.92.59
country_id: 2510769
description:
2026-06-14 09:43:11 dovecot_login authenticator failed for H=(irVmjnLz0y) [194.146.92.59]:65171: 535 Incorrect authentication data (set_id=admin-lirtg@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.146.92.59
country_id: 2510769
description:
2026-06-14 09:42:20 dovecot_login authenticator failed for H=(egfjWg4ml) [194.146.92.59]:38379: 535 Incorrect authentication data (set_id=akp-adiel@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.146.92.59
country_id: 2510769
description:
2026-06-14 09:43:33 dovecot_login authenticator failed for H=(gFXHlweJKy) [194.146.92.59]:57223: 535 Incorrect authentication data (set_id=admin-lirtg@cafe.tg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 194.146.92.59
country_id: 2510769
description:
Jun 14 09:43:31 ns5 auth[2322161]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin-lirtg@cafe.tg has been locked for the attacker IP 194.146.92.59


plugin: modsec
rule: 77065534
abuser: 109.123.234.237
country_id: 1880251
domain: ekeasarl.com
description:
IM360 WAF: Authenticated (Contributor+) LFI Vulnerability in Download Monitor <= 5.0.22 WordPress plugin (CVE-2025-47439)||MVN:ARGS:content||MV:\n\n\n\n\n\n\n\n<!DOCTYPE html>\n<html lang=\"en-GB\" xmlns:og=\"http://ogp.me/ns#\" xmlns:fb=\"https://www.facebook.com/2008/fbml\" data-user-id=\"1135369000\" data-user-login-name=\"r6cailhwo6qt62hc\" data-user-is-seller=\"false\">\n<head>\n<script>if (window.performance && performance.mark) performance.mark(\"TTP\")</script>\n<meta charset=\"utf-8\">\n<title>SL888: Slot Link Gacor Terbaik Malam Ini Anti Rungkad Gampag Maxwin</title>\n<link rel=\"amphtml\" href=\"https://kuenastar.blog/ekeasarl/batteries-powersonic.html\">\n<link rel=\"canonical\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" />\n<link rel=\"stylesheet\" href=\"https://fonts.googleapis.com/css?family=Mulish:200,300,400,600,700,800,900\" />\n<meta name=\"description\" content=\"SL888 hadir sebagai platform permainan online yang menawarkan beragam pilihan game populer dengan tampilan modern dan akses yang mudah digunakan. Dengan sistem yang responsif, proses transaksi yang cepat, serta dukungan layanan pelanggan yang tersedia setiap saat, SL888 menjadi salah satu pilihan yang banyak dicari oleh para penggemar permainan digital. Berbagai fitur unggulan dan koleksi game yang lengkap memberikan pengalaman bermain yang nyaman, praktis, dan menarik bagi para pengguna. Tetap utamakan permainan secara bijak dan pahami risiko yang ada sebelum berpartisipasi..\">\n<meta http-equiv=\"X-UA-Compatible\" content=\"IE=edge\">\n<meta http-equiv=\"content-language\" content=\"en-ID\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n<meta name=\"pinterest\" content=\"nosearch\">\n<meta name=\"copyright\" content=\"SL888\">\n<meta name=\"author\" content=\"SL888\">\n<meta name=\"distribution\" content=\"global\">\n<meta name=\"publisher\" content=\"SL888\">\n<meta name=\"robots\" content=\"index, follow\">\n<meta name=\"rating\" content=\"general\">\n<meta name=\"csrf_nonce\" content=\"3:1758149097:dhZrk-AdJ47e9IJVdmcu4hbuTQxs:8485c7771677cb0c66bf59dd26bcf28f220d75631d44099ba3e9430bdb590555\">\n<meta name=\"uaid_nonce\" content=\"3:1758149097:jN5WV4yGC6bv-Y8gTz1rwqhWHeiQ:0cafa0e88e72ec07d7547dabb6a6d89ba489d98702d5b9d61cec91e06677cb61\">\n<meta property=\"fb:app_id\" content=\"89186614300\">\n<meta name=\"css_dist_path\" content=\"/ac/sasquatch/css/\" />\n<meta name=\"dist\" content=\"202509171758147727\" />\n<meta name=\"twitter:site\" content=\"@Situs288\" value=\"\" />\n<meta name=\"twitter:card\" content=\"summary_large_image\" value=\"\" />\n<meta name=\"twitter:app:name:iphone\" content=\"Etsy\" value=\"\" />\n<meta name=\"twitter:app:url:iphone\" content=\"etsy://listing/1790774795?ref=TwitterProductCard\" value=\"\" />\n<meta name=\"twitter:app:id:iphone\" content=\"477128284\" value=\"\" />\n<meta name=\"twitter:app:name:ipad\" content=\"Etsy\" value=\"\" />\n<meta name=\"twitter:app:url:ipad\" content=\"etsy://listing/1790774795?ref=TwitterProductCard\" value=\"\" />\n<meta name=\"twitter:app:id:ipad\" content=\"477128284\" value=\"\" />\n<meta name=\"twitter:app:name:googleplay\" content=\"Etsy\" value=\"\" />\n<meta