# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:22:36 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:22:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:26144: 535 Incorrect authentication data (set_id=mormon)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:22:47 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.57
country_id: 1643084
description:
[2026-06-22 17:23:37 +0000] info [cpaneld] 103.65.237.57 - crepsad "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:23:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:10312: 535 Incorrect authentication data (set_id=celebrity)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:23:28 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:23:30 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:23:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:32890: 535 Incorrect authentication data (set_id=already)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:23:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:15342: 535 Incorrect authentication data (set_id=smtp-out)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:23:33 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:23:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:25716: 535 Incorrect authentication data (set_id=jesslyn)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:23:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:1842: 535 Incorrect authentication data (set_id=oslo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:23:28 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:23:30 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:23:30 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:23:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:47548: 535 Incorrect authentication data (set_id=shannon)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:24:54 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:52406: 535 Incorrect authentication data (set_id=nanette)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.214.117.56
country_id: 6252001
description:
34.214.117.56 - - [22/Jun/2026:17:25:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7103084&pdata=https%253A%252F%252Flacs1.mairie.tg%253A2083%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782149101 HTTP/2.0" 302 0 lacs1.mairie.tg "https://lacs1.mairie.tg:2083/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.214.117.56


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.214.117.56
country_id: 6252001
description:
[2026-06-22 17:25:10 +0000] info [cpaneld] 34.214.117.56 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:24:32 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:24:33 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:24:44 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:25:02 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:24:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:19542: 535 Incorrect authentication data (set_id=staff2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:24:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:38320: 535 Incorrect authentication data (set_id=shoes)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:24:45 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:24:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:8770: 535 Incorrect authentication data (set_id=nathaniel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:24:52 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-22 17:25:08 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:52496: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:24:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:64524: 535 Incorrect authentication data (set_id=essie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:24:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:37856: 535 Incorrect authentication data (set_id=arzt)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:25:32 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:25:39 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:25:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:64156: 535 Incorrect authentication data (set_id=alone)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:25:48 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:25:30 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:25:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:47966: 535 Incorrect authentication data (set_id=done)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:25:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:6508: 535 Incorrect authentication data (set_id=benefits)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:25:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:49126: 535 Incorrect authentication data (set_id=smsgateway)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.57
country_id: 1643084
description:
[2026-06-22 17:25:42 +0000] info [cpaneld] 103.65.237.57 - kidsedunetmaster "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kidsedunetmaster (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:25:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:57876: 535 Incorrect authentication data (set_id=avp)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.18.15.11
country_id: 1168579
description:
103.18.15.11 - - [22/Jun/2026:17:26:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13158293&pdata=https%253A%252F%252Fcfpj.tg%252Fcnrw-3907vetid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782149159 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/cnrw-3907vetid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.18.15.11


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:25:28 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:25:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:13780: 535 Incorrect authentication data (set_id=tim1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:25:47 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:26:09 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:36394: 535 Incorrect authentication data (set_id=avp)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:26:30 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:26:31 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 17:26:59 +0000] info [cpaneld] 141.95.93.31 - togoinrdceh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:26:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:63994: 535 Incorrect authentication data (set_id=kissa)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:26:34 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:26:34 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:26:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:46492: 535 Incorrect authentication data (set_id=notarial)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:26:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:15710: 535 Incorrect authentication data (set_id=intrepid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:26:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:2180: 535 Incorrect authentication data (set_id=antony)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:26:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:33526: 535 Incorrect authentication data (set_id=sudakov)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:26:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:57930: 535 Incorrect authentication data (set_id=x5)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:26:42 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:26:34 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:27:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:22168: 535 Incorrect authentication data (set_id=woofti)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:27:45 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:27:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:6100: 535 Incorrect authentication data (set_id=stainless)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:27:28 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:27:30 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:27:36 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:27:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:62922: 535 Incorrect authentication data (set_id=alexandre)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:27:32 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:27:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:56126: 535 Incorrect authentication data (set_id=xadmin)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.168.148.116
country_id: 2363686
description:
[2026-06-22 17:27:54 +0000] info [cpaneld] 196.168.148.116 NEW neyxglgq:1BbE7OPEzVFVBiYs address=196.168.148.116,app=cpaneld,creator=neyxglgq,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:27:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:4954: 535 Incorrect authentication data (set_id=inter)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:27:50 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:27:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:40812: 535 Incorrect authentication data (set_id=virtual)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:28:58 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:28:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:30062: 535 Incorrect authentication data (set_id=alle)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:28:33 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:28:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:16378: 535 Incorrect authentication data (set_id=usuario2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:28:52 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:28:54 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:56374: 535 Incorrect authentication data (set_id=liang)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:29:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:37746: 535 Incorrect authentication data (set_id=klimas)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:28:28 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.66.154.32
country_id: 6252001
description:
[2026-06-22 17:28:58 +0000] info [cpaneld] 73.66.154.32 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.136.107.103
country_id: 1210997
description:
103.136.107.103 - - [22/Jun/2026:17:29:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6343060&pdata=https%253A%252F%252Fwww.togosem.com%252F2025%252F05%252F04%252Fno-wagering-online-casino-benefit-a-guide-to-unlocking-real-payout%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782149342 HTTP/2.0" 302 0 www.togosem.com "https://www.togosem.com/2025/05/04/no-wagering-online-casino-benefit-a-guide-to-unlocking-real-payout/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.136.107.103


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:28:26 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:28:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:27724: 535 Incorrect authentication data (set_id=quan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:28:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:28122: 535 Incorrect authentication data (set_id=corvair)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:29:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:26236: 535 Incorrect authentication data (set_id=monitoring)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:28:38 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:29:32 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:29:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:31906: 535 Incorrect authentication data (set_id=monitoring)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:29:47 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.249
country_id: 6252001
description:
Jun 22 17:30:12 ns5 pure-ftpd[2632522]: (?@205.210.31.249) [INFO] New connection from 205.210.31.249


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:29:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:4060: 535 Incorrect authentication data (set_id=ilyas)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:29:37 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:29:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:31272: 535 Incorrect authentication data (set_id=c00per)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:29:39 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:29:42 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:29:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:25062: 535 Incorrect authentication data (set_id=sohail)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:29:46 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:29:48 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:49526: 535 Incorrect authentication data (set_id=sklee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:29:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:65142: 535 Incorrect authentication data (set_id=justine)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:30:25 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:30:26 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:30:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:40742: 535 Incorrect authentication data (set_id=date1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:30:29 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:30:32 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:30:39 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:30:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:21656: 535 Incorrect authentication data (set_id=suporte)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.121.8
country_id: 798544
description:
Jun 22 17:31:20 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.121.8 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:30:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:6286: 535 Incorrect authentication data (set_id=oracle)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:30:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:32644: 535 Incorrect authentication data (set_id=tatoo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:30:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:7848: 535 Incorrect authentication data (set_id=dongle)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:30:33 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:30:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:24920: 535 Incorrect authentication data (set_id=cheddy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:31:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:61218: 535 Incorrect authentication data (set_id=lasvegas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:31:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:37810: 535 Incorrect authentication data (set_id=globe)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:31:58 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:31:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:2304: 535 Incorrect authentication data (set_id=phone)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:31:26 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:31:30 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:31:36 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:31:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:48156: 535 Incorrect authentication data (set_id=poor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.121.8
country_id: 798544
description:
Jun 22 17:31:27 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.121.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:31:28 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:31:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:64912: 535 Incorrect authentication data (set_id=oriental)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:31:32 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:31:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:12304: 535 Incorrect authentication data (set_id=tamayo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:32:35 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:32:44 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:32:51 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:32:26 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:32:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:57304: 535 Incorrect authentication data (set_id=larry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:32:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:32322: 535 Incorrect authentication data (set_id=nira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:32:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:36882: 535 Incorrect authentication data (set_id=liang)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.95
country_id: 798544
description:
Jun 22 17:32:29 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:32:46 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:32:48 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:44470: 535 Incorrect authentication data (set_id=stp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:32:53 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:11550: 535 Incorrect authentication data (set_id=tech)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:32:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:64576: 535 Incorrect authentication data (set_id=larry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:32:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:60040: 535 Incorrect authentication data (set_id=config)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:32:50 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:33:34 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:33:26 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:33:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:35068: 535 Incorrect authentication data (set_id=mind)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:33:30 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:33:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:7956: 535 Incorrect authentication data (set_id=adell)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:33:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:65458: 535 Incorrect authentication data (set_id=breakfast)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:33:31 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:33:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:19884: 535 Incorrect authentication data (set_id=test3)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:33:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:51658: 535 Incorrect authentication data (set_id=supp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:33:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:40392: 535 Incorrect authentication data (set_id=kostya)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:33:27 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:33:50 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:34:26 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:34:28 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:34:31 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:34:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:43942: 535 Incorrect authentication data (set_id=phantom)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:34:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:31224: 535 Incorrect authentication data (set_id=rehber)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:34:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:4566: 535 Incorrect authentication data (set_id=domino)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:34:29 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:34:30 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:34:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:16338: 535 Incorrect authentication data (set_id=babette)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:17:35:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7117413&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782149712 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:34:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:47156: 535 Incorrect authentication data (set_id=ozren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:34:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:33146: 535 Incorrect authentication data (set_id=nscd)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:34:36 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:17:35:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9554834&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782149714 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:35:30 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:35:48 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:10978: 535 Incorrect authentication data (set_id=specs)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:35:32 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:35:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:25132: 535 Incorrect authentication data (set_id=raf)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:35:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:62800: 535 Incorrect authentication data (set_id=sugino)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:35:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:63932: 535 Incorrect authentication data (set_id=izzy)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 17:35:30 +0000] info [cpaneld] 141.95.93.31 - tiyasuxe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tiyasuxe (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:35:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:5022: 535 Incorrect authentication data (set_id=boo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:35:43 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:35:49 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:17:35:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10055578&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782149722 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:35:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:42306: 535 Incorrect authentication data (set_id=sugino)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:35:46 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:35:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:24440: 535 Incorrect authentication data (set_id=supporto)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:35:44 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:36:30 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:36:33 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:36:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:33508: 535 Incorrect authentication data (set_id=u25)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:36:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:22584: 535 Incorrect authentication data (set_id=lecture)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 158.173.157.149
country_id: 3017382
description:
[2026-06-22 17:36:57 +0000] info [whostmgrd] 158.173.157.149 - root "GET / HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [80.248.64.198] != Current IP Address [158.173.157.149]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:36:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:63910: 535 Incorrect authentication data (set_id=ferenc)


plugin: ossec
rule: 11011
name: WHM SSO login failed
abuser: 158.173.157.149
country_id: 3017382
description:
[2026-06-22 17:36:57 +0000] info [whostmgrd] 158.173.157.149 PURGE root:zazOVVrvw4p4DyRg badpass [cookie ip check: IP address has changed: IP Address [80.248.64.198] != Current IP Address [158.173.157.149]]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:36:31 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:36:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:39372: 535 Incorrect authentication data (set_id=font)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:36:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:7916: 535 Incorrect authentication data (set_id=brian)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:36:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:18162: 535 Incorrect authentication data (set_id=ns101)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:36:31 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:36:33 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:36:44 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 11009
name: WHM login success
abuser: 158.173.157.149
country_id: 3017382
description:
[2026-06-22 17:37:02 +0000] info [whostmgrd] 158.173.157.149 NEW root:fp3UiTkuYOAQ21yT address=158.173.157.149,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:37:26 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:37:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:62332: 535 Incorrect authentication data (set_id=kingston)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:37:27 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:37:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:20228: 535 Incorrect authentication data (set_id=test02)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:37:33 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:37:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:48172: 535 Incorrect authentication data (set_id=bien-vieillir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:37:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:1132: 535 Incorrect authentication data (set_id=uno)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:38:04 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:37:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:60124: 535 Incorrect authentication data (set_id=whir)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:37:37 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:37:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:10654: 535 Incorrect authentication data (set_id=elp)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:37:25 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 17:38:22 +0000] info [cpaneld] 141.95.93.31 - test "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user test (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:38:29 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:38:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:57126: 535 Incorrect authentication data (set_id=nitin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:38:48 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:38:49 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:38:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:40798: 535 Incorrect authentication data (set_id=fox)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:38:54 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:30432: 535 Incorrect authentication data (set_id=moon)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:38:42 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:38:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:10184: 535 Incorrect authentication data (set_id=specials)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:38:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:53358: 535 Incorrect authentication data (set_id=appert)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:38:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:12614: 535 Incorrect authentication data (set_id=fox)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 37.222.203.26
country_id: 2510769
description:
37.222.203.26 - - [22/Jun/2026:17:39:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10120299&pdata=https%253A%252F%252Ftogodailynews.tg%252Fma-commune-une-emission-dediee-a-la-decentralisation%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782149962 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/ma-commune-une-emission-dediee-a-la-decentralisation/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2346.1260 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:37.222.203.26


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:38:34 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:38:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:37464: 535 Incorrect authentication data (set_id=okano)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:38:52 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:39:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:50568: 535 Incorrect authentication data (set_id=dustin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:39:35 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:39:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:1314: 535 Incorrect authentication data (set_id=bigdata)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:39:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:65248: 535 Incorrect authentication data (set_id=yann)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:39:45 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:39:31 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:39:34 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:39:38 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:39:38 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:39:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:6060: 535 Incorrect authentication data (set_id=jewelry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:39:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:40100: 535 Incorrect authentication data (set_id=mike01)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:39:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:16126: 535 Incorrect authentication data (set_id=ganttproject)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:40:32 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:40:35 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:40:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:3452: 535 Incorrect authentication data (set_id=recette2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:40:26 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:40:31 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:40:38 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:40:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:33506: 535 Incorrect authentication data (set_id=nano)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.57
country_id: 1643084
description:
[2026-06-22 17:41:22 +0000] info [cpaneld] 103.65.237.57 - 90446907 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:40:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:47004: 535 Incorrect authentication data (set_id=tiptop)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:40:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:16048: 535 Incorrect authentication data (set_id=kapsch)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.213.135.113
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/2-1-768x512.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/2-1-300x200.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/2-1-1024x683.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/06/2-1-1536x1024.webp 1536w, http:/togodailynews.tg/wp-content/uploads/2026/06/2-1.webp 1600w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:40:26 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:40:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:27448: 535 Incorrect authentication data (set_id=kamei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:40:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:46192: 535 Incorrect authentication data (set_id=kari)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:42:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:39132: 535 Incorrect authentication data (set_id=k3)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.57
country_id: 1643084
description:
[2026-06-22 17:41:43 +0000] info [cpaneld] 103.65.237.57 - iaideveloppementgroupe@gmail.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:41:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:43432: 535 Incorrect authentication data (set_id=ravi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:41:27 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:41:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:61872: 535 Incorrect authentication data (set_id=kunden)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:41:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:56542: 535 Incorrect authentication data (set_id=melbourne)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:41:35 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:41:27 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:41:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:17620: 535 Incorrect authentication data (set_id=testip)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:42:01 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:41:43 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:41:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:9466: 535 Incorrect authentication data (set_id=azalea)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 17:41:38 +0000] info [cpaneld] 141.95.93.31 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:41:57 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:42:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:54920: 535 Incorrect authentication data (set_id=daf)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:42:26 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:42:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:16962: 535 Incorrect authentication data (set_id=reader)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:42:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:47184: 535 Incorrect authentication data (set_id=hacienda)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:42:49 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:42:25 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:42:44 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:42:47 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:42:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:37646: 535 Incorrect authentication data (set_id=auschwitz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:42:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:8140: 535 Incorrect authentication data (set_id=joanne)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:42:31 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:42:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:57444: 535 Incorrect authentication data (set_id=k3)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:42:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:45990: 535 Incorrect authentication data (set_id=diendan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:43:26 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:43:34 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:43:35 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:43:36 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:43:37 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:43:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:9876: 535 Incorrect authentication data (set_id=pdd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:43:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:4938: 535 Incorrect authentication data (set_id=quota)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:43:27 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:43:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:22610: 535 Incorrect authentication data (set_id=bridgette)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:43:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:18830: 535 Incorrect authentication data (set_id=staging.demo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:43:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:48142: 535 Incorrect authentication data (set_id=maria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:43:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:13290: 535 Incorrect authentication data (set_id=ic)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:44:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:42078: 535 Incorrect authentication data (set_id=kyk)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:44:56 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:44:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:38128: 535 Incorrect authentication data (set_id=username)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:44:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:56950: 535 Incorrect authentication data (set_id=wbem)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:44:31 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:44:31 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:44:37 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:44:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:8814: 535 Incorrect authentication data (set_id=javascript)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:45:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:39772: 535 Incorrect authentication data (set_id=doconnor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:44:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:7532: 535 Incorrect authentication data (set_id=bitcoin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:44:39 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:44:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:49196: 535 Incorrect authentication data (set_id=sglass)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.6
country_id: 6252001
description:
205.169.39.6 - - [22/Jun/2026:17:45:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10405225&pdata=http%253A%252F%252Fkoko.kpmg.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782150306 HTTP/1.1" 302 0 koko.kpmg.tg "http://koko.kpmg.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.6


