# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.62.8.163
country_id: 1269750
description:
Jun 15 16:16:40 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.62.8.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:16:50 dovecot_login authenticator failed for H=(ygn3gQ) [141.98.10.175]:53047: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.51.212.130
country_id: 3469034
description:
Jun 15 16:18:05 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.51.212.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.51.212.130
country_id: 3469034
description:
2026-06-15 16:18:07 dovecot_login authenticator failed for H=([186.239.254.4]) [187.51.212.130]:35089: 535 Incorrect authentication data (set_id=partners@soena.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:17:47 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:17:19 dovecot_login authenticator failed for H=(u2AEjdPm) [141.98.10.175]:60454: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.12.27
country_id: 2017370
description:
2026-06-15 16:18:28 dovecot_login authenticator failed for H=([219.159.57.4]) [31.173.12.27]:37524: 535 Incorrect authentication data (set_id=felix.barigao@arse.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 192.42.116.48
country_id: 2750405
description:
192.42.116.48 - zauwogvk [15/Jun/2026:16:20:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065765&pdata=https%253A%252F%252Fscafricaplc.com%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781540451 HTTP/2.0" 302 0 scafricaplc.com "https://scafricaplc.com:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:192.42.116.48


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:16:22:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.176.233.150
country_id: 3686110
description:
[2026-06-15 16:22:52 +0000] info [cpaneld] 45.176.233.150 - mesys "GET /login/?login_only=1&user=mesys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesys (has_cpuser_file failed)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:16:22:54 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:16:22:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:16:22:52 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:16:23:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842262&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781540627 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:16:23:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10120606&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781540624 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:16:24:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000540&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781535407 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 45.237.57.100
country_id: 3469034
description:
45.237.57.100 - - [15/Jun/2026:16:24:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000540&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781535407 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 Edg/148.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.237.57.100


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-15 16:26:04 +0000] info [webmaild] 196.171.46.177 - direction@togointerim.net "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.72.198.167
country_id: 1210997
description:
103.72.198.167 - - [15/Jun/2026:16:26:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6657223&pdata=https%253A%252F%252Fmacite.tg%252F2025%252F01%252F28%252Ffoot-2025-le-tirage-au-sort-place-la-cote-divoire-et-le-cameroun-dans-la-poule-f%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781540786 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2025/01/28/foot-2025-le-tirage-au-sort-place-la-cote-divoire-et-le-cameroun-dans-la-poule-f/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.5362.1951 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.72.198.167


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:16:26:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000540&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781535407 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:28:47 dovecot_login authenticator failed for H=(KrErCUWhtc) [141.98.10.175]:56071: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:28:45 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:29:20 dovecot_login authenticator failed for H=(nKrCa2Psn) [141.98.10.175]:62165: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:29:49 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 16:29:49 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:57398: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:30:25 dovecot_login authenticator failed for H=(QAvRHQ8) [141.98.10.175]:58199: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:30:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.125.223.238
country_id: 3469034
domain: ns5.netmaster.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ns5.netmaster.tg/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.58.39.242
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/08/t\xc3\xa9l\xc3\xa9chargement-7.jpeg HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - kagbekoh@davakconsulting.com [06/15/2026:16:32:00 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: kagbekoh@davakconsulting.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:31:23 dovecot_login authenticator failed for H=(jVTrqwnx) [141.98.10.175]:53004: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:31:21 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:32:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:32:24 dovecot_login authenticator failed for H=(BbU25rH) [141.98.10.175]:65262: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 45.237.57.100
country_id: 3469034
description:
45.237.57.100 - - [15/Jun/2026:16:34:06 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000540&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781535407" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 Edg/148.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.237.57.100


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:33:29 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 45.237.57.100
country_id: 3469034
description:
45.237.57.100 - - [15/Jun/2026:16:34:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000540&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781535407 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 Edg/148.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.237.57.100


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:33:31 dovecot_login authenticator failed for H=(IdoxMUMYnp) [141.98.10.175]:61510: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:34:39 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - e.senahounvo@davakconsulting.com [06/15/2026:16:34:48 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: e.senahounvo@davakconsulting.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:34:41 dovecot_login authenticator failed for H=(YteMv2oOu) [141.98.10.175]:59183: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 66.245.221.41
country_id: 1861060
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.17||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/antasadmin/public_html/owa/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:36:09 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:36:11 dovecot_login authenticator failed for H=(O3Tr3DS3) [141.98.10.175]:61465: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.104.244.165
country_id: 6251999
domain: construction.sia-togo.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.17||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/qfaclpeg/public_html/construction/wp-content||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.169
country_id: 1880251
description:
47.128.121.169 - - [15/Jun/2026:16:36:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6853991&pdata=https%253A%252F%252Fdirect7.tg%252Ftag%252Flions-club%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781541415 HTTP/2.0" 302 0 direct7.tg "https://direct7.tg/tag/lions-club/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.169