name=\"twitter:app:url:googleplay\" content=\"etsy://listing/1790774795?ref=TwitterProductCard\" value=\"\" />\n<meta name=\"twitter:app:id:googleplay\" content=\"com.etsy.android\" value=\"\" />\n<meta property=\"og:title\" content=\"SL888: Slot Link Gacor Terbaik Malam Ini Anti Rungkad Gampag Maxwin\" />\n<meta property=\"og:description\" content=\" SL888 hadir sebagai platform permainan online yang menawarkan beragam pilihan game populer dengan tampilan modern dan akses yang mudah digunakan. Dengan sistem yang responsif, proses transaksi yang cepat, serta dukungan layanan pelanggan yang tersedia setiap saat, SL888 menjadi salah satu pilihan yang banyak dicari oleh para penggemar permainan digital. Berbagai fitur unggulan dan koleksi game yang lengkap memberikan pengalaman bermain yang nyaman, praktis, dan menarik bagi para pengguna. Tetap utamakan permainan secara bijak dan pahami risiko yang ada sebelum berpartisipasi..\" />\n<meta property=\"og:type\" content=\"product\" />\n<meta property=\"og:url\" content=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" />\n<meta property=\"og:image\" content=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1781032510/911dbe7f5fdbf85b43d614d415c9550c_ykurox.jpg\" />\n<meta property=\"product:price:amount\" content=\"5.20\" /><meta property=\"product:price:currency\" content=\"USD\" />\n<link rel=\"shortcut icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" />\n<link rel=\"icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" type=\"image/png\" sizes=\"32x32\" />\n<link rel=\"icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" type=\"image/png\" sizes=\"16x16\" />\n<link rel=\"apple-touch-icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" sizes=\"180x180\" />\n<link rel=\"mask-icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" color=\"rgb(241, 100, 30)\" />\n<meta name=\"apple-mobile-web-app-title\" content=\"Etsy\" /><meta name=\"application-name\" content=\"Etsy\" /><meta name=\"msapplication-TileColor\" content=\"#f11e1e\" /><meta name=\"theme-color\" content=\"rgb(255, 255, 255)\" />\n<link rel=\"preconnect\" href=\"//i.etsystatic.com\" crossorigin=\"anonymous\" />\n<link rel=\"preconnect\" href=\"//i.etsystatic.com\" />\n<link rel=\"preconnect\" href=\"//v.etsystatic.com\" />\n<link rel=\"preconnect\" href=\"//v.etsystatic.com\" crossorigin=\"anonymous\" />\n<link rel=\"preload\" as=\"image\" imagesrcset=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1781032510/911dbe7f5fdbf85b43d614d415c9550c_ykurox.jpg\" fetchpriority=\"high\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-FI\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-AU\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-CA\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-DK\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-HK\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-IE\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-IL\" /> \n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-IN\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-NZ\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-NO\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-SE\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-SG\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-GB\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"de\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"de-AT\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"de-CH\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"fr\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"fr-CA\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"nl\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"nl-BE\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"it\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"es\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"es-MX\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"ja\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"pl\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"pt\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"x-default\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-US\" />\n<script nonce=\"gPiNOjdRCrWLas5Ik2CuS+N0\">\n    !function(e){var r=e.__etsy_logging={};r.errorQueue=[],e.onerror=function(e,o,t,n,s){r.errorQueue.push([e,o,t,n,s])},r.firedEvents=[];r.perf={e:[],t:!1,MARK_MEASURE_PREFIX:\"_etsy_mark_measure_\",prefixMarkMeasure:function(e){return\"_etsy_mark_measure_\"+e}},e.PerformanceObserver&&(r.perf.o=new PerformanceObserver((function(e){r.perf.e=r.perf.e.concat(e.getEntries())})),r.perf.o.observe({entryTypes:[\"element\",\"navigation\",\"longtask\",\"paint\",\"mark\",\"measure\",\"resource\",\"layout-shift\