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [22/Jun/2026:17:45:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13134695&pdata=http%253A%252F%252Fkoko.kpmg.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782150307 HTTP/1.1" 302 0 koko.kpmg.tg "http://koko.kpmg.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 86.99.73.97
country_id: 290557
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/11/Shelter-Afrique-AG.-MDKingsley-Muwowo-1024x945.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2022/11/Shelter-Afrique-AG.-MDKingsley-Muwowo-300x277.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2022/11/Shelter-Afrique-AG.-MDKingsley-Muwowo-768x708.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2022/11/Shelter-Afrique-AG.-MDKingsley-Muwowo.jpg 1662w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:44:38 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.31.179.142
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1745852350 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:45:36 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:45:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:13910: 535 Incorrect authentication data (set_id=outsourcing)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:45:42 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:45:55 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:22054: 535 Incorrect authentication data (set_id=acs1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:45:53 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:45:28 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:45:38 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:45:42 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:45:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:13548: 535 Incorrect authentication data (set_id=robert)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:45:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:39614: 535 Incorrect authentication data (set_id=pr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:45:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:7480: 535 Incorrect authentication data (set_id=oohashi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:45:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:10686: 535 Incorrect authentication data (set_id=mailtester)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 17:46:39 +0000] info [cpaneld] 141.95.93.31 - websitecpanel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.229.85.233
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/11/WhatsApp-Image-2023-11-26-at-12.59.58.jpeg 838w, http:/togodailynews.tg/wp-content/uploads/2023/11/WhatsApp-Image-2023-11-26-at-12.59.58-233x300.jpeg 233w, http:/togodailynews.tg/wp-content/uploads/2023/11/WhatsApp-Image-2023-11-26-at-12.59.58-795x1024.jpeg 795w, http:/togodailynews.tg/wp-content/uploads/2023/11/WhatsApp-Image-2023-11-26-at-12.59.58-768x990.jpeg 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 17:50:21 +0000] info [cpaneld] 141.95.93.31 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:17:50:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13211493&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782150655 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:17:51:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10274706&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782150659 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 17:52:51 +0000] info [cpaneld] 141.95.93.31 - @ "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.0.186
country_id: 2363686
description:
[2026-06-22 17:53:37 +0000] info [webmaild] 196.168.0.186 - kawunyo@wages.tg "POST /cpsess5935231149/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.170.45.140] != Current IP Address [196.168.0.186]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.73.70.170
country_id: 102358
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/HTML/BODY/DIV[@class='single-author-posts-area theme-single-post-component']/*[2][self::DIV]/*[2][self::ARTICLE]/*[1][self::DIV]/*[1][self::A]/*[1][self::IMG] HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-22 17:56:20 +0000] info [webmaild] 160.242.195.10 - secretariat_daj@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.182.59.205
country_id: 1814991
description:
2026-06-22 17:56:38 dovecot_login authenticator failed for H=(xvjhea) [123.182.59.205]:58082: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.126
country_id: 3469034
description:
Jun 22 17:58:39 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.126 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 18:02:40 +0000] info [cpaneld] 141.95.93.31 - arsetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 31.57.184.20
country_id: 6252001
description:
31.57.184.20 - - [22/Jun/2026:18:05:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9792918&pdata=https%253A%252F%252Fdany2.mairie.tg%252Fwp-admin%252Fadmin.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782151499 HTTP/2.0" 302 0 dany2.mairie.tg "https://dany2.mairie.tg/wp-admin/admin.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:31.57.184.20


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 18:05:06 +0000] info [cpaneld] 141.95.93.31 - primuscourtiertg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user primuscourtiertg (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 192.29.39.134
country_id: 1861060
description:
Denial of Service (DoS) attack was discovered from 192.29.39.134: 250 connections per 30 seconds to 53 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 79.108.230.88
country_id: 2510769
description:
79.108.230.88 - - [22/Jun/2026:18:07:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6461853&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782151636 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.3659.1671 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:79.108.230.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:18:06:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738136&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782151613 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:18:06:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9606804&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782151612 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 112.215.45.244
country_id: 1643084
description:
112.215.45.244 - - [22/Jun/2026:18:07:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10052507&pdata=https%253A%252F%252Fucao-uut.tg%252Fcontact%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782151661 HTTP/2.0" 302 0 ucao-uut.tg "https://ucao-uut.tg/contact/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:112.215.45.244


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.82.68.78
country_id: 1819730
description:
2026-06-22 18:08:49 dovecot_plain authenticator failed for H=(qcm9urq6ek1sjgfsun5pk6wuzf) [47.82.68.78]:40995: 535 Incorrect authentication data (set_id=ptitrikou@mesyscom.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 18:12:20 +0000] info [cpaneld] 141.95.93.31 - kidsedunetmaster "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kidsedunetmaster (has_cpuser_file failed)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.165.143
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>le togo franchit un nouveau dans la modernisation de ses infrastructures et la transition \xc3\xa9cologique. le vendredi 19 juin, le ministre de l\xe2\x80\x99am\xc3\xa9nagement du territoire et de l\xe2\x80\x99urbanisme, kodjo adedze, a officiellement inaugur\xc3\xa9 une usine de pr\xc3\xa9fabrication de tuyaux bas carbone au sein de la plateforme industrielle d\xe2\x80\x99ad\xc3\xa9tikop\xc3\xa9 (pia).</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>implant\xc3\xa9e strat\xc3\xa9giquement \xc3\xa0 ad\xc3\xa9tikop\xc3\xa9, cette nouvelle unit\xc3\xa9 de production constitue, en effet, un maillon essentiel du projet raine (r\xc3\xa9seau d\xe2\x80\x99assainissement par intercepteurs pour la non-inondation de nos espaces).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>d\xc3\xa9di\xc3\xa9e \xc3\xa0 la fabrication de mat\xc3\xa9riaux \xc3\xa0 faible empreinte carbone, l'usine va fournir des \xc3\xa9quipements de pointe indispensables pour non seulement les grands r\xc3\xa9seaux d\xe2\x80\x99assainissement collectif, mais aussi pour l\xe2\x80\x99adduction d\xe2\x80\x99eau potable et les projets d\xe2\x80\x99am\xc3\xa9nagement urbain durables.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31402,\"sizeslug\":\"full\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-full\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/otr_bandeau-renseignements.jpg\" alt=\"\" class=\"wp-image-31402\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>l\xe2\x80\x99objectif principal de l'\xc3\x89tat togolais est clair : stimuler une production locale et durable capable de r\xc3\xa9pondre aux besoins des grands chantiers nationaux, tout en r\xc3\xa9duisant drastiquement la d\xc3\xa9pendance du pays aux importations de mat\xc3\xa9riaux de construction.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>des chiffres cl\xc3\xa9s impressionnants pour la premi\xc3\xa8re ann\xc3\xa9e</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>l'impact industriel et \xc3\xa9cologique de cette usine se mesure d\xc3\xa9j\xc3\xa0 \xc3\xa0 travers des objectifs de production massifs. lors de son allocution, le ministre en charge de l\xe2\x80\x99eau et de l'assainissement, s\xc3\xa9na alipui, a d\xc3\xa9voil\xc3\xa9 les ambitions de la premi\xc3\xa8re ann\xc3\xa9e d\xe2\x80\x99exploitation.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\xc2\xab&nbsp;<em>cette infrastructure permettra de produire, d\xc3\xa8s sa premi\xc3\xa8re ann\xc3\xa9e d\xe2\x80\x99exploitation, plus de 2200 tuyaux de fon\xc3\xa7age de diam\xc3\xa8tre 2000 millim\xc3\xa8tres destin\xc3\xa9s aux intercepteurs du projet raine. plus de 1400 tonnes d\xe2\x80\x99acier y seront transform\xc3\xa9es et pr\xc3\xa8s de 10.000 m\xc3\xa8tres cubes de b\xc3\xa9ton bas carbone seront fabriqu\xc3\xa9s directement sur le site</em>&nbsp;\xc2\xbb, a-t-il expliqu\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>&nbsp;un levier \xc3\xa9conomique, social et \xc3\xa9cologique pour le togo</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>au-del\xc3\xa0 de la simple performance technique, cette usine s\xe2\x80\x99inscrit dans la vision de d\xc3\xa9veloppement inclusif port\xc3\xa9e par l\xe2\x80\x99ex\xc3\xa9cutif togolais. en favorisant le savoir-faire local, le projet va g\xc3\xa9n\xc3\xa9rer de nombreux b\xc3\xa9n\xc3\xa9fices transversaux. car, souligne-t-on, <em>\xc2\xab l\xe2\x80\x99ambition, \xc3\xa0 terme, est de consolider une industrie nationale comp\xc3\xa9titive, capable d\xe2\x80\x99accompagner les grands projets d\xe2\x80\x99am\xc3\xa9nagement, d\xe2\x80\x99assainissement et de lutte contre les inondations, tout en int\xc3\xa9grant les exigences de la transition \xc3\xa9cologique. \xc2\xbb</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31146,\"width\":\"622px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/image-30-724x1024.png\" alt=\"\" class=\"wp-image-31146\" style=\"width:622px;height:auto\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>notons qu\xe2\x80\x99avec cette inauguration, le togo prouve qu'il est possible de conjuguer industrialisation rapide, lutte contre les inondations et respect des engagements climatiques. une avanc\xc3\xa9e majeure pour le bien-\xc3\xaatre des populations et la r\xc3\xa9silience urbaine.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>mab\xc3\xa9 b.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 18:15:01 +0000] info [cpaneld] 141.95.93.31 - yvwaocrr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yvwaocrr (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 31.134.5.120
country_id: 241170
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:18-14.31.134.5.120||RSV:8.19||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 198.142.152.5
country_id: 2077456
description:
Denial of Service (DoS) attack was discovered from 198.142.152.5: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 198.142.152.6
country_id: 2077456
description:
Denial of Service (DoS) attack was discovered from 198.142.152.6: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 161.123.54.25
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:18-18.161.123.54.25||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 31.59.24.133
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:18-18.31.59.24.133||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:18:19:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10012572&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782152386 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:18:19:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6579399&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782152387 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 92.153.161.25
country_id: 3017382
description:
92.153.161.25 - - [22/Jun/2026:18:20:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7104873&pdata=https%253A%252F%252F24heureinfo.tg%252Finternational%252Fnetanyahou-nous-sommes-le-peuple-de-la-lumiere-nous-realiserons-la-prophetie-disaie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782152400 HTTP/2.0" 302 0 24heureinfo.tg "https://www.google.tg/" "Mozilla/5.0 (Linux; Android 9; SM-S901B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:92.153.161.25


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 208.67.219.139
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 208.67.219.139: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 208.67.219.140
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 208.67.219.140: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 208.67.219.141
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 208.67.219.141: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 208.67.219.132
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 208.67.219.132: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 192.29.67.73
country_id: 6251999
description:
Denial of Service (DoS) attack was discovered from 192.29.67.73: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 208.67.219.136
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 208.67.219.136: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 208.67.219.135
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 208.67.219.135: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 208.67.219.130
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 208.67.219.130: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 208.67.219.131
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 208.67.219.131: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 154.21.239.154
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 154.21.239.154: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 18:22:12 +0000] info [cpaneld] 141.95.93.31 - dev03 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dev03 (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 154.21.239.66
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 154.21.239.66: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 31.57.184.20
country_id: 6252001
description:
31.57.184.20 - - [22/Jun/2026:18:26:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6515311&pdata=https%253A%252F%252Fdany2.mairie.tg%252Fwp-admin%252Fadmin.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782152783 HTTP/2.0" 302 0 dany2.mairie.tg "https://dany2.mairie.tg/wp-admin/admin.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:31.57.184.20


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.112.237
country_id: 1880251
description:
47.128.112.237 - - [22/Jun/2026:18:29:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10248598&pdata=https%253A%252F%252Fcivilemagazine.tg%252Ftogo-resultat-concours-lycees-scientifiques%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782152972 HTTP/2.0" 302 0 civilemagazine.tg "https://civilemagazine.tg/togo-resultat-concours-lycees-scientifiques/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.112.237


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 178.205.50.105
country_id: 2017370
description:
2026-06-22 18:31:39 H=([178.205.50.105]) [178.205.50.105]:15426 F=<home@white-ways.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.28.159.48
country_id: 1880251
description:
104.28.159.48 - - [22/Jun/2026:18:31:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7235731&pdata=https%253A%252F%252Fucao-uut.tg%252Fcontact%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782153098 HTTP/2.0" 302 0 ucao-uut.tg "https://ucao-uut.tg/contact/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:152.0) Gecko/20100101 Firefox/152.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.28.159.48


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 103.227.66.245
country_id: 2077456
description:
Denial of Service (DoS) attack was discovered from 103.227.66.245: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.165.143
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>depuis le jeudi 18 juin, la capitale togolaise abrite une quinzaine r\xc3\xa9gionale d\xc3\xa9di\xc3\xa9e au commerce transfrontalier \xc3\xa0 petite \xc3\xa9chelle. cet \xc3\xa9v\xc3\xa9nement enti\xc3\xa8rement consacr\xc3\xa9 aux femmes commer\xc3\xa7antes de l\xe2\x80\x99espace cedeao, constitue une bonne occasion pour capitaliser les exp\xc3\xa9riences issues des campagnes de sensibilisation men\xc3\xa9es sur plusieurs corridors de la communaut\xc3\xa9\xe2\x80\xa6.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>organis\xc3\xa9e par le centre de la cedeao pour le d\xc3\xa9veloppement du genre, cette initiative majeure ambitionne de transformer le quotidien des micro-entrepreneuses et de b\xc3\xa2tir un commerce transfrontalier plus inclusif, s\xc3\xa9curis\xc3\xa9 et structur\xc3\xa9 en afrique de l'ouest.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ainsi, pendant pr\xc3\xa8s de deux semaines, cette rencontre va servir de pont entre les diff\xc3\xa9rentes forces vives du commerce r\xc3\xa9gional. ceci avec pour objectif de cr\xc3\xa9er une synergie forte entre les administrations douani\xc3\xa8res et les forces de s\xc3\xa9curit\xc3\xa9, mais \xc3\xa9galement entre les collectivit\xc3\xa9s locales et les organisations f\xc3\xa9minines de commer\xc3\xa7antes.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31402,\"sizeslug\":\"full\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-full\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/otr_bandeau-renseignements.jpg\" alt=\"\" class=\"wp-image-31402\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>\xc3\x80 travers des espaces d\xe2\x80\x99\xc3\xa9changes, de sensibilisation et d\xe2\x80\x99exposition, l'\xc3\xa9v\xc3\xa9nement permettra aux participantes de mieux s'approprier les textes communautaires de la cedeao, tout en offrant une vitrine exceptionnelle pour valoriser leurs produits.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ce rendez-vous, loin d'\xc3\xaatre un simple espace de discussion, est un laboratoire de solutions. il va permettre de capitaliser sur les exp\xc3\xa9riences des campagnes de sensibilisation men\xc3\xa9es sur plusieurs corridors d'afrique de l'ouest dans l\xe2\x80\x99optique de lever les goulots d'\xc3\xa9tranglement aux postes frontaliers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>pr\xc3\xa9sent \xc3\xa0 l'ouverture de l'\xc3\xa9v\xc3\xa9nement, le ministre de l\xe2\x80\x99\xc3\x89conomie et de la veille strat\xc3\xa9gique du togo, badanam patoki, a rappel\xc3\xa9 l'esprit de cette initiative avec force. <em>\xc2\xab les fronti\xc3\xa8res de notre r\xc3\xa9gion ne doivent plus devenir des barri\xc3\xa8res, mais des leviers de d\xc3\xa9veloppement, d\xe2\x80\x99int\xc3\xa9gration et de prosp\xc3\xa9rit\xc3\xa9 partag\xc3\xa9e. \xc2\xbb,</em> a-t-il soulign\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31146,\"width\":\"622px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/image-30-724x1024.png\" alt=\"\" class=\"wp-image-31146\" style=\"width:622px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>profitant de cette tribune, l\xe2\x80\x99officiel a mis en avant les efforts constants du gouvernement togolais en faveur de l'\xc3\xa9galit\xc3\xa9 des chances. qu'il s'agisse de politiques publiques audacieuses, de m\xc3\xa9canismes de financement inclusifs ou de programmes d\xe2\x80\x99accompagnement de l\xe2\x80\x99entrepreneuriat f\xc3\xa9minin, le togo r\xc3\xa9affirme sa volont\xc3\xa9 de placer les femmes au c\xc5\x93ur de la croissance \xc3\xa9conomique sous-r\xc3\xa9gionale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>jpb</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:18:36:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13092241&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782153355 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:18:36:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7118232&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782153358 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 5.255.124.175
country_id: 2750405
description:
Denial of Service (DoS) attack was discovered from 5.255.124.175: 80 connections per 30 seconds to 80 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.170.29.120
country_id: 2363686
description:
[2026-06-22 18:40:22 +0000] info [webmaild] 196.170.29.120 - emt@emt.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.152.28.227
country_id: 3469034
description:
Jun 22 18:40:05 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.152.28.227 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 87.142.50.64
country_id: 2921044
description:
87.142.50.64 - - [22/Jun/2026:18:41:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13343382&pdata=https%253A%252F%252Fcfpj.tg%252Fcnrw-104035xetid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782153668 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/cnrw-104035xetid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:87.142.50.64


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.110.102.20
country_id: 2464461
description:
[2026-06-22 18:42:07 +0000] info [whostmgrd] 154.110.102.20 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 154.110.102.20
country_id: 2464461
description:
[2026-06-22 18:42:08 +0000] info [whostmgrd] 154.110.102.20 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 181.62.53.42
country_id: 3686110
description:
181.62.53.42 - - [22/Jun/2026:18:44:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9605829&pdata=https%253A%252F%252Fortouche.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782153859 HTTP/2.0" 302 0 ortouche.com "https://ortouche.com/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.8148.1875 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:181.62.53.42


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.113
country_id: 1880251
description:
47.128.121.113 - - [22/Jun/2026:18:43:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12741015&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fset-greve%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782153834 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/set-greve/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.113


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-22 18:46:44 +0000] info [webmaild] 196.171.46.177 - vincent.sodjehoun@togointerim.net "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.224
country_id: 3469034
description:
Jun 22 18:48:55 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.224 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:18:51:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920295&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782154302 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-22 18:52:25 +0000] info [webmaild] 102.176.253.226 - secre.gene@ucao-uut.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:18:51:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066835&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782154302 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-22 18:52:28 +0000] info [webmaild] 102.176.253.226 - secre.gene@ucao-uut.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.243.82.38
country_id: 1210997
description:
2026-06-22 18:56:43 dovecot_plain authenticator failed for H=(xaixhz6rl445w1hrtsagkjszqfkh) [103.243.82.38]:46851: 535 Incorrect authentication data (set_id=rappels@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.243.82.38
country_id: 1210997
description:
Jun 22 18:56:41 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.243.82.38 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.57
country_id: 1643084
description:
[2026-06-22 18:59:55 +0000] info [cpaneld] 103.65.237.57 - stephane "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user stephane (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-22 19:03:40 +0000] info [webmaild] 102.176.253.226 - secre.gene@ucao-uut.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 45.231.120.197
country_id: 3469034
domain: www.snb.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/siteweb/public/index.php?add-to-cart=22861||QS:add-to-cart=22861||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.195.8.90
country_id: 3469034
description:
Jun 22 19:06:23 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.195.8.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.195.8.90
country_id: 3469034
description:
Jun 22 19:06:31 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.195.8.90 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:19:06:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6788708&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782155194 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:19:06:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13276777&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782155195 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.235.140.189
country_id: 6252001
description:
2026-06-22 19:09:27 dovecot_plain authenticator failed for H=189.140.235.35.bc.googleusercontent.com (zegjg7h604ef0bujjr912s) [35.235.140.189]:16384: 535 Incorrect authentication data (set_id=info@soena.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.175.20.14
country_id: 3686110
description:
Jun 22 19:10:04 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.175.20.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.175.20.14
country_id: 3686110
description:
2026-06-22 19:10:06 dovecot_login authenticator failed for H=([98.170.57.251]) [45.175.20.14]:49494: 535 Incorrect authentication data (set_id=info@matosshop.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [22/Jun/2026:19:10:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9882009&pdata=https%253A%252F%252F24heureinfo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782155439 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.57
country_id: 1643084
description:
[2026-06-22 19:10:57 +0000] info [cpaneld] 103.65.237.57 - https "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user https (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.37.177.219
country_id: 1814991
description:
Jun 22 19:12:21 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.37.177.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.37.177.219
country_id: 1814991
description:
2026-06-22 19:12:23 dovecot_login authenticator failed for H=(ip-178-46-128-225.dsl.surnet.ru) [153.37.177.219]:27510: 535 Incorrect authentication data (set_id=info@matosshop.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.61
country_id: 3469034
description:
Jun 22 19:11:57 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.61 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 74.63.23.248
country_id: 953987
description:
Denial of Service (DoS) attack was discovered from 74.63.23.248: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 152.52.175.142
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 152.52.175.142: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 74.63.23.249
country_id: 953987
description:
Denial of Service (DoS) attack was discovered from 74.63.23.249: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 61.246.71.194
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 61.246.71.194: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.147.41
country_id: 1819730
description:
Jun 22 19:16:45 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.147.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.223.76.255
country_id: 1880251
description:
2026-06-22 19:20:16 dovecot_login authenticator failed for H=(159.223.76.255) [159.223.76.255]:39934: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.223.76.255
country_id: 1880251
description:
Jun 22 19:20:14 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.223.76.255 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 54.82.33.143
country_id: 6252001
domain: www.test.zephyr.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/136.0.0.0 Safari/537.36||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:19:22:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9815444&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782156149 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:19:22:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856363&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782156159 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 178.90.226.29
country_id: 1522867
description:
2026-06-22 19:26:31 H=([178.90.226.29]) [178.90.226.29]:18637 F=<prakash@white-ways.com> rejected RCPT <prakash@white-ways.com>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.168.0.186
country_id: 2363686
description:
[2026-06-22 19:31:47 +0000] info [cpaneld] 196.168.0.186 - aopsacai "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.138.16.178
country_id: 798544
description:
Jun 22 19:32:42 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.138.16.178 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.86.3.73
country_id: 226074
description:
[2026-06-22 19:33:43 +0000] info [cpaneld] 102.86.3.73 - pnls "GET /cpsess0359858073/3rdparty/phpMyAdmin/index.php?=undefined&login=1&post_login=18132933149748 HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [105.21.66.86] != Current IP Address [102.86.3.73]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.168.0.186
country_id: 2363686
description:
[2026-06-22 19:33:49 +0000] info [cpaneld] 196.168.0.186 - aopsacai "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.142
country_id: 3469034
description:
Jun 22 19:34:28 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.5.91
country_id: 2395170
description:
Jun 22 19:34:48 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.5.91 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-22 19:35:45 +0000] info [cpaneld] 102.54.238.57 - tresorerie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tresorerie (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:19:35:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10197658&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782156952 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 141.164.91.175
country_id: 6252001
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:141.164.91.175||TA:141.164.91.175||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:19:36:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9530522&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782156957 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.112
country_id: 1880251
description:
47.128.121.112 - - [22/Jun/2026:19:37:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12870552&pdata=https%253A%252F%252Ftogomedia24.tg%252Fcategory%252Ffootball%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782157033 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/category/football/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.112


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 31.59.24.133
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:19-37.31.59.24.133||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.170.45.140
country_id: 2363686
description:
[2026-06-22 19:39:52 +0000] info [cpaneld] 196.170.45.140 NEW aopsacai:GL725ZUsgg7wVq6j address=196.170.45.140,app=cpaneld,creator=aopsacai,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.168.0.186
country_id: 2363686
description:
[2026-06-22 19:39:43 +0000] info [cpaneld] 196.168.0.186 NEW aopsacai:FX15JtGyXIFHcJsP address=196.168.0.186,app=cpaneld,creator=aopsacai,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.45.140
country_id: 2363686
description:
[2026-06-22 19:39:43 +0000] info [cpaneld] 196.170.45.140 - aopsacai "GET /cpsess3892729982/?=undefined&login=1&post_login=10334966213278 HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [196.168.0.186] != Current IP Address [196.170.45.140]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.0.186
country_id: 2363686
description:
[2026-06-22 19:39:56 +0000] info [cpaneld] 196.168.0.186 - aopsacai "GET /cPanel_magic_revision_1781668665/frontend/jupiter/assets/application_icons/sprites/icon_spritemap.css HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [196.170.45.140] != Current IP Address [196.168.0.186]


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.147.235.246
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:45.147.235.246||TA:45.147.235.246||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.167.25.115
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:19-41.104.167.25.115||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.28.156.110
country_id: 1880251
description:
104.28.156.110 - - [22/Jun/2026:19:49:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6908310&pdata=https%253A%252F%252Fcpanel.mpa-maquette.free.netmaster.tg%252F%253Flocale%253Dja&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782157783 HTTP/2.0" 302 0 cpanel.mpa-maquette.free.netmaster.tg "https://cpanel.mpa-maquette.free.netmaster.tg/?locale=ja" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.28.156.110


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:19:51:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6802371&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782157868 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 190.106.186.63
country_id: 3175395
description:
190.106.186.63 - - [22/Jun/2026:19:51:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12818835&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fdepart-du-pouvoir%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782157875 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/depart-du-pouvoir/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.6885.1464 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:190.106.186.63


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-22 19:50:30 +0000] info [cpaneld] 102.54.238.57 - pduusmyf "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:19:51:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6775491&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782157868 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.44
country_id: 3175395
description:
Jun 22 19:51:28 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.44 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 91.234.194.198
country_id: 3017382
description:
Denial of Service (DoS) attack was discovered from 91.234.194.198: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-22 19:52:46 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:33982: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 123.6.49.44
country_id: 1814991
description:
123.6.49.44 - - [22/Jun/2026:19:56:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10185585&pdata=https%253A%252F%252Fmacite.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782158189 HTTP/2.0" 302 0 macite.tg "https://macite.tg/" "Mozilla/5.0 (Linux; U; Android 8.1.0; zh-cn; MI 8 Build/OPM1.171019.011) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.108 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:123.6.49.44


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.113
country_id: 1880251
description:
47.128.121.113 - - [22/Jun/2026:19:56:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869470&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fde-capitale%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782158192 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/de-capitale/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.113


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.27
country_id: 130758
description:
Jun 22 19:57:12 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.27 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.112
country_id: 1880251
description:
47.128.121.112 - - [22/Jun/2026:19:58:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738391&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fson-statut%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782158300 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/son-statut/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.112


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 123.6.49.18
country_id: 1814991
description:
123.6.49.18 - - [22/Jun/2026:19:57:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10250903&pdata=http%253A%252F%252Fmacite.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782158247 HTTP/1.1" 302 0 macite.tg "http://macite.tg/" "Mozilla/5.0 (Linux; Android 11; V2055A) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:123.6.49.18


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.143.192
country_id: 690791
description:
Jun 22 20:00:25 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.143.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.143.192
country_id: 690791
description:
Jun 22 20:00:32 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.143.192 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 112.15.239.66
country_id: 1814991
description:
Denial of Service (DoS) attack was discovered from 112.15.239.66: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 112.15.239.67
country_id: 1814991
description:
Denial of Service (DoS) attack was discovered from 112.15.239.67: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 27.2.226.14
country_id: 1562822
description:
Denial of Service (DoS) attack was discovered from 27.2.226.14: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 112.197.5.182
country_id: 1562822
description:
Denial of Service (DoS) attack was discovered from 112.197.5.182: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:20:05:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13265509&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782158722 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 176.97.79.119
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:20-06.176.97.79.119||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:20:05:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050396&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782158722 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 192.144.89.137
country_id: 2750405
description:
192.144.89.137 - - [22/Jun/2026:20:10:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7039647&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fsupply%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782159035 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/supply/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.5243.1390 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:192.144.89.137


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 176.97.79.119
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:20-10.176.97.79.119||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.208.83.5
country_id: 6252001
description:
2026-06-22 20:11:26 dovecot_login authenticator failed for H=(usmlepatients.com) [172.208.83.5]:44912: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.58.35
country_id: 1269750
description:
Jun 22 20:13:17 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.58.35 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.94.226.250
country_id: 3437598
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/b8b7b6 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.58.35
country_id: 1269750
description:
Jun 22 20:13:32 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.58.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.120.126
country_id: 3469034
description:
Jun 22 20:13:38 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.120.126 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.96.133
country_id: 2363686
description:
[2026-06-22 20:16:37 +0000] info [webmaild] 196.171.96.133 - tlemou@caissederetraites.tg "POST /cpsess2349632903/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [160.242.199.70] != Current IP Address [196.171.96.133]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.96.133
country_id: 2363686
description:
[2026-06-22 20:18:13 +0000] info [webmaild] 196.171.96.133 - tlemou@caissederetraites.tg "POST /cpsess2349632903/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 135.136.18.8
country_id: 3042058
domain: belali.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:antoniomccloud3||Email:gseotier2@xmc.pl||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.85.16
country_id: 2921044
description:
[2026-06-22 20:18:11 +0000] info [cpaneld] 217.181.85.16 - sahamtg "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.96.133
country_id: 2363686
description:
[2026-06-22 20:19:12 +0000] info [webmaild] 196.171.96.133 - tlemou@caissederetraites.tg "POST /cpsess2349632903/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.96.133
country_id: 2363686
description:
[2026-06-22 20:20:14 +0000] info [webmaild] 196.171.96.133 - tlemou@caissederetraites.tg "GET /cpsess5696081225/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 45.86.19.169
country_id: 6252001
domain: ekeasarl.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/140.0.0.0 Safari/537.36||RSV:8.19||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.245.243.110
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:104.245.243.110||TA:104.245.243.110||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.241
country_id: 3175395
description:
Jun 22 20:20:54 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.241 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:20:20:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065564&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782159648 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:20:20:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6921064&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782159651 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 89.248.171.23
country_id: 2750405
description:
89.248.171.23 - - [22/Jun/2026:20:22:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6854255&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782159730 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:89.248.171.23


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.255.139.138
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/880334571 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.62
country_id: 130758
description:
Jun 22 20:27:37 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.62 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 146.70.251.124
country_id: 2623032
description:
146.70.251.124 - - [22/Jun/2026:20:28:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6775964&pdata=https%253A%252F%252F154.70.82.246%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782160132 HTTP/2.0" 302 0 154.70.82.246 "https://154.70.82.246/home" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Safari/605.1.15" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:146.70.251.124


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 109.61.85.42
country_id: 2623032
description:
109.61.85.42 - - [22/Jun/2026:20:28:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10013037&pdata=http%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782160135 HTTP/1.1" 302 0 www.snb.tg "http://www.snb.tg/home" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:109.61.85.42


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.113
country_id: 1880251
description:
47.128.121.113 - - [22/Jun/2026:20:28:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9921483&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252F2024%252Fpage%252F6%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782160130 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/2024/page/6/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.113


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.146
country_id: 3469034
description:
Jun 22 20:29:46 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.146 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.83.4.64
country_id: 3017382
description:
[2026-06-22 20:30:13 +0000] info [cpaneld] 51.83.4.64 - kwbcfbmo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kwbcfbmo (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.143.197.40
country_id: 1527747
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/senat-togo-barry-moussa-barque-rencontre-la-cedeao-et-loms/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.119.147.37
country_id: 6252001
description:
[2026-06-22 20:33:57 +0000] info [whostmgrd] 70.119.147.37 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.66.6.155
country_id: 953987
description:
Jun 22 20:35:04 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.66.6.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.251.144
country_id: 3469034
description:
Jun 22 20:35:24 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.251.144 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:20:34:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7259290&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782160467 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:20:34:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12885449&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782160468 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.251.144
country_id: 3469034
description:
Jun 22 20:35:32 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.251.144 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 109.61.85.42
country_id: 2623032
description:
109.61.85.42 - - [22/Jun/2026:20:35:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6777966&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782160531 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (iPhone; CPU iPhone OS 6_0 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko)                     Version/6.0 Mobile/10A5376e Safari/8536.25" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:109.61.85.42


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.174.147.120
country_id: 3469034
description:
Jun 22 20:39:36 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.174.147.120 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 109.61.85.42
country_id: 2623032
description:
109.61.85.42 - - [22/Jun/2026:20:40:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6777966&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782160531 HTTP/2.0" 404 159 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_0 like Mac OS X) AppleWebKit/602.1.38 (KHTML, like Gecko) Version/10.0 Mobile/14A5297c Safari/602.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:109.61.85.42


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.16.91.93
country_id: 1269750
description:
Jun 22 20:45:16 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.16.91.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.16.91.93
country_id: 1269750
description:
Jun 22 20:45:30 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.16.91.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.162.20.26
country_id: 3865483
description:
Jun 22 20:45:56 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.162.20.26 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.28.163.35
country_id: 1880251
description:
104.28.163.35 - - [22/Jun/2026:20:46:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9724619&pdata=https%253A%252F%252Fwww.snb.tg%252Fcontact&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782161189 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/contact" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/30.0 Chrome/143.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.28.163.35