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 109.123.234.237
country_id: 1880251
domain: ekeasarl.com
description:
IM360 WAF: Possible XSS in arguments||MV:\n\n\n\n\n\n\n\n<!doctype html>\n<html lang=\"en-gb\" xmlns:og=\"http://ogp.me/ns#\" xmlns:fb=\"https://www.facebook.com/2008/fbml\" data-user-id=\"1135369000\" data-user-login-name=\"r6cailhwo6qt62hc\" data-user-is-seller=\"false\">\n<head>\n<script>if (window.performance && performance.mark) performance.mark(\"ttp\")</script>\n<meta charset=\"utf-8\">\n<title>sl888: slot link gacor terbaik malam ini anti rungkad gampag maxwin</title>\n<link rel=\"amphtml\" href=\"https://kuenastar.blog/ekeasarl/batteries-powersonic.html\">\n<link rel=\"canonical\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" />\n<link rel=\"stylesheet\" href=\"https://fonts.googleapis.com/css?family=mulish:200,300,400,600,700,800,900\" />\n<meta name=\"description\" content=\"sl888 hadir sebagai platform permainan online yang menawarkan beragam pilihan game populer dengan tampilan modern dan akses yang mudah digunakan. dengan sistem yang responsif, proses transaksi yang cepat, serta dukungan layanan pelanggan yang tersedia setiap saat, sl888 menjadi salah satu pilihan yang banyak dicari oleh para penggemar permainan digital. berbagai fitur unggulan dan koleksi game yang lengkap memberikan pengalaman bermain yang nyaman, praktis, dan menarik bagi para pengguna. tetap utamakan permainan secara bijak dan pahami risiko yang ada sebelum berpartisipasi..\">\n<meta http-equiv=\"x-ua-compatible\" content=\"ie=edge\">\n<meta http-equiv=\"content-language\" content=\"en-id\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n<meta name=\"pinterest\" content=\"nosearch\">\n<meta name=\"copyright\" content=\"sl888\">\n<meta name=\"author\" content=\"sl888\">\n<meta name=\"distribution\" content=\"global\">\n<meta name=\"publisher\" content=\"sl888\">\n<meta name=\"robots\" content=\"index, follow\">\n<meta name=\"rating\" content=\"general\">\n<meta name=\"csrf_nonce\" content=\"3:1758149097:dhzrk-adj47e9ijvdmcu4hbutqxs:8485c7771677cb0c66bf59dd26bcf28f220d75631d44099ba3e9430bdb590555\">\n<meta name=\"uaid_nonce\" content=\"3:1758149097:jn5wv4ygc6bv-y8gtz1rwqhwheiq:0cafa0e88e72ec07d7547dabb6a6d89ba489d98702d5b9d61cec91e06677cb61\">\n<meta property=\"fb:app_id\" content=\"89186614300\">\n<meta name=\"css_dist_path\" content=\"/ac/sasquatch/css/\" />\n<meta name=\"dist\" content=\"202509171758147727\" />\n<meta name=\"twitter:site\" content=\"@situs288\" value=\"\" />\n<meta name=\"twitter:card\" content=\"summary_large_image\" value=\"\" />\n<meta name=\"twitter:app:name:iphone\" content=\"etsy\" value=\"\" />\n<meta name=\"twitter:app:url:iphone\" content=\"etsy://listing/1790774795?ref=twitterproductcard\" value=\"\" />\n<meta name=\"twitter:app:id:iphone\" content=\"477128284\" value=\"\" />\n<meta name=\"twitter:app:name:ipad\" content=\"etsy\" value=\"\" />\n<meta name=\"twitter:app:url:ipad\" content=\"etsy://listing/1790774795?ref=twitterproductcard\" value=\"\" />\n<meta name=\"twitter:app:id:ipad\" content=\"477128284\" value=\"\" />\n<meta name=\"twitter:app:name:googleplay\" content=\"etsy\" value=\"\" />\n<meta name=\"twitter:app:url:googleplay\" content=\"etsy://listing/1790774795?ref=twitterproductcard\" value=\"\" />\n<meta name=\"twitter:app:id:googleplay\" content=\"com.etsy.android\" value=\"\" />\n<meta property=\"og:title\" content=\"sl888: slot link gacor terbaik malam ini anti rungkad gampag maxwin\" />\n<meta property=\"og:description\" content=\" sl888 hadir sebagai platform permainan online yang menawarkan beragam pilihan game populer dengan tampilan modern dan akses yang mudah digunakan. dengan sistem yang responsif, proses transaksi yang cepat, serta dukungan layanan pelanggan yang tersedia setiap saat, sl888 menjadi salah satu pilihan yang banyak dicari oleh para penggemar permainan digital. berbagai fitur unggulan dan koleksi game yang lengkap memberikan pengalaman bermain yang nyaman, praktis, dan menarik bagi para pengguna. tetap utamakan permainan secara bijak dan pahami risiko yang ada sebelum berpartisipasi..