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
Jun 22 20:50:14 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.111.162.230
country_id: 2017370
description:
Jun 22 20:49:54 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.111.162.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.111.162.230
country_id: 2017370
description:
2026-06-22 20:49:56 dovecot_plain authenticator failed for H=(zbbrjzexr7jsgomy7y9u110) [89.111.162.230]:41925: 535 Incorrect authentication data (set_id=andre.k@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.74
country_id: 130758
description:
Jun 22 20:50:02 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.74 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:20:50:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6448285&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782161452 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:20:50:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10275478&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782161450 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jun 22 20:51:40 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.241.7.212
country_id: 1814991
description:
Jun 22 20:52:22 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.241.7.212 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.241.7.212
country_id: 1814991
description:
2026-06-22 20:52:24 dovecot_plain authenticator failed for H=(3mm2dwgru9ghg6c4j5975hn5td) [114.241.7.212]:54626: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.73.107.107
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/sante-au-togo-un-code-vestimentaire-national-pour-le-personnel-hospitalier HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 209.242.198.35
country_id: 3017382
description:
209.242.198.35 - - [22/Jun/2026:20:53:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13222808&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fmarche%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782161580 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/marche/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.8365.1081 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:209.242.198.35


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.66.155.73
country_id: 1880251
description:
Jun 22 20:55:27 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.66.155.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.220
country_id: 1269750
description:
Jun 22 20:55:38 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.220 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.83.4.60
country_id: 3017382
description:
[2026-06-22 20:56:33 +0000] info [cpaneld] 51.83.4.60 - pduusmyf "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 134.209.190.136
country_id: 2635167
description:
Jun 22 20:59:24 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 134.209.190.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.174.147.120
country_id: 3469034
description:
Jun 22 21:01:04 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.174.147.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.223.38.27
country_id: 1814991
description:
Jun 22 21:03:12 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.223.38.27 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.204.165.135
country_id: 6252001
description:
[2026-06-22 21:03:39 +0000] info [whostmgrd] 73.204.165.135 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 42.236.11.76
country_id: 1814991
description:
Denial of Service (DoS) attack was discovered from 42.236.11.76: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:21:05:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9542598&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782162313 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:21:05:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066841&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782162315 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-22 21:04:41 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:57520: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.250.247.129
country_id: 6252001
description:
[2026-06-22 21:07:30 +0000] info [whostmgrd] 96.250.247.129 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [22/Jun/2026:21:10:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10383201&pdata=http%253A%252F%252Fsia-togo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782162613 HTTP/1.1" 302 0 sia-togo.tg "http://sia-togo.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.135.105.172
country_id: 163843
description:
2026-06-22 21:09:59 dovecot_login authenticator failed for H=(cameg-togo.tg) [79.135.105.172]:32826: 535 Incorrect authentication data (set_id=sales@mail.cameg-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.196.9.6
country_id: 6252001
description:
103.196.9.6 - - [22/Jun/2026:21:10:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12819349&pdata=https%253A%252F%252Ftogomedia24.tg%252Fcategory%252Ffootball%252Fpage%252F13%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782162636 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/category/football/page/13/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.8325.1123 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.196.9.6


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-22 21:10:32 +0000] info [cpaneld] 102.54.238.57 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.148.120
country_id: 690791
description:
Jun 22 21:11:37 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.148.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.215.131
country_id: 1562822
description:
Jun 22 21:13:25 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.163.215.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.76.160.193
country_id: 1819730
description:
Jun 22 21:13:12 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.76.160.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.13.90.74
country_id: 1814991
description:
Jun 22 21:14:26 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.13.90.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
Jun 22 21:14:58 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.159.90.127
country_id: 2750405
description:
Jun 22 21:17:36 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.159.90.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.159.90.127
country_id: 2750405
description:
2026-06-22 21:17:38 dovecot_login authenticator failed for H=(ADMIN) [203.159.90.127]:35062: 535 Incorrect authentication data (set_id=mailer-daemon@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 134.209.190.136
country_id: 2635167
description:
Jun 22 21:19:05 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 134.209.190.136 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 65.110.40.143
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 65.110.40.143: 80 connections per 30 seconds to 80 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jun 22 21:19:35 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:21:21:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10183578&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782163270 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:21:21:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12949606&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782163274 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.255.62.89
country_id: 6252001
description:
Jun 22 21:21:32 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.255.62.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.174.147.120
country_id: 3469034
description:
Jun 22 21:22:48 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.174.147.120 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 52.34.76.65
country_id: 6252001
description:
52.34.76.65 - - [22/Jun/2026:21:22:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9881450&pdata=https%253A%252F%252F154.70.82.246&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782163363 HTTP/2.0" 302 0 154.70.82.246 "https://154.70.82.246/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:52.34.76.65


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.86.126.60
country_id: 6252001
description:
Jun 22 21:23:51 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.86.126.60 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.252.78.48
country_id: 298795
description:
212.252.78.48 - - [22/Jun/2026:21:24:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053017&pdata=https%253A%252F%252Fhaplucia-togo.tg%252Fwps-members%252Fkokouvi-lardja-arouna%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782163458 HTTP/2.0" 302 0 haplucia-togo.tg "https://haplucia-togo.tg/wps-members/kokouvi-lardja-arouna/" "Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.4 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.252.78.48


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-22 21:24:22 +0000] info [cpaneld] 102.54.238.57 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.206.160.92
country_id: 3469034
description:
2026-06-22 21:26:22 dovecot_plain authenticator failed for H=(working.k1eyh34ykwtu5edqqzhz0ohxbb.nx.internal.cloudapp.net) [20.206.160.92]:53346: 535 Incorrect authentication data (set_id=controleur@ccit.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.223.38.27
country_id: 1814991
description:
Jun 22 21:25:41 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.223.38.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.206.160.92
country_id: 3469034
description:
2026-06-22 21:26:28 dovecot_login authenticator failed for H=(working.k1eyh34ykwtu5edqqzhz0ohxbb.nx.internal.cloudapp.net) [20.206.160.92]:53346: 535 Incorrect authentication data (set_id=controleur@ccit.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.225.52.111
country_id: 290557
description:
Jun 22 21:26:47 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.225.52.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.255.62.89
country_id: 6252001
description:
Jun 22 21:29:03 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.255.62.89 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 65.110.40.18
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 65.110.40.18: 80 connections per 30 seconds to 80 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.71.187.124
country_id: 6252001
description:
54.71.187.124 - - [22/Jun/2026:21:29:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12885870&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782163791 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.71.187.124


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 138.199.6.242
country_id: 2658434
description:
138.199.6.242 - - [22/Jun/2026:21:30:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10250596&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782163825 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:138.199.6.242


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 194.180.233.73
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:194.180.233.73||TA:194.180.233.73||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.138.16.178
country_id: 798544
description:
Jun 22 21:30:59 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.138.16.178 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 209.216.92.194
country_id: 6252001
domain: www.snb.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/141.0.0.0 Safari/537.36||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.4.249
country_id: 2300660
description:
Jun 22 21:32:10 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.4.249 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.145.245.99
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/plus-de-50-demarches-administratives-digitalisees-au-togo HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.215.131
country_id: 1562822
description:
Jun 22 21:35:24 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.163.215.131 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:21:35:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7300295&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782164151 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:21:35:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131605&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782164152 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.138.16.178
country_id: 798544
description:
Jun 22 21:36:55 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.138.16.178 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.124.239.254
country_id: 1210997
domain: www.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tg/ustogo/wwwhlmesppb.html HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.124.239.254
country_id: 1210997
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/ustogo/wwwhlmesppb.html HTTP/1.1||RSV:8.19||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 65.110.40.37
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 65.110.40.37: 80 connections per 30 seconds to 80 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 134.209.190.136
country_id: 2635167
description:
Jun 22 21:38:51 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 134.209.190.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
Jun 22 21:39:33 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.249.90.133
country_id: 248816
domain: www.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tg/?p=602 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.249.90.133
country_id: 248816
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/?p=602 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.255.62.89
country_id: 6252001
description:
Jun 22 21:42:42 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.255.62.89 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.113
country_id: 1880251
description:
47.128.121.113 - - [22/Jun/2026:21:44:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10195814&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fnouveaux-diplomes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782164669 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/nouveaux-diplomes/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.113


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:21:50:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6712935&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782165005 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:21:50:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10077126&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782165009 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [22/Jun/2026:21:53:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132074&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DbW9oYW1tZWQubXVzaHRhcUB0Y3MuY29t&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782165195 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=bW9oYW1tZWQubXVzaHRhcUB0Y3MuY29t" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.138.16.178
country_id: 798544
description:
Jun 22 21:55:10 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.138.16.178 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.153.91.23
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/oembed/1.0/embed?format=xml&url=http:/togodailynews.tg/togo-les-pertes-post-recolte-reduites-lagriculture-optimisee-et-les-producteurs-heureux/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 67.209.155.44
country_id: 1522867
description:
2026-06-22 21:58:44 H=([67.209.155.44]) [67.209.155.44]:44093 F=<home@white-ways.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.194
country_id: 6252001
description:
Jun 22 21:59:49 ns5 pure-ftpd[2803229]: (?@205.210.31.194) [INFO] New connection from 205.210.31.194


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.137.212.23
country_id: 2750405
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:21-59.45.137.212.23||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-22 22:01:14 +0000] info [cpaneld] 102.54.238.57 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.188.166.141
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/oembed/1.0/embed?format=xml&url=http:/togodailynews.tg/pnds-les-grands-objectifs-du-togo/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:22:04:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10327191&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782165841 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:22:04:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10316393&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782165841 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
Jun 22 22:04:10 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 192.29.39.134
country_id: 1861060
description:
Denial of Service (DoS) attack was discovered from 192.29.39.134: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 123.6.49.50
country_id: 1814991
description:
123.6.49.50 - - [22/Jun/2026:22:13:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6591387&pdata=http%253A%252F%252Fwww.lcr-adem.org&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782166399 HTTP/1.1" 302 0 www.lcr-adem.org "http://www.lcr-adem.org/" "Mozilla/5.0 (Linux; Android 11; V2055A) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:123.6.49.50


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.82.158.125
country_id: 6252001
description:
[2026-06-22 22:13:24 +0000] info [whostmgrd] 74.82.158.125 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.86.126.60
country_id: 6252001
description:
Jun 22 22:15:43 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.86.126.60 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:22:18:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10011241&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782166731 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 51.68.148.113
country_id: 3017382
description:
Denial of Service (DoS) attack was discovered from 51.68.148.113: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 8.47.97.87
country_id: 6252001
description:
[2026-06-22 22:22:54 +0000] info [cpaneld] 8.47.97.87 - dgdntogotg "GET /login/?login_only=1&user=dgdntogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.179.232.92
country_id: 6252001
description:
[2026-06-22 22:23:02 +0000] info [cpaneld] 73.179.232.92 - dgdnt "GET /login/?login_only=1&user=dgdnt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.185.214.157
country_id: 6252001
description:
[2026-06-22 22:22:56 +0000] info [cpaneld] 47.185.214.157 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.129.182.240
country_id: 6252001
description:
[2026-06-22 22:23:05 +0000] info [cpaneld] 68.129.182.240 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.68.94.35
country_id: 6252001
description:
[2026-06-22 22:22:59 +0000] info [cpaneld] 71.68.94.35 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.30.218.236
country_id: 6252001
description:
[2026-06-22 22:23:11 +0000] info [cpaneld] 76.30.218.236 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.120.135.182
country_id: 6252001
description:
[2026-06-22 22:22:48 +0000] info [cpaneld] 74.120.135.182 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.89.71
country_id: 6252001
description:
[2026-06-22 22:23:14 +0000] info [cpaneld] 172.59.89.71 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.170.84.202
country_id: 6252001
description:
[2026-06-22 22:22:51 +0000] info [cpaneld] 76.170.84.202 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.165.54.5
country_id: 102358
description:
2026-06-22 22:24:49 dovecot_plain authenticator failed for H=(897f3l5weqha2ooqsy) [213.165.54.5]:50824: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.74
country_id: 130758
description:
Jun 22 22:26:57 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.74 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.96.20.245
country_id: 6252001
description:
[2026-06-22 22:29:20 +0000] info [cpaneld] 73.96.20.245 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.166.150.148
country_id: 6252001
description:
[2026-06-22 22:29:23 +0000] info [cpaneld] 47.166.150.148 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
Jun 22 22:28:38 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.86.16.135
country_id: 6252001
description:
[2026-06-22 22:29:25 +0000] info [cpaneld] 152.86.16.135 - dgdntogotg "GET /login/?login_only=1&user=dgdntogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.227.55.237
country_id: 6252001
description:
[2026-06-22 22:29:44 +0000] info [cpaneld] 98.227.55.237 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.5.153.160
country_id: 6252001
description:
[2026-06-22 22:29:49 +0000] info [cpaneld] 107.5.153.160 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.146.33.43
country_id: 6252001
description:
[2026-06-22 22:29:35 +0000] info [cpaneld] 76.146.33.43 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.184.238.254
country_id: 6252001
description:
[2026-06-22 22:29:37 +0000] info [cpaneld] 72.184.238.254 - dgdnt "GET /login/?login_only=1&user=dgdnt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 205.201.77.3
country_id: 6252001
description:
[2026-06-22 22:29:42 +0000] info [cpaneld] 205.201.77.3 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [22/Jun/2026:22:30:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10064743&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782167444 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [22/Jun/2026:22:30:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13266846&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782167447 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:22:34:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13224086&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782167688 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.108.233.190
country_id: 1835841
description:
Jun 22 22:39:13 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.108.233.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.233.190
country_id: 1835841
description:
2026-06-22 22:39:15 dovecot_login authenticator failed for H=([106.10.69.50]) [183.108.233.190]:43285: 535 Incorrect authentication data (set_id=info@emt.tg)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.64.171.58
country_id: 2363686
description:
[2026-06-22 22:45:01 +0000] info [cpaneld] 102.64.171.58 - mvfxewjz "GET /cpsess4804377194/frontend/jupiter/email_accounts/index.html HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [196.171.122.34] != Current IP Address [102.64.171.58]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.243.252.106
country_id: 290291
domain: www.arse.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg:80/wp-content/themes/jannah/assets/css/plugins/bbpress.min.css?ver=7.1.0 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.247.71.176
country_id: 290557
domain: www.arse.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg:80/wp-content/themes/jannah/assets/css/style.min.css?ver=7.1.0 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.247.64.50
country_id: 3017382
domain: www.arse.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg:80/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=6.0.3 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.93.133.214
country_id: 3658394
domain: www.arse.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg:80/wp-includes/css/dashicons.min.css?ver=6.7.5 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 176.97.79.119
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:22-45.176.97.79.119||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.245.234.40
country_id: 798544
domain: www.arse.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg:80/wp-content/plugins/taqyeem-buttons/assets/style.css?ver=6.7.5 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.246.209.173
country_id: 290557
domain: www.arse.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg:80/wp-content/plugins/embedpress/assets/css/embedpress.css?ver=6.7.5 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 208.84.101.111
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 208.84.101.111: 80 connections per 30 seconds to 80 port.


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 62.197.45.211
country_id: 2750405
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:22-48.62.197.45.211||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:22:50:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9805459&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782168596 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:22:50:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10012776&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782168599 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 195.177.93.67
country_id: 2658434
description:
195.177.93.67 - - [22/Jun/2026:22:49:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7444893&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782168593 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:195.177.93.67


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.138.16.178
country_id: 798544
description:
Jun 22 22:50:31 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.138.16.178 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.183.88.219
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/amelioration-du-climat-des-affaire-lancement-dune-enquete-de-satisfaction-du-secteur-prive-au-togo HTTP/1.1||RSV:8.19||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.223.45.202
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.223.45.202: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.223.45.234
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.223.45.234: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.223.45.205
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.223.45.205: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.218.216.168
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.218.216.168: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.242.178.229
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.242.178.229: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.242.178.157
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.242.178.157: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.242.178.213
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.242.178.213: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.83.4.64
country_id: 3017382
description:
[2026-06-22 22:56:31 +0000] info [cpaneld] 51.83.4.64 - cvajhehu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cvajhehu (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.228.113.27
country_id: 1835841
description:
Jun 22 22:58:17 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.228.113.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-06-22 22:58:19 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:47590: 535 Incorrect authentication data (set_id=info@tps.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.169.99.242
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/wp/v2/posts/1729 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.169.82.89
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tofa-2026-ouidah-entre-tradition-et-spiritualite HTTP/1.1||RSV:8.19||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 69.28.41.222
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 69.28.41.222: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.231.189.83
country_id: 3624060
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/enseignement-superieur-au-togo-de-largent-mobilise-pour-le-progres-des-universites-publiques HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.56.145.120
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/promotion-des-produits-locaux-la-cci-togo-et-togomall-signent-un-protocole-daccord HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.132.98.137
country_id: 6252001
description:
[2026-06-22 23:07:48 +0000] info [cpaneld] 68.132.98.137 - cafeittg "GET /login/?login_only=1&user=cafeittg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafeittg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.250.83.40
country_id: 6252001
description:
[2026-06-22 23:08:04 +0000] info [cpaneld] 71.250.83.40 - ca "GET /login/?login_only=1&user=ca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.72.86.150
country_id: 6252001
description:
[2026-06-22 23:07:45 +0000] info [cpaneld] 174.72.86.150 - cafeit "GET /login/?login_only=1&user=cafeit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafeit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.218.86.73
country_id: 6252001
description:
[2026-06-22 23:07:54 +0000] info [cpaneld] 75.218.86.73 - cafe "GET /login/?login_only=1&user=cafe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.172
country_id: 690791
description:
2026-06-22 23:08:39 H=([45.144.212.172]) [45.144.212.172]:52858 F=<dpr@priv8shop.com> rejected RCPT <garyconsultant@outlook.com>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.220.113.66
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/industrie-la-zone-franche-togolaise-source-demplois HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.113.171.152
country_id: 1814991
description:
Jun 22 23:11:52 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.113.171.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.113.171.152
country_id: 1814991
description:
2026-06-22 23:11:54 dovecot_plain authenticator failed for H=(kofe24krlcgjtlm8n6d) [123.113.171.152]:50736: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.57
country_id: 6252001
description:
205.169.39.57 - - [22/Jun/2026:23:16:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6777185&pdata=http%253A%252F%252Fekeasarl.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782170191 HTTP/1.1" 302 0 ekeasarl.com "http://ekeasarl.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.57


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [22/Jun/2026:23:16:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9989315&pdata=http%253A%252F%252Fekeasarl.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782170189 HTTP/1.1" 302 0 ekeasarl.com "http://ekeasarl.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [22/Jun/2026:23:16:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999817&pdata=https%253A%252F%252Fekeasarl.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782170197 HTTP/2.0" 302 0 ekeasarl.com "https://ekeasarl.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.241
country_id: 3469034
description:
Jun 22 23:19:18 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.241 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:23:19:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116646&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782170374 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:23:19:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9671061&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782170376 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 167.71.235.30
country_id: 1269750
description:
167.71.235.30 - - [22/Jun/2026:23:22:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723429&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782170520 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:167.71.235.30


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.38.156.139
country_id: 798544
description:
45.38.156.139 - - [22/Jun/2026:23:22:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9947034&pdata=https%253A%252F%252Ftogomedia24.tg%252F2022%252F11%252F03%252Fle-president-ivoirien-aurait-il-rejete-un-projet-daccord-de-liberation-des-soldats%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782170560 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/2022/11/03/le-president-ivoirien-aurait-il-rejete-un-projet-daccord-de-liberation-des-soldats/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.9145.1469 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.38.156.139


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.255.85.138
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-les-faits-marquants-du-nouveau-gouvernement HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 137.184.140.204
country_id: 6252001
description:
137.184.140.204 - - [22/Jun/2026:23:24:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7236761&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782170678 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:137.184.140.204


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.205.224.44
country_id: 6252001
description:
[2026-06-22 23:27:42 +0000] info [cpaneld] 72.205.224.44 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.181.25.172
country_id: 6252001
description:
[2026-06-22 23:27:45 +0000] info [cpaneld] 97.181.25.172 - dgdntogotg "GET /login/?login_only=1&user=dgdntogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.197.52.81
country_id: 6252001
description:
[2026-06-22 23:27:52 +0000] info [cpaneld] 71.197.52.81 - dgdnt "GET /login/?login_only=1&user=dgdnt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.199.155.31
country_id: 6252001
description:
[2026-06-22 23:27:47 +0000] info [cpaneld] 73.199.155.31 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.13.205.112
country_id: 6252001
description:
[2026-06-22 23:27:50 +0000] info [cpaneld] 68.13.205.112 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.145.84.248
country_id: 6252001
description:
[2026-06-22 23:27:56 +0000] info [cpaneld] 216.145.84.248 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.95.216.2
country_id: 6252001
description:
[2026-06-22 23:28:00 +0000] info [cpaneld] 38.95.216.2 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 42.236.11.209
country_id: 1814991
description:
Denial of Service (DoS) attack was discovered from 42.236.11.209: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.60
country_id: 3175395
description:
Jun 22 23:29:30 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.119.35.240
country_id: 953987
description:
2026-06-22 23:29:57 dovecot_plain authenticator failed for H=(localhost) [160.119.35.240]:55211: 535 Incorrect authentication data (set_id=contact@emt.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.60
country_id: 3175395
description:
Jun 22 23:29:37 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.46
country_id: 3175395
description:
Jun 22 23:31:11 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.171.106.15
country_id: 1814991
description:
Jun 22 23:31:17 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.171.106.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.171.106.15
country_id: 1814991
description:
2026-06-22 23:31:19 dovecot_plain authenticator failed for H=(a3v9ainnlethojj05t60) [116.171.106.15]:45130: 535 Incorrect authentication data (set_id=emmanuel.megbenu@mesyscom.com)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 208.84.101.197
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 208.84.101.197: 80 connections per 30 seconds to 80 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.244.123.240
country_id: 6252001
description:
[2026-06-22 23:32:31 +0000] info [cpaneld] 73.244.123.240 - togointe "GET /login/?login_only=1&user=togointe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.224.17.209
country_id: 6252001
description:
[2026-06-22 23:32:28 +0000] info [cpaneld] 96.224.17.209 - togointerimnet "GET /login/?login_only=1&user=togointerimnet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointerimnet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.172.161.117
country_id: 6252001
description:
[2026-06-22 23:32:20 +0000] info [cpaneld] 73.172.161.117 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.127.115.140
country_id: 6252001
description:
[2026-06-22 23:32:25 +0000] info [cpaneld] 24.127.115.140 - togointerim "GET /login/?login_only=1&user=togointerim&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointerim (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.5.198.141
country_id: 6252001
description:
[2026-06-22 23:32:36 +0000] info [cpaneld] 24.5.198.141 - togoint "GET /login/?login_only=1&user=togoint&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoint (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.40.25.218
country_id: 6252001
description:
[2026-06-22 23:32:47 +0000] info [cpaneld] 68.40.25.218 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 22 23:33:28 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.130.192.18
country_id: 6252001
description:
[2026-06-22 23:32:38 +0000] info [cpaneld] 38.130.192.18 - togoin "GET /login/?login_only=1&user=togoin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.127.16.4
country_id: 6252001
description:
[2026-06-22 23:32:49 +0000] info [cpaneld] 73.127.16.4 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.40.83.4
country_id: 6252001
description:
[2026-06-22 23:32:41 +0000] info [cpaneld] 68.40.83.4 - togoi "GET /login/?login_only=1&user=togoi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.146.30
country_id: 6252001
description:
[2026-06-22 23:32:44 +0000] info [cpaneld] 172.59.146.30 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 209.50.186.12
country_id: 3175395
domain: cafe.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:trumpweiss||User:cafetg||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:23:34:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066792&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782171288 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:23:35:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9672137&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782171300 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.186.68.154
country_id: 1814991
description:
Jun 22 23:37:45 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.186.68.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.186.68.154
country_id: 1814991
description:
2026-06-22 23:37:47 dovecot_login authenticator failed for H=([222.186.68.154]) [222.186.68.154]:33466: 535 Incorrect authentication data (set_id=geraud@armp.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.52.13.11
country_id: 690791
description:
2026-06-22 23:38:37 dovecot_plain authenticator failed for H=(localhost) [77.52.13.11]:64759: 535 Incorrect authentication data (set_id=netflix@emt.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 68.167.199.119
country_id: 6252001
domain: brasseriesnb.snb.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/brasseriesnb.snb.tg/uploads/images/108.png HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 73.217.46.241
country_id: 6252001
domain: www.snb.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:23-40.73.217.46.241||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.69
country_id: 798544
description:
Jun 22 23:41:52 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.47.190
country_id: 2300660
description:
Jun 22 23:43:42 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.47.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.103.105.201
country_id: 2589581
description:
Jun 22 23:45:17 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.103.105.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.103.105.201
country_id: 2589581
description:
2026-06-22 23:45:19 dovecot_plain authenticator failed for H=(localhost) [41.103.105.201]:56846: 535 Incorrect authentication data (set_id=mointie@emt.tg)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 208.84.101.94
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 208.84.101.94: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.172.34
country_id: 6252001
description:
Jun 22 23:46:40 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.172.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.105.21.148
country_id: 719819
description:
Jun 22 23:48:35 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.105.21.148 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.193.171.225
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/umoa-titres-le-togo-leve-327-milliards-fcfa HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.105.21.148
country_id: 719819
description:
Jun 22 23:48:42 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.105.21.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.129.202
country_id: 690791
description:
Jun 22 23:48:53 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.129.202 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:23:51:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6791115&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782172271 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:23:51:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13027182&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782172276 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.86.152.38
country_id: 1880251
domain: brasseriesnb.snb.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/brasseriesnb.snb.tg/uploads/images/105.png HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.112.178.202
country_id: 2328926
description:
2026-06-22 23:55:21 dovecot_plain authenticator failed for H=(localhost) [105.112.178.202]:29784: 535 Incorrect authentication data (set_id=rappels@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.112.178.202
country_id: 2328926
description:
Jun 22 23:55:19 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.112.178.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 22 23:56:19 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 193.167.245.120
country_id: 660013
description:
Denial of Service (DoS) attack was discovered from 193.167.245.120: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 18.101.181.173
country_id: 2510769
domain: www.sp-eau.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:18.101.181.173||TA:18.101.181.173||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 114.10.139.50
country_id: 1643084
description:
114.10.139.50 - - [22/Jun/2026:23:58:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10185115&pdata=https%253A%252F%252Fucao-uut.tg%252Fadmissions%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782172723 HTTP/2.0" 302 0 ucao-uut.tg "https://ucao-uut.tg/admissions/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:114.10.139.50


plugin: modsec
rule: 77433249
name: IM360 WAF: Track WordPress admin user creation
abuser: 174.118.45.202
country_id: 6251999
domain: tdn.tg
description:
IM360 WAF: Track WordPress admin user creation||WPU:ABen||NewUser:Anselme||Email:yaoavi21@gmail.com||Role:author||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.133
country_id: 2635167
description:
[2026-06-23 00:00:40 +0000] info [cpaneld] 5.230.133.133 NEW newistm:khAF0cnYFJd0MEJQ address=5.230.133.133,app=cpaneld,creator=newistm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.2.253
country_id: 690791
description:
Jun 23 00:01:05 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.2.253 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 8.243.161.141
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/economie/page/aeac9f HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.50.57.225
country_id: 3277605
description:
2026-06-23 00:01:12 dovecot_plain authenticator failed for H=(localhost) [185.50.57.225]:54289: 535 Incorrect authentication data (set_id=agounkej@ucao-uut.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.77
country_id: 690791
description:
Jun 23 00:01:25 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:01:27 dovecot_login authenticator failed for H=(SmfBeKI5) [77.83.39.77]:65150: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.77
country_id: 690791
description:
Jun 23 00:01:43 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:01:45 dovecot_login authenticator failed for H=(TomDH9o9Ld) [77.83.39.77]:55409: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.77
country_id: 690791
description:
Jun 23 00:02:55 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.77 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.41.48.22
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tribunal-militaire-de-lome-le-lieutenant-colonel-dadjo-ograbako-nomme-procureur-general HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:02:39 dovecot_login authenticator failed for H=(5OH1FlPI) [77.83.39.77]:52114: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.147.234.132
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:45.147.234.132||TA:45.147.234.132||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.77
country_id: 690791
description:
Jun 23 00:03:49 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:03:51 dovecot_login authenticator failed for H=(inYKj8f) [77.83.39.77]:51482: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.77
country_id: 690791
description:
Jun 23 00:04:43 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:04:45 dovecot_login authenticator failed for H=(vo31O25) [77.83.39.77]:56143: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:05:03 dovecot_login authenticator failed for H=(gEcUbbCtB) [77.83.39.77]:57425: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.197.20.93
country_id: 241170
domain: brasseriesnb.snb.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/brasseriesnb.snb.tg/uploads/images/109.png HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:05:39 dovecot_login authenticator failed for H=(5opVwZQ) [77.83.39.77]:59987: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.77
country_id: 690791
description:
Jun 23 00:05:37 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:06:51 dovecot_login authenticator failed for H=(7l83t9iC) [77.83.39.77]:50010: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.38.37.39
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/economie/page/1117923215 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.215
country_id: 6252001
description:
Jun 23 00:07:01 ns5 pure-ftpd[2858073]: (?@205.210.31.215) [INFO] New connection from 205.210.31.215


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.77
country_id: 690791
description:
Jun 23 00:06:49 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.77 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 148.222.205.65
country_id: 3895114
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/wp/v2/posts/6936 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.77
country_id: 690791
description:
Jun 23 00:07:43 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:07:45 dovecot_login authenticator failed for H=(F4Qrj45G) [77.83.39.77]:64920: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:09:15 dovecot_login authenticator failed for H=(NwsvHR) [77.83.39.77]:60386: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:08:39 dovecot_login authenticator failed for H=(annVKd) [77.83.39.77]:50727: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.77
country_id: 690791
description:
Jun 23 00:08:37 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.77
country_id: 690791
description:
Jun 23 00:09:49 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:09:51 dovecot_login authenticator failed for H=(aycz03PlR3) [77.83.39.77]:60587: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.77
country_id: 690791
description:
Jun 23 00:10:43 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:10:45 dovecot_login authenticator failed for H=(x7pqebpHz) [77.83.39.77]:52976: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:11:43 dovecot_login authenticator failed for H=(FzHfiicn1i) [77.83.39.77]:61783: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.77
country_id: 690791
description:
Jun 23 00:11:41 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.77 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.254.167.18
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/10/Page-7-B.jpg 800w, http:/togodailynews.tg/wp-content/uploads/2022/10/Page-7-B-300x221.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2022/10/Page-7-B-768x566.jpg 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.77
country_id: 690791
description:
Jun 23 00:12:43 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:12:45 dovecot_login authenticator failed for H=(gGwv60mEk7) [77.83.39.77]:55855: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 77.247.120.48
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/economie/page/782706330 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 23 00:14:01 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 23 00:13:56 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-23 00:14:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:43034: 535 Incorrect authentication data (set_id=diva)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.66
country_id: 130758
description:
Jun 23 00:13:38 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:13:57 dovecot_login authenticator failed for H=(3hVJzmjLV) [77.83.39.77]:61527: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 23 00:14:18 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-23 00:14:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:29966: 535 Incorrect authentication data (set_id=gucchi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.77
country_id: 690791
description:
Jun 23 00:13:37 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 23 00:13:56 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-23 00:13:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:11420: 535 Incorrect authentication data (set_id=panel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-23 00:13:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:18284: 535 Incorrect authentication data (set_id=fortune)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-23 00:14:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:51420: 535 Incorrect authentication data (set_id=asdasd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-23 00:14:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:54960: 535 Incorrect authentication data (set_id=recruit)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 23 00:14:09 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:13:39 dovecot_login authenticator failed for H=(5bTfYX82) [77.83.39.77]:64924: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 23 00:13:59 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 23 00:15:03 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-23 00:14:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:57568: 535 Incorrect authentication data (set_id=esxi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 23 00:14:49 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-23 00:14:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:19056: 535 Incorrect authentication data (set_id=secureftp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.159.90.127
country_id: 2750405
description:
2026-06-23 00:15:30 dovecot_login authenticator failed for H=(ADMIN) [203.159.90.127]:55498: 535 Incorrect authentication data (set_id=mailer-daemon@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-23 00:14:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:27234: 535 Incorrect authentication data (set_id=fabienne)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 23 00:14:50 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 23 00:15:16 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 23 00:14:44 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-23 00:15:05 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:5358: 535 Incorrect authentication data (set_id=ceo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-23 00:15:18 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:55571: 535 Incorrect authentication data (set_id=sonicwall)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-23 00:14:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:58110: 535 Incorrect authentication data (set_id=pana)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.77
country_id: 690791
description:
Jun 23 00:14:49 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 23 00:14:53 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:14:51 dovecot_login authenticator failed for H=(MLRhOS) [77.83.39.77]:63727: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-23 00:14:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:51562: 535 Incorrect authentication data (set_id=aftermarket-robotech)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 23 00:15:03 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.159.90.127
country_id: 2750405
description:
Jun 23 00:15:28 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.159.90.127 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 130.12.182.188
country_id: 3190538
description:
Jun 23 00:16:08 ns5 pure-ftpd[2863165]: (?@130.12.182.188) [INFO] New connection from 130.12.182.188