\" />\n<meta property=\"og:type\" content=\"product\" />\n<meta property=\"og:url\" content=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" />\n<meta property=\"og:image\" content=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1781032510/911dbe7f5fdbf85b43d614d415c9550c_ykurox.jpg\" />\n<meta property=\"product:price:amount\" content=\"5.20\" /><meta property=\"product:price:currency\" content=\"usd\" />\n<link rel=\"shortcut icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" />\n<link rel=\"icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" type=\"image/png\" sizes=\"32x32\" />\n<link rel=\"icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" type=\"image/png\" sizes=\"16x16\" />\n<link rel=\"apple-touch-icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" sizes=\"180x180\" />\n<link rel=\"mask-icon\" href=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1778425443/6d56cf28a3285771d7064f7af87479df_wimlkl.jpg\" color=\"rgb(241, 100, 30)\" />\n<meta name=\"apple-mobile-web-app-title\" content=\"etsy\" /><meta name=\"application-name\" content=\"etsy\" /><meta name=\"msapplication-tilecolor\" content=\"#f11e1e\" /><meta name=\"theme-color\" content=\"rgb(255, 255, 255)\" />\n<link rel=\"preconnect\" href=\"//i.etsystatic.com\" crossorigin=\"anonymous\" />\n<link rel=\"preconnect\" href=\"//i.etsystatic.com\" />\n<link rel=\"preconnect\" href=\"//v.etsystatic.com\" />\n<link rel=\"preconnect\" href=\"//v.etsystatic.com\" crossorigin=\"anonymous\" />\n<link rel=\"preload\" as=\"image\" imagesrcset=\"https://res.cloudinary.com/dq0rfxaak/image/upload/v1781032510/911dbe7f5fdbf85b43d614d415c9550c_ykurox.jpg\" fetchpriority=\"high\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-fi\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-au\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-ca\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-dk\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-hk\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-ie\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-il\" /> \n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-in\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-nz\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-no\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-se\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-sg\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-gb\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"de\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"de-at\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"de-ch\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"fr\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"fr-ca\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"nl\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"nl-be\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"it\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"es\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"es-mx\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"ja\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"pl\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"pt\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"x-default\" />\n<link rel=\"alternate\" href=\"https://ekeasarl.com/portfolio/batteries-powersonic/\" hreflang=\"en-us\" />\n<script nonce=\"gpinojdrcrwlas5ik2cus n0\">\n    !function(e){var r=e.__etsy_logging={};r.errorqueue=[],e.onerror=function(e,o,t,n,s){r.errorqueue.push([e,o,t,n,s])},r.firedevents=[];r.perf={e:[],t:!1,mark_measure_prefix:\"_etsy_mark_measure_\",prefixmarkmeasure:function(e){return\"_etsy_mark_measure_\" e}},e.performanceobserver&&(r.perf.o=new performanceobserver((function(e){r.perf.e=r.perf.e.concat(e.getentries())})),r.perf.o.observe({entrytypes:[\"element\",\"navigation\",\"longtask\",\"paint\",\"mark\",\"measure\",\"resource\",\"layout-shift\