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 23 00:15:40 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-23 00:15:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:37312: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-23 00:15:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:63654: 535 Incorrect authentication data (set_id=123)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-23 00:15:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:33198: 535 Incorrect authentication data (set_id=psicologia)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-23 00:15:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:65204: 535 Incorrect authentication data (set_id=takashima)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 23 00:15:53 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 23 00:15:41 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:15:45 dovecot_login authenticator failed for H=(vod9qo97u) [77.83.39.77]:50249: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-23 00:15:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:3182: 535 Incorrect authentication data (set_id=web15)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 23 00:15:41 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-23 00:15:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:6672: 535 Incorrect authentication data (set_id=edipo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.77
country_id: 690791
description:
Jun 23 00:15:43 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.132.160.240
country_id: 2921044
description:
2026-06-23 00:15:50 dovecot_plain authenticator failed for H=(gh78frtxrt9etgzxxjucdxbmmx0ux) [91.132.160.240]:42976: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 23 00:15:47 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 23 00:15:48 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.132.160.240
country_id: 2921044
description:
Jun 23 00:15:48 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.132.160.240 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.195.39.17
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/economie/page/125992904 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:16:40 dovecot_login authenticator failed for H=(0QCAZv2) [77.83.39.77]:56529: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.77
country_id: 690791
description:
Jun 23 00:16:56 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.77 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.102.66
country_id: 2363686
description:
[2026-06-23 00:17:25 +0000] info [webmaild] 196.170.102.66 - leo.afagbedji@togointerim.net "POST /cpsess9225367742/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.169.18.121] != Current IP Address [196.170.102.66]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:17:52 dovecot_login authenticator failed for H=(DRJhOfWl) [77.83.39.77]:62693: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.77
country_id: 690791
description:
Jun 23 00:17:50 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 23 00:19:20 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.77
country_id: 690791
description:
Jun 23 00:18:44 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:18:46 dovecot_login authenticator failed for H=(s5JCrZCoO) [77.83.39.77]:60375: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:19:40 dovecot_login authenticator failed for H=(Ta9m0Gh) [77.83.39.77]:63780: 535 Incorrect authentication data (set_id=adt-togo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.186
country_id: 130758
description:
Jun 23 00:20:16 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.77
country_id: 690791
description:
Jun 23 00:19:38 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:21:10 dovecot_login authenticator failed for H=(AIbGxL) [77.83.39.77]:55968: 535 Incorrect authentication data (set_id=adt-togo)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.17.121.145
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/author/admin/page/519898857 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:20:52 dovecot_login authenticator failed for H=(VEGpioa) [77.83.39.77]:53908: 535 Incorrect authentication data (set_id=adt-togo)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [23/Jun/2026:00:21:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999206&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782174060 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.117.47.156
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/economie/page/1317324012 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.77
country_id: 690791
description:
Jun 23 00:20:50 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.65
country_id: 130758
description:
Jun 23 00:21:43 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.65 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.44.165.77
country_id: 1694008
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/author/admin/page/899093 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.88
country_id: 130758
description:
Jun 23 00:24:25 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.64
country_id: 130758
description:
Jun 23 00:24:32 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.145
country_id: 3175395
description:
Jun 23 00:24:45 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.160
country_id: 130758
description:
Jun 23 00:26:22 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.89.160.89
country_id: 6252001
description:
Jun 23 00:27:12 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.89.160.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.160.89
country_id: 6252001
description:
2026-06-23 00:27:14 dovecot_login authenticator failed for H=(arcop.tg) [64.89.160.89]:55712: 535 Incorrect authentication data (set_id=pfcgolfe4@arcop.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.64
country_id: 130758
description:
Jun 23 00:27:14 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.64 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 202.166.193.5
country_id: 1282988
description:
Denial of Service (DoS) attack was discovered from 202.166.193.5: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 135.181.165.131
country_id: 660013
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:135.181.165.131||TA:135.181.165.131||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.83.5.75
country_id: 3017382
description:
[2026-06-23 00:29:04 +0000] info [cpaneld] 51.83.5.75 - anadebfreenetmas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anadebfreenetmas (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.112
country_id: 1880251
description:
47.128.121.112 - - [23/Jun/2026:00:29:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920601&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fus-aid-ippf%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782174595 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/us-aid-ippf/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.112


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.71
country_id: 130758
description:
Jun 23 00:30:36 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.178.26
country_id: 3175395
description:
Jun 23 00:30:52 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.178.26 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 62.61.187.195
country_id: 286963
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1545546024 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 65.110.40.136
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 65.110.40.136: 80 connections per 30 seconds to 80 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.87
country_id: 130758
description:
Jun 23 00:32:36 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.87 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 193.163.89.225
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:193.163.89.225||TA:193.163.89.225||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.89.29.105
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/author/admin/page/1701988589 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.62.47
country_id: 6252001
domain: leadelles.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/leadelles.tg/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [23/Jun/2026:00:35:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7129541&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782174921 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.74.119.156
country_id: 3703430
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/wp/v2/posts/22798 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.87
country_id: 130758
description:
Jun 23 00:37:03 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.87 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.104.235
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2020/09/WhatsApp-Image-2020-09-10-at-11.07.17.jpeg 480w, http:/togodailynews.tg/wp-content/uploads/2020/09/WhatsApp-Image-2020-09-10-at-11.07.17-300x200.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2020/09/WhatsApp-Image-2020-09-10-at-11.07.17-272x182.jpeg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.238.25.199
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/07/IMG-20210727-WA0167.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2021/07/IMG-20210727-WA0167-300x221.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2021/07/IMG-20210727-WA0167-768x567.jpg 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.189.168.94
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/46566763 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.55
country_id: 690791
description:
2026-06-23 00:38:53 H=([77.83.39.55]) [77.83.39.55]:51966 F=<info@elsolut.com> rejected RCPT <contact@sthandling-aero.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.39
country_id: 130758
description:
Jun 23 00:41:18 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.39 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.100.46.75
country_id: 614540
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/couverture-sanitaire-universelle-au-togo-victoire-tomegah-dogbe-lance-le-sseqcu HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.204.61.24
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/economie/page/a99b98 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 23 00:42:06 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.37.3
country_id: 3469034
description:
Jun 23 00:45:18 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.37.3 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 148.251.135.59
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 148.251.135.59: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.67
country_id: 130758
description:
Jun 23 00:46:25 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.67 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 77.137.71.45
country_id: 294640
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/10/IMG-20221001-WA0003.jpg 700w, http:/togodailynews.tg/wp-content/uploads/2022/10/IMG-20221001-WA0003-300x166.jpg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.182.58.56
country_id: 1814991
description:
2026-06-23 00:46:52 dovecot_login authenticator failed for H=(dvieac) [123.182.58.56]:57909: 535 Incorrect authentication data (set_id=web)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.120.129.7
country_id: 690791
description:
Jun 23 00:49:30 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.120.129.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.11.153
country_id: 2300660
description:
Jun 23 00:49:04 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.11.153 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.155.72.166
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/07/IMG_20210721_160424_062.jpg 4160w, http:/togodailynews.tg/wp-content/uploads/2021/07/IMG_20210721_160424_062-300x225.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2021/07/IMG_20210721_160424_062-768x576.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2021/07/IMG_20210721_160424_062-1024x768.jpg 1024w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.120.88.124
country_id: 3508796
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/07/Le-Togo-et-le-Nigeria-redynamisent-leur-cooperation-768x472.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2021/07/Le-Togo-et-le-Nigeria-redynamisent-leur-cooperation-768x472-300x184.jpg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 65.110.40.58
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 65.110.40.58: 80 connections per 30 seconds to 80 port.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.123.243.189
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/economie/page/bcb7a2 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [23/Jun/2026:00:50:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13420141&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782175817 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.186
country_id: 130758
description:
Jun 23 00:49:40 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.120.129.7
country_id: 690791
description:
Jun 23 00:49:43 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.120.129.7 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.53.111.24
country_id: 102358
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/07/HeForShe-Lancement-au-Togo.jpg 715w, http:/togodailynews.tg/wp-content/uploads/2021/07/HeForShe-Lancement-au-Togo-300x178.jpg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.65
country_id: 130758
description:
Jun 23 00:51:52 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.65 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.166.172.216
country_id: 1282988
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1843036101 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 98.97.76.212
country_id: 2328926
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/696867 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.86.109.129
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1684141515 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.236.172.42
country_id: 798544
description:
Jun 23 00:53:19 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.236.172.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.67
country_id: 130758
description:
Jun 23 00:56:19 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.67 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.35.230.147
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/08/4millions_001.jpg 765w, http:/togodailynews.tg/wp-content/uploads/2023/08/4millions_001-300x50.jpg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.61.115.196
country_id: 3585968
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/11/0168423241a0678521ccf427016e00be_L.jpg 600w, http:/togodailynews.tg/wp-content/uploads/2024/11/0168423241a0678521ccf427016e00be_L-300x169.jpg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.100
country_id: 130758
description:
Jun 23 00:57:42 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.100 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.25.149
country_id: 2635167
description:
[2026-06-23 00:59:27 +0000] info [cpaneld] 195.63.25.149 - doufelg "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.94.44
country_id: 2635167
description:
[2026-06-23 00:59:32 +0000] info [cpaneld] 217.181.94.44 - qfaclpeg "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 91.92.240.232
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 91.92.240.232: 80 connections per 30 seconds to 443 port.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.189.151.135
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/05/t\xc3\xa9l\xc3\xa9chargement-75.jpeg 275w, http:/togodailynews.tg/wp-content/uploads/2022/05/t\xc3\xa9l\xc3\xa9chargement-75-272x182.jpeg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.28.187.80
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/education/page/9299a0 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.189.103.160
country_id: 3895114
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/education/page/751466963 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.32.24.77
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/education/page/2059873731 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.60.68.90
country_id: 3895114
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/education/page/bcb7a2 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 160.187.221.25
country_id: 1694008
description:
160.187.221.25 - - [23/Jun/2026:01:03:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869164&pdata=https%253A%252F%252Fcpanel.batika.free.netmaster.tg%252F%253Flocale%253Dda&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782176607 HTTP/2.0" 302 0 cpanel.batika.free.netmaster.tg "https://cpanel.batika.free.netmaster.tg/?locale=da" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:160.187.221.25


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [23/Jun/2026:01:04:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051163&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782176654 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.41.50.30
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/education/page/1743523723 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.228.212.147
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/education/page/899093 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.39
country_id: 130758
description:
Jun 23 01:06:05 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.39 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.99.73.170
country_id: 3658394
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/270356128 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.91
country_id: 130758
description:
Jun 23 01:06:05 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.91 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.154
country_id: 2635167
description:
[2026-06-23 01:07:32 +0000] info [cpaneld] 5.230.133.154 NEW wcnyaruu:kcL_J2iSWmUIIDRR address=5.230.133.154,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.102
country_id: 6252001
description:
[2026-06-23 01:07:32 +0000] info [cpaneld] 64.44.59.102 NEW wcnyaruu:14oFgXWHgiM2KyOV address=64.44.59.102,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.120.198.100
country_id: 3437598
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/06/IMG-20210602-WA0045-696x928.jpg 696w, http:/togodailynews.tg/wp-content/uploads/2021/06/IMG-20210602-WA0045-696x928-225x300.jpg 225w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.255.108.21
country_id: 3932488
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-le-danses-traditionnelles-revisitees HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.230.114.42
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/oembed/1.0/embed?format=xml&url=http:/togodailynews.tg/banque-mondiale-ndiame-diop-nomme-vice-president-pour-lafrique-orientale-et-australe/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 65.110.40.90
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 65.110.40.90: 80 connections per 30 seconds to 80 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.186
country_id: 130758
description:
Jun 23 01:11:42 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.65
country_id: 130758
description:
Jun 23 01:13:34 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.172
country_id: 690791
description:
2026-06-23 01:13:23 H=([45.144.212.172]) [45.144.212.172]:59569 F=<dpr@priv8shop.com> rejected RCPT <garyconsultant@outlook.com>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 80.216.241.158
country_id: 2661886
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1754797572 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 128.1.120.236
country_id: 2921044
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/05/10a4747ed68e10029a24440c43ae0996_XL-1.jpg 698w, http:/togodailynews.tg/wp-content/uploads/2022/05/10a4747ed68e10029a24440c43ae0996_XL-1-300x186.jpg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 131.221.85.227
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/education/page/325916707 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.53.98.45
country_id: 3439705
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/oembed/1.0/embed?format=xml&url=http:/togodailynews.tg/nationale-n34-lome-vogan-anfoin-le-pm-victoire-tomegah-dogbe-en-visite-sur-le-terrain/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.68.37
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/01/PK.webp 1000w, http:/togodailynews.tg/wp-content/uploads/2026/01/PK-300x225.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/01/PK-768x576.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.51.32.207
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/06/images-1.jpeg 301w, http:/togodailynews.tg/wp-content/uploads/2022/06/images-1-300x167.jpeg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.186.93.88
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/education/page/1655507918 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.88
country_id: 130758
description:
Jun 23 01:17:37 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.88 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 93.183.142.168
country_id: 732800
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/09/IMG-20210928-WA0152-1024x768.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2021/09/IMG-20210928-WA0152-300x225.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2021/09/IMG-20210928-WA0152-768x576.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2021/09/IMG-20210928-WA0152.jpg 1040w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 131.108.143.250
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/09/WhatsApp-Image-2023-09-23-at-08.47.12.jpeg 1600w, http:/togodailynews.tg/wp-content/uploads/2023/09/WhatsApp-Image-2023-09-23-at-08.47.12-300x200.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2023/09/WhatsApp-Image-2023-09-23-at-08.47.12-1024x682.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2023/09/WhatsApp-Image-2023-09-23-at-08.47.12-768x512.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2023/09/WhatsApp-Image-2023-09-23-at-08.47.12-1536x1023.jpeg 1536w, http:/togodailynews.tg/wp-content/uploads/2023/09/WhatsApp-Image-2023-09-23-at-08.47.12-272x182.jpeg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-23 01:18:38 +0000] info [whostmgrd] 141.95.93.31 - netwhmcstg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-23 01:18:41 +0000] info [whostmgrd] 141.95.93.31 - cp909049p23 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-23 01:19:27 +0000] info [whostmgrd] 141.95.93.31 - abttogo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [23/Jun/2026:01:20:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051206&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782177626 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.169.23
country_id: 6252001
description:
Jun 23 01:20:30 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.169.23 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [23/Jun/2026:01:20:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6788503&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782177631 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.182.232.150
country_id: 1269750
description:
Jun 23 01:21:37 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.182.232.150 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.22.44.233
country_id: 241170
description:
[2026-06-23 01:22:36 +0000] info [cpaneld] 157.22.44.233 - irenee.a "POST /login/?login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user irenee.a (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.166.199.168
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/education/page/1446477270 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.152
country_id: 1880251
description:
47.128.121.152 - - [23/Jun/2026:01:22:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7443559&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fle-togo-est-gere-comme-un-butin-de-guerre%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782177767 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/le-togo-est-gere-comme-un-butin-de-guerre/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.152


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.182.232.150
country_id: 1269750
description:
Jun 23 01:22:59 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.182.232.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 96.62.4.195
country_id: 6252001
domain: snbt-togocom.snb.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/snbt-togocom.snb.tg/images/logo/logo.png HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.167.34.120
country_id: 6252001
description:
Jun 23 01:23:40 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.167.34.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.182.232.150
country_id: 1269750
description:
Jun 23 01:24:41 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.182.232.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.87
country_id: 130758
description:
Jun 23 01:25:51 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.87 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.125.248.19
country_id: 1733045
description:
27.125.248.19 - - [23/Jun/2026:01:27:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10143688&pdata=https%253A%252F%252Fcpanel.maquette-mpa.free.netmaster.tg%252F%253Flocale%253Dfil&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782178048 HTTP/2.0" 302 0 cpanel.maquette-mpa.free.netmaster.tg "https://cpanel.maquette-mpa.free.netmaster.tg/?locale=fil" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.125.248.19


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.157.41.63
country_id: 1814991
description:
Jun 23 01:28:18 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.157.41.63 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 72.63.129.225
country_id: 1861060
description:
72.63.129.225 - - [23/Jun/2026:01:28:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7236966&pdata=https%253A%252F%252Ftogomedia24.tg%252Fcategory%252Fsociete%252Fpage%252F5%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782178096 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/category/societe/page/5/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.9914.1773 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:72.63.129.225


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.22.253.223
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/12/Page-4-A.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2022/12/Page-4-A-300x168.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2022/12/Page-4-A-768x431.jpg 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.189.185.50
country_id: 1227603
description:
2026-06-23 01:27:38 dovecot_plain authenticator failed for H=(localhost) [203.189.185.50]:3392: 535 Incorrect authentication data (set_id=tps@tps.tg)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 65.110.40.177
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 65.110.40.177: 80 connections per 30 seconds to 80 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.83.4.60
country_id: 3017382
description:
[2026-06-23 01:29:51 +0000] info [cpaneld] 51.83.4.60 - cafeitadm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.136.56.244
country_id: 6252001
description:
Jun 23 01:30:04 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.136.56.244 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.87
country_id: 130758
description:
Jun 23 01:30:18 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.162
country_id: 1269750
description:
Jun 23 01:30:41 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 18.191.11.44
country_id: 6252001
description:
2026-06-23 01:30:49 dovecot_plain authenticator failed for H=ec2-18-191-11-44.us-east-2.compute.amazonaws.com (x3w7bl1qbwl9lrnmu9ca) [18.191.11.44]:54886: 535 Incorrect authentication data (set_id=supports@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.124.55.157
country_id: 3017382
description:
Jun 23 01:33:16 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.124.55.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.238.166.159
country_id: 798544
description:
Jun 23 01:33:48 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.238.166.159 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [23/Jun/2026:01:35:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9672300&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782178550 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [23/Jun/2026:01:35:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000233&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782178554 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.61.117.89
country_id: 1733045
description:
Jun 23 01:36:48 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.61.117.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.191.58.34
country_id: 1562822
description:
Jun 23 01:38:08 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.191.58.34 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.112
country_id: 1880251
description:
47.128.121.112 - - [23/Jun/2026:01:38:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065047&pdata=https%253A%252F%252Ftogomedia24.tg%252Fcategory%252Fsociete%252Fpage%252F13%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782178709 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/category/societe/page/13/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.112


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.223.112.145
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.223.112.145: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.61.218.35
country_id: 3469034
description:
Jun 23 01:37:56 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.61.218.35 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 35.80.48.160
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 35.80.48.160: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.185
country_id: 3469034
description:
Jun 23 01:39:22 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.191.58.34
country_id: 1562822
description:
Jun 23 01:38:44 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.191.58.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.101.237
country_id: 3865483
description:
Jun 23 01:38:52 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.101.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.0.202
country_id: 690791
description:
Jun 23 01:39:08 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.0.202 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 51.255.95.233
country_id: 3017382
description:
Denial of Service (DoS) attack was discovered from 51.255.95.233: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 158.94.211.154
country_id: 2750405
description:
2026-06-23 01:41:02 H=([158.94.211.154]) [158.94.211.154]:61300 F=<orlovavv@kursksmu.net> rejected RCPT <whiteway@white-ways.com>: The mail server could not deliver mail to whiteway@white-ways.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.219
country_id: 3469034
description:
Jun 23 01:45:52 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.88.33.27
country_id: 3469034
description:
Jun 23 01:47:03 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.88.33.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.113
country_id: 3469034
description:
Jun 23 01:49:09 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.80.95.91
country_id: 1562822
description:
2026-06-23 01:49:47 dovecot_plain authenticator failed for H=(localhost) [183.80.95.91]:16303: 535 Incorrect authentication data (set_id=sano.ahoga@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.136.56.244
country_id: 6252001
description:
Jun 23 01:50:39 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.136.56.244 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [23/Jun/2026:01:51:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9739673&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782179513 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [23/Jun/2026:01:51:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7115415&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782179514 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.4.194
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/oembed/1.0/embed?format=xml&url=http:/togodailynews.tg/les-grandes-decisions-du-conseil-des-ministres-du-19-fevrier-2026/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.157.112.12
country_id: 3017382
description:
45.157.112.12 - - [23/Jun/2026:01:54:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10183010&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782179656 HTTP/2.0" 302 0 www.snb.tg "https://www.google.com/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.157.112.12


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.160
country_id: 130758
description:
Jun 23 01:55:30 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.160 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 160.242.199.137
country_id: 2363686
description:
Denial of Service (DoS) attack was discovered from 160.242.199.137: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.113
country_id: 1880251
description:
47.128.121.113 - - [23/Jun/2026:01:56:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869515&pdata=https%253A%252F%252Ftogomedia24.tg%252F2019%252F07%252F08%252F2607%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782179805 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/2019/07/08/2607/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.113


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.64
country_id: 130758
description:
Jun 23 01:57:53 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 77.137.76.218
country_id: 294640
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/agroalimentaire-le-togo-et-linstitut-bresilien-daniel-franco-signent-un-partenariat-strategique HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.62.199.251
country_id: 1733045
description:
Jun 23 02:00:06 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.62.199.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.90.99.61
country_id: 3469034
description:
Jun 23 02:00:04 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.90.99.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.64
country_id: 130758
description:
Jun 23 02:00:48 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.180.191.8
country_id: 617790
description:
Jun 23 02:02:07 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.180.191.8 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 198.142.152.51
country_id: 2077456
description:
Denial of Service (DoS) attack was discovered from 198.142.152.51: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 152.59.179.152
country_id: 1269750
description:
152.59.179.152 - - [23/Jun/2026:02:04:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9857387&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782180285 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:152.59.179.152


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 198.142.152.52
country_id: 2077456
description:
Denial of Service (DoS) attack was discovered from 198.142.152.52: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 198.142.152.125
country_id: 2077456
description:
Denial of Service (DoS) attack was discovered from 198.142.152.125: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 103.153.183.69
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 103.153.183.69: 80 connections per 30 seconds to 80 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [23/Jun/2026:02:07:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6973334&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782180438 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [23/Jun/2026:02:07:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6722966&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782180449 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 65.110.40.127
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 65.110.40.127: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.253.159.85
country_id: 732800
description:
Jun 23 02:10:47 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.253.159.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.136.56.244
country_id: 6252001
description:
Jun 23 02:11:07 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.136.56.244 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.151.215.38
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/evenements-sociopolitiques-de-juin-lassemblee-nationale-recoit-un-rapport-detape-de-la-cndh HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.57.144
country_id: 1269750
description:
Jun 23 02:15:32 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.57.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.167.34.120
country_id: 6252001
description:
Jun 23 02:15:52 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.167.34.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.10.208
country_id: 3469034
description:
Jun 23 02:15:53 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.10.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.57.144
country_id: 1269750
description:
Jun 23 02:15:39 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.57.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.40.89.57
country_id: 1210997
description:
Jun 23 02:18:09 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.40.89.57 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 62.201.202.152
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/la-cedeao-rencontre-ce-mardi-la-junte-malienne-a-accra HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.50.171.167
country_id: 3439705
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/echanges-avec-les-populations-a-la-base-le-chef-de-letat-rencontre-les-forces-vives-a-kpalime-2 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.86.129.146
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/wp/v2/posts/21901 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 61.180.188.132
country_id: 1814991
description:
2026-06-23 02:22:40 H=([61.180.188.132]) [61.180.188.132]:52331 F=<home@white-ways.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.162.66.211
country_id: 6252001
description:
[2026-06-23 02:24:11 +0000] info [cpaneld] 54.162.66.211 - mpqypjjp "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mpqypjjp (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [23/Jun/2026:02:23:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10120341&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782181427 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [23/Jun/2026:02:23:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6919365&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782181426 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.222.244.181
country_id: 1269750
description:
Jun 23 02:25:05 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.222.244.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.7.154
country_id: 690791
description:
Jun 23 02:26:24 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.7.154 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.203.145.187
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/fetes-de-fin-dannee-loperation-keligou-2-activee HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 158.94.211.154
country_id: 2750405
description:
2026-06-23 02:30:55 H=([158.94.211.154]) [158.94.211.154]:51197 F=<shahina@kursksmu.net> rejected RCPT <whiteway@white-ways.com>: The mail server could not deliver mail to whiteway@white-ways.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.252.92.36
country_id: 1643084
description:
[2026-06-23 02:31:12 +0000] info [cpaneld] 180.252.92.36 - tgkkwsvr "GET /cpsess7171811163/frontend/jupiter/filemanager/editit.html?file=indexx.html&fileop=&dir=%2Fhome%2Ftgkkwsvr%2Fpublic_html&dirop=&charset=&file_charset=utf-8&baseurl=&basedir=&edit=1 HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [180.252.89.129] != Current IP Address [180.252.92.36]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [23/Jun/2026:02:32:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10263495&pdata=http%253A%252F%252Fekeasarl.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782181970 HTTP/1.1" 302 0 ekeasarl.com "http://ekeasarl.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.243.53.88
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/golfe4-le-maire-jean-pierre-fabre-rapproche-sa-commune-de-lallemagne HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [23/Jun/2026:02:37:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10144355&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782182256 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.24
country_id: 6252001
description:
205.169.39.24 - - [23/Jun/2026:02:38:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723522&pdata=http%253A%252F%252Fekeasarl.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782182316 HTTP/1.1" 302 0 ekeasarl.com "http://ekeasarl.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.24


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [23/Jun/2026:02:37:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9870493&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782182264 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.236.237.105
country_id: 3469034
description:
Jun 23 02:40:20 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.236.237.105 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.241.36.96
country_id: 248816
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/developpement-agricole-la-banque-mondiale-disposee-a-accompagner-le-togo HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.40.89.57
country_id: 1210997
description:
Jun 23 02:41:40 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.40.89.57 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.131.138.147
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/oembed/1.0/embed?url=http:/togodailynews.tg/ag-millenium-microfinance-une-sante-financiere-au-point/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.34.197
country_id: 2395170
description:
Jun 23 02:44:10 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.34.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.172
country_id: 690791
description:
2026-06-23 02:45:58 H=([45.144.212.172]) [45.144.212.172]:58473 F=<dpr@priv8shop.com> rejected RCPT <garyconsultant@outlook.com>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [23/Jun/2026:02:46:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9882014&pdata=http%253A%252F%252Fcrepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782182814 HTTP/1.1" 302 0 crepsad.tg "http://crepsad.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 87.248.238.39
country_id: 2017370
domain: www.arse.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:adminbockup||User:arsetg||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.113.113.130
country_id: 1269750
description:
Jun 23 02:50:47 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.113.113.130 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [23/Jun/2026:02:53:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6383001&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782183227 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [23/Jun/2026:02:53:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13016006&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782183227 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.120.156
country_id: 3865483
description:
Jun 23 02:54:23 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.120.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.120.156
country_id: 3865483
description:
Jun 23 02:54:38 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.120.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.9.92
country_id: 597427
description:
2026-06-23 02:58:27 dovecot_plain authenticator failed for H=([141.98.9.92]) [141.98.9.92]:50297: 535 Incorrect authentication data (set_id=itra@cafe.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 204.101.161.15
country_id: 6251999
description:
204.101.161.15 - - [23/Jun/2026:02:57:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9858970&pdata=https%253A%252F%252Fmail.tensai.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782183471 HTTP/2.0" 302 0 mail.tensai.tg "https://mail.tensai.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:204.101.161.15


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.9.92
country_id: 597427
description:
Jun 23 02:58:25 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.9.92 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 141.98.9.92
country_id: 597427
description:
Jun 23 02:58:41 ns5 pure-ftpd[2942533]: (?@141.98.9.92) [WARNING] Authentication failed for user [itra]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 3.228.172.16
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 3.228.172.16: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.124.234.108
country_id: 6252001
description:
Jun 23 03:03:33 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.124.234.108 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 3.228.172.122
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 3.228.172.122: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.236.237.105
country_id: 3469034
description:
Jun 23 03:03:03 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.236.237.105 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 64.49.38.227
country_id: 6252001
description:
64.49.38.227 - - [23/Jun/2026:03:04:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13408670&pdata=https%253A%252F%252Fcafe.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782183868 HTTP/2.0" 302 0 cafe.tg "https://cafe.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:64.49.38.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.122.162
country_id: 226074
description:
Jun 23 03:03:54 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.122.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.77.175.32
country_id: 3017382
description:
Jun 23 03:03:59 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.77.175.32 has been locked due to Imunify RBL


plugin: modsec
rule: 77705892
name: IM360 WAF: Tracking new fake-admin WordPress username candidate (WPT-2545 baseline)
abuser: 176.194.17.184
country_id: 2017370
domain: www.afriquerevelation.tg
description:
IM360 WAF: Tracking new fake-admin WordPress username candidate (WPT-2545 baseline)||MV:adm1n||MVN:ARGS:log||WPU:adm1n||User:glfmqhlj||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 193.22.231.109
country_id: 2017370
domain: www.afriquerevelation.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:adminbockup||User:glfmqhlj||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.171.227.7
country_id: 6252001
description:
Jun 23 03:04:40 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.171.227.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.111.208.130
country_id: 719819
description:
Jun 23 03:08:39 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.111.208.130 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [23/Jun/2026:03:09:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10315628&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782184140 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [23/Jun/2026:03:09:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12948633&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782184140 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 99.225.252.242
country_id: 6251999
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/wp-content/uploads/2014/11/R\xc3\xa9sultat_Lot3.pdf HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.121.176.168
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/electricite-la-ceet-annonce-des-perturbations-cette-semaine-a-lome/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.74
country_id: 130758
description:
Jun 23 03:15:13 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.74 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 146.70.65.191
country_id: 2328926
description:
146.70.65.191 - - [23/Jun/2026:03:19:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6474605&pdata=https%253A%252F%252F_dc-mx.181a5c4be146.cndh-togo.org&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782184764 HTTP/2.0" 302 0 _dc-mx.181a5c4be146.cndh-togo.org "https://_dc-mx.181a5c4be146.cndh-togo.org/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:146.70.65.191


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 36.152.7.105
country_id: 1814991
domain: cafe.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=2340||QS:add-to-cart=2340||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77705892
name: IM360 WAF: Tracking new fake-admin WordPress username candidate (WPT-2545 baseline)
abuser: 187.102.82.201
country_id: 3469034
domain: www.butodra.tg
description:
IM360 WAF: Tracking new fake-admin WordPress username candidate (WPT-2545 baseline)||MV:adm1n||MVN:ARGS:log||WPU:adm1n||User:vefzejhd||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.114.73.95
country_id: 1562822
description:
Jun 23 03:23:49 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.114.73.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.114.73.95
country_id: 1562822
description:
2026-06-23 03:23:51 dovecot_plain authenticator failed for H=(localhost) [42.114.73.95]:24223: 535 Incorrect authentication data (set_id=kido@cafe.tg)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 65.110.40.157
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 65.110.40.157: 80 connections per 30 seconds to 80 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 208.84.100.106
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 208.84.100.106: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.43.230.237
country_id: 798544
description:
Jun 23 03:24:31 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.43.230.237 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [23/Jun/2026:03:24:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12806083&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782185077 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [23/Jun/2026:03:24:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9684892&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782185090 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Edge/12.246" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [23/Jun/2026:03:25:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9870739&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782185125 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Edge/12.246" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.43.230.237
country_id: 798544
description:
Jun 23 03:24:44 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.43.230.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.160
country_id: 130758
description:
Jun 23 03:25:18 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.160 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [23/Jun/2026:03:24:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13200797&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782185075 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 46.201.22.153
country_id: 690791
description:
46.201.22.153 - - [23/Jun/2026:03:26:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791899&pdata=https%253A%252F%252Fsproca.tg%253A2083%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782185186 HTTP/2.0" 302 0 sproca.tg "https://sproca.tg:2083/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:46.201.22.153


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.236.237.105
country_id: 3469034
description:
Jun 23 03:25:38 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.236.237.105 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.201.22.153
country_id: 690791
description:
[2026-06-23 03:26:34 +0000] info [cpaneld] 46.201.22.153 - sprocaadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.166
country_id: 3469034
description:
Jun 23 03:28:46 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.48.78.242
country_id: 6252001
description:
Jun 23 03:28:57 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.48.78.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.64
country_id: 130758
description:
Jun 23 03:29:15 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.64
country_id: 130758
description:
Jun 23 03:32:07 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.174.53.171
country_id: 6252001
description:
Jun 23 03:31:40 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.174.53.171 has been locked due to Imunify RBL


plugin: modsec
rule: 77317977
name: IM360 WAF: Sensitive Information Disclosure in OptinMonster plugin for WordPress (CVE-2021-39341)
abuser: 103.164.183.114
country_id: 1831722
domain: togomedia24.tg
description:
IM360 WAF: Sensitive Information Disclosure in OptinMonster plugin for WordPress (CVE-2021-39341)||RSV:8.19||T:APACHE||User:ecukpqcm||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.185
country_id: 2635167
description:
[2026-06-23 03:35:18 +0000] info [cpaneld] 5.230.153.185 NEW wgqhqbem:sadeDwe0CnLymwLA address=5.230.153.185,app=cpaneld,creator=wgqhqbem,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.112.179.35
country_id: 3469034
description:
Jun 23 03:35:56 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.112.179.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.129.127.244
country_id: 1562822
description:
2026-06-23 03:37:31 dovecot_plain authenticator failed for H=(fhhutx4z4kes452o320s3c2dxzlv) [103.129.127.244]:36110: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.129.127.244
country_id: 1562822
description:
Jun 23 03:37:29 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.129.127.244 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.181.215.118
country_id: 3469034
description:
Jun 23 03:38:45 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.181.215.118 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.249.174.110
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2019/08/IMG-20190831-WA0001.jpg HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 103.164.183.114
country_id: 1831722
description:
[2026-06-23 03:43:51 +0000] info [cpaneld] 103.164.183.114 NEW ecukpqcm:cPQCusMbqTBDy3LJ address=103.164.183.114,app=cpaneld,creator=ecukpqcm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.129.64.170
country_id: 6252001
description:
Jun 23 03:43:51 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.129.64.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.129.64.170
country_id: 6252001
description:
2026-06-23 03:43:53 dovecot_plain authenticator failed for H=(sivs0nx4yx4nbfn712668hlhr6h) [23.129.64.170]:5697: 535 Incorrect authentication data (set_id=mesys@mesyscom.com)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 207.241.173.226
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 207.241.173.226: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.197.171
country_id: 1880251
description:
Jun 23 03:47:50 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.245.197.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.236.237.105
country_id: 3469034
description:
Jun 23 03:48:05 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.236.237.105 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [23/Jun/2026:03:54:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053828&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782186875 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 116.204.162.171
country_id: 1149361
description:
2026-06-23 03:57:37 H=([116.204.162.171]) [116.204.162.171]:63504 F=<prakash@white-ways.com> rejected RCPT <prakash@white-ways.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.36.236
country_id: 2395170
description:
Jun 23 03:57:19 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.36.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.124.55.157
country_id: 3017382
description:
Jun 23 03:58:14 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.124.55.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.20.97.192
country_id: 1562822
description:
Jun 23 04:00:59 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.20.97.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.61.117.89
country_id: 1733045
description:
Jun 23 04:02:29 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.61.117.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.93.30.90
country_id: 1269750
description:
Jun 23 04:05:16 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.93.30.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.197.171
country_id: 1880251
description:
Jun 23 04:09:32 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.245.197.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 116.204.162.171
country_id: 1149361
description:
2026-06-23 04:09:15 H=([116.204.162.171]) [116.204.162.171]:57196 F=<prakash@white-ways.com> rejected RCPT <prakash@white-ways.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.236.237.105
country_id: 3469034
description:
Jun 23 04:10:37 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.236.237.105 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 149.88.106.186
country_id: 1880251
description:
Denial of Service (DoS) attack was discovered from 149.88.106.186: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [23/Jun/2026:04:10:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13278567&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782187829 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [23/Jun/2026:04:10:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13081034&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782187828 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.79
country_id: 3175395
description:
Jun 23 04:10:36 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-23 04:14:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:41302: 535 Incorrect authentication data (set_id=gn)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 23 04:13:59 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.100.91.113
country_id: 1814991
description:
Jun 23 04:13:56 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.100.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-23 04:14:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:11900: 535 Incorrect authentication data (set_id=lgomez)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.117.105.7
country_id: 1814991
description:
Jun 23 04:13:49 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.117.105.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 23 04:13:58 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.191.58.34
country_id: 1562822
description:
Jun 23 04:13:36 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.191.58.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-23 04:14:07 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:40734: 535 Incorrect authentication data (set_id=user)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 23 04:14:05 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 23 04:14:09 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 23 04:14:15 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.87
country_id: 130758
description:
Jun 23 04:14:17 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-23 04:14:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:3706: 535 Incorrect authentication data (set_id=lgomez)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 23 04:14:20 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.191.58.34
country_id: 1562822
description:
Jun 23 04:14:11 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.191.58.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.225.52.111
country_id: 290557
description:
Jun 23 04:14:33 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.225.52.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-23 04:14:43 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:26996: 535 Incorrect authentication data (set_id=lydia)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 158.69.117.34
country_id: 6251999
domain: dev.centif.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.19||T:APACHE||MV:/wp-json/wp/v2/users/5?_fields=id,slug,roles||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-23 04:14:05 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:42578: 535 Incorrect authentication data (set_id=cockpit)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 23 04:14:24 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-23 04:14:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:55232: 535 Incorrect authentication data (set_id=trouble)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.13.7.239
country_id: 1814991
description:
Jun 23 04:14:27 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.13.7.239 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.76.197.46
country_id: 1819730
description:
Jun 23 04:14:31 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.76.197.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.66.155.73
country_id: 1880251
description:
Jun 23 04:14:03 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.66.155.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-23 04:14:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:39138: 535 Incorrect authentication data (set_id=kurs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-23 04:14:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:48360: 535 Incorrect authentication data (set_id=fond)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 23 04:14:41 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.66.155.73
country_id: 1880251
description:
Jun 23 04:15:01 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.66.155.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 23 04:15:02 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 23 04:15:06 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-23 04:15:08 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:30818: 535 Incorrect authentication data (set_id=es-nexus)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2026-06-23 04:15:30 dovecot_login authenticator failed for H=(customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:52818: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-06-23 04:15:25 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:44496: 535 Incorrect authentication data (set_id=scan@togosem.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-23 04:15:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:46434: 535 Incorrect authentication data (set_id=milan)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.76
country_id: 1643084
description:
[2026-06-23 04:15:06 +0000] info [cpaneld] 185.213.83.76 - mpqypjjp "GET / HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.6
country_id: 290557
description:
2026-06-23 04:15:38 dovecot_login authenticator failed for H=([5.32.107.6]) [5.32.107.6]:56295: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.153.138
country_id: 1819730
description:
Jun 23 04:15:36 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.153.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.255.62.89
country_id: 6252001
description:
Jun 23 04:15:01 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.255.62.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 87.192.224.131
country_id: 1512440
domain: dev.centif.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.19||T:APACHE||MV:/wp-json/wp/v2/users/6?_fields=id,slug,roles||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 23 04:15:08 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 158.69.117.34
country_id: 6251999
domain: dev.centif.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.19||T:APACHE||MV:/wp-json/wp/v2/users/7?_fields=id,slug,roles||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-23 04:15:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:62390: 535 Incorrect authentication data (set_id=spa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-06-23 04:15:29 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:38636: 535 Incorrect authentication data (set_id=scan@togosem.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-23 04:15:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:56336: 535 Incorrect authentication data (set_id=stable)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-23 04:15:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:44106: 535 Incorrect authentication data (set_id=home1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 23 04:15:26 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.138
country_id: 1819730
description:
2026-06-23 04:15:38 dovecot_login authenticator failed for H=(223-197-153-138.static.imsbiz.com) [223.197.153.138]:57098: 535 Incorrect authentication data (set_id=scan@togosem.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
country_id: 1835841
description:
2026-06-23 04:15:43 dovecot_login authenticator failed for H=([175.206.113.91]) [175.206.113.91]:43992: 535 Incorrect authentication data (set_id=scan@togosem.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.252.100.51
country_id: 6252001
description:
Jun 23 04:15:05 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.252.100.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 23 04:15:38 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.113.91
country_id: 1835841
description:
Jun 23 04:15:41 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.113.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.228.113.27
country_id: 1835841
description:
Jun 23 04:15:48 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.228.113.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-23 04:15:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:24076: 535 Incorrect authentication data (set_id=latest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.159.90.127
country_id: 2750405
description:
2026-06-23 04:15:14 dovecot_login authenticator failed for H=(ADMIN) [203.159.90.127]:42980: 535 Incorrect authentication data (set_id=mailer-daemon@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-06-23 04:15:50 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:42536: 535 Incorrect authentication data (set_id=scan@togosem.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.59.202.241
country_id: 149590
description:
Jun 23 04:15:27 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.59.202.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.55.89.5
country_id: 1269750
description:
Jun 23 04:15:23 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.55.89.5 has been locked due to Imunify RBL


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 103.127.30.137
country_id: 1269750
domain: dev.centif.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.19||T:APACHE||MV:/wp-json/wp/v2/users/8?_fields=id,slug,roles||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 23 04:15:02 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.159.90.127
country_id: 2750405
description:
Jun 23 04:15:12 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.159.90.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-23 04:16:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:10514: 535 Incorrect authentication data (set_id=tsm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.48.78.242
country_id: 6252001
description:
Jun 23 04:16:58 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.48.78.242 has been locked due to Imunify RBL


plugin: ossec
rule: 11019
name: WHM session loaded via API from external IP
abuser: 203.147.139.82
country_id: 1831722
description:
[2026-06-23 04:17:59 +0000] info [whostmgrd] 203.147.139.82 NEW root:UeI0YBFRuiMrmSWf address=203.147.139.82,app=whostmgrd,creator=root,method=handle_form_login,path=loadsession:root:RhIAyXKfjtzgSJi1:create_user_session,possessed=0


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 95.167.183.174
country_id: 2017370
description:
2026-06-23 04:17:23 H=([95.167.183.174]) [95.167.183.174]:32877 F=<home@white-ways.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 95.167.183.174
country_id: 2017370
description:
2026-06-23 04:18:59 H=([95.167.183.174]) [95.167.183.174]:26592 F=<home@white-ways.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.57
country_id: 1643084
description:
[2026-06-23 04:21:41 +0000] info [cpaneld] 103.65.237.57 - 2083primuscourtiertg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.77
country_id: 3175395
description:
Jun 23 04:23:18 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.77 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [23/Jun/2026:04:23:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9987478&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782188604 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.89.211.130
country_id: 3469034
description:
Jun 23 04:24:39 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.89.211.130 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 171.25.193.39
country_id: 2661886
description:
171.25.193.39 - - [23/Jun/2026:04:26:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10339222&pdata=https%253A%252F%252Fwebdisk.tensai.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782188810 HTTP/2.0" 302 0 webdisk.tensai.tg "https://webdisk.tensai.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:171.25.193.39


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.137.212.23
country_id: 2750405
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:04-28.45.137.212.23||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [23/Jun/2026:04:29:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7235440&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782188952 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Edge/12.246" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [23/Jun/2026:04:29:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6853269&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782188942 HTTP/2.0" 404 561 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Edge/12.246" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-23 04:29:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:37930: 535 Incorrect authentication data (set_id=instinct)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-23 04:29:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:50598: 535 Incorrect authentication data (set_id=terrance)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-23 04:29:16 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:14793: 535 Incorrect authentication data (set_id=bs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-23 04:29:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:14074: 535 Incorrect authentication data (set_id=operator02)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 23 04:29:37 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 23 04:29:52 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 23 04:29:33 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.57.200.119
country_id: 1835841
description:
Jun 23 04:29:12 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.57.200.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.186.103
country_id: 6252001
description:
Jun 23 04:29:18 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.186.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 23 04:29:49 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.135.167.80
country_id: 6252001
description:
Jun 23 04:29:41 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.135.167.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-23 04:29:54 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:42920: 535 Incorrect authentication data (set_id=warning)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 23 04:29:14 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 179.43.170.186
country_id: 2658434
domain: cafe.tg
description:
IM360 WAF: Track file upload for Infectors||RSV:8.19||T:APACHE||SC:/home/cafetg/public_html/wp-json||User:cafetg||WPU:||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [23/Jun/2026:04:29:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9727076&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782188988 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Edge/12.246" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.255.62.89
country_id: 6252001
description:
Jun 23 04:29:32 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.255.62.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-23 04:29:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:16550: 535 Incorrect authentication data (set_id=siva)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.168.71.135
country_id: 798544
description:
Jun 23 04:29:38 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.168.71.135 has been locked due to Imunify RBL


plugin: modsec
rule: 77350391
name: IM360 WAF: Interaction with fake plugin
abuser: 179.43.170.186
country_id: 2658434
domain: cafe.tg
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pods/pods.php||WPU:||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.65
country_id: 130758
description:
Jun 23 04:29:15 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 23 04:29:36 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-23 04:29:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:60122: 535 Incorrect authentication data (set_id=chernandez)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.197.171
country_id: 1880251
description:
Jun 23 04:31:12 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.245.197.171 has been locked due to Imunify RBL


plugin: modsec
rule: 77625155
name: IM360 WAF: Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.3.3 RCE (CVE-2020-12800)
abuser: 179.43.170.186
country_id: 2658434
domain: cafe.tg
description:
IM360 WAF: Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.3.3 RCE (CVE-2020-12800)||RSV:8.19||T:APACHE||MVN:FILES:upload-file||MV:mconfig.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.162.21.253
country_id: 3865483
description:
Jun 23 04:31:21 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.162.21.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.190.192.7
country_id: 1814991
description:
Jun 23 04:31:26 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.190.192.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.124.66
country_id: 690791
description:
Jun 23 04:31:41 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.124.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.236.237.105
country_id: 3469034
description:
Jun 23 04:33:05 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.236.237.105 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.145.128.230
country_id: 294640
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:45.145.128.230||TA:45.145.128.230||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.13.147
country_id: 3469034
description:
Jun 23 04:36:01 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.13.147 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [23/Jun/2026:04:37:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10380697&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782189433 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [23/Jun/2026:04:37:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10316907&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782189427 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.154.162.73
country_id: 6252001
description:
Jun 23 04:37:56 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.154.162.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.162.73
country_id: 6252001
description:
2026-06-23 04:37:58 dovecot_plain authenticator failed for H=(w2x86gngtw3pvga6ef06ggbe) [165.154.162.73]:50373: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 64.89.162.172
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 64.89.162.172: 80 connections per 30 seconds to 80 port.


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 173.211.88.116
country_id: 6252001
description:
[2026-06-23 04:41:23 +0000] info [cpaneld] 173.211.88.116 NEW wgqhqbem:AHn089U8eQE17bbN address=173.211.88.116,app=cpaneld,creator=wgqhqbem,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.140.249.111
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:45.140.249.111||TA:45.140.249.111||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.57
country_id: 1643084
description:
[2026-06-23 04:44:59 +0000] info [cpaneld] 103.65.237.57 - 2083einguval "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.14.134
country_id: 1269750
description:
2026-06-23 04:46:29 dovecot_login authenticator failed for H=(nsg-static-241.106.76.182-airtel.com) [182.75.14.134]:45308: 535 Incorrect authentication data (set_id=info@golfe3.mairie.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.75.14.134
country_id: 1269750
description:
Jun 23 04:46:27 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.75.14.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.112.179.35
country_id: 3469034
description:
Jun 23 04:47:06 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.112.179.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 23 04:48:46 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-23 04:48:48 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:17153: 535 Incorrect authentication data (set_id=bowman)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.74
country_id: 130758
description:
Jun 23 04:51:01 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.167.34.120
country_id: 6252001
description:
Jun 23 04:51:59 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.167.34.120 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 148.113.166.150
country_id: 6251999
domain: ucao-uut.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/91.0.4472.77 Safari/537.36||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [23/Jun/2026:04:52:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10458821&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782190367 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 173.239.198.85
country_id: 6252001
description:
173.239.198.85 - - [23/Jun/2026:04:53:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6646376&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782190393 HTTP/2.0" 302 0 www.snb.tg "https://www.google.com/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:173.239.198.85


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.72.170.21
country_id: 2233387
domain: derou.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/derou.tg/fr/slides/10 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [23/Jun/2026:04:52:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935258&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782190361 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.160
country_id: 130758
description:
Jun 23 04:54:23 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.160 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.192.144.107
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.192.144.107: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.251.52.80
country_id: 1269750
domain: besteva1.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:35134.besteva1.com||ServerName:besteva1.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:29b7b512d67202825bf9c8e3fb903b8e473b2df5||Title:caliqvswb9a87w01ra||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 23 04:55:38 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.236.237.105
country_id: 3469034
description:
Jun 23 04:55:44 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.236.237.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-23 04:55:40 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:59087: 535 Incorrect authentication data (set_id=sanu)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 208.84.101.116
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 208.84.101.116: 80 connections per 30 seconds to 80 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.64
country_id: 130758
description:
Jun 23 04:58:50 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.30.129.29
country_id: 2510769
description:
Jun 23 04:59:50 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.30.129.29 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 208.84.100.136
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 208.84.100.136: 80 connections per 30 seconds to 80 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.57
country_id: 1643084
description:
[2026-06-23 05:02:11 +0000] info [cpaneld] 103.65.237.57 - 2083myxlsnta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.124.234.108
country_id: 6252001
description:
Jun 23 05:02:20 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.124.234.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.64
country_id: 130758
description:
Jun 23 05:01:47 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 23 05:02:55 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-23 05:02:57 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:14559: 535 Incorrect authentication data (set_id=gu)