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:36:38 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:36:40 dovecot_login authenticator failed for H=(PmuoyO4dr) [141.98.10.175]:51602: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - kagbekoh@davakconsulting.com [06/15/2026:16:37:49 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: kagbekoh@davakconsulting.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:37:41 dovecot_login authenticator failed for H=(gcciDWMf) [141.98.10.175]:49193: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:37:39 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - e.senahounvo@davakconsulting.com [06/15/2026:16:38:37 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: e.senahounvo@davakconsulting.com


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:16:39:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:16:39:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:38:35 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:16:39:08 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:16:39:11 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:38:37 dovecot_login authenticator failed for H=(j0OEWG4LZ) [141.98.10.175]:61494: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:16:38:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13002134&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781541508 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:16:38:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10261867&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781541511 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:39:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:39:35 dovecot_login authenticator failed for H=(rxaM5v5) [141.98.10.175]:56470: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - e.gbevon@davakconsulting.com [06/15/2026:16:41:06 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: e.gbevon@davakconsulting.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:40:37 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:40:39 dovecot_login authenticator failed for H=(q6geNVUp7) [141.98.10.175]:53596: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.155.237.108
country_id: 1835841
description:
2026-06-15 16:41:00 dovecot_login authenticator failed for H=([182.95.230.122]) [221.155.237.108]:34684: 535 Incorrect authentication data (set_id=elogdoyoih@otr.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.155.237.108
country_id: 1835841
description:
Jun 15 16:40:58 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.155.237.108 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - kagbekoh@davakconsulting.com [06/15/2026:16:41:48 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: kagbekoh@davakconsulting.com


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-15 16:42:18 +0000] info [webmaild] 196.171.46.177 - sandra.amana@togointerim.net "POST /cpsess0889713981/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.169.24.13] != Current IP Address [196.171.46.177]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:41:20 dovecot_login authenticator failed for H=(PHKhfy05) [141.98.10.175]:63236: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:41:51 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.203
country_id: 1880251
description:
47.128.96.203 - - [15/Jun/2026:16:41:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13211538&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fafro-global-connect%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781541678 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/afro-global-connect/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.203


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 206.232.1.22
country_id: 6252001
domain: sp-eau.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:16-41.206.232.1.22||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.153
country_id: 1880251
description:
47.128.96.153 - - [15/Jun/2026:16:41:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9881241&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Futilisation-des-eleves-pour-des-travaux-champetres-et-autres-corvees%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781541706 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/utilisation-des-eleves-pour-des-travaux-champetres-et-autres-corvees/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.153


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-06-15 16:42:22 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:51506: 535 Incorrect authentication data (set_id=partners@dany2.mairie.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:42:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:42:24 dovecot_login authenticator failed for H=(4GSs38gHr) [141.98.10.175]:62160: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.184
country_id: 1880251
description:
47.128.96.184 - - [15/Jun/2026:16:43:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051925&pdata=https%253A%252F%252Ftdn.tg%252Finades-formation-togo-recrute-comptable%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781541797 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/inades-formation-togo-recrute-comptable/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.184


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.93.6.230
country_id: 1814991
description:
Jun 15 16:42:20 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.93.6.230 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - e.senahounvo@davakconsulting.com [06/15/2026:16:43:58 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: e.senahounvo@davakconsulting.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:43:20 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:43:22 dovecot_login authenticator failed for H=(Qan70njBa) [141.98.10.175]:58954: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.148
country_id: 1643084
description:
[2026-06-15 16:43:28 +0000] info [cpaneld] 185.213.83.148 - e.sanvee "GET / HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.185
country_id: 1880251
description:
47.128.96.185 - - [15/Jun/2026:16:44:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10249582&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvehicules-blindes-de-roch-kabore-cribles-de-balles%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781541873 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/vehicules-blindes-de-roch-kabore-cribles-de-balles/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.185


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:44:25 dovecot_login authenticator failed for H=(Hkl50wO6D) [141.98.10.175]:57087: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 16:44:25 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:35214: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 104.232.222.55
country_id: 2802361
domain: www.direct7.tg
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 13; XQ-BC72 Build/61.2.A.0.472A; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/118.0.0.0 Mobile Safari/537.36 trill_310804 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/trill app_version/31.8.4 ByteLocale/zh-TW ByteFullLocale/zh-Hant-TW Region/TW AppId/1180 Spark/1.4.3-alpha.5 AppVersion/31.8.4 BytedanceWebview/d8a21c6||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 160.155.242.22
country_id: 2287781
domain: www.direct7.tg
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (iPhone; CPU iPhone OS 26_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 Safari/604.1 musical_ly_45.5.0 BytedanceWebview/d8a21c6||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:44:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:45:54 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:45:56 dovecot_login authenticator failed for H=(UugqjEZ) [141.98.10.175]:59933: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - e.senahounvo@davakconsulting.com [06/15/2026:16:47:18 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: e.senahounvo@davakconsulting.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:46:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:46:28 dovecot_login authenticator failed for H=(vMYRm8G) [141.98.10.175]:49627: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:47:29 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:47:31 dovecot_login authenticator failed for H=(04B6OS3) [141.98.10.175]:62675: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:48:32 dovecot_login authenticator failed for H=(syTaonOH) [141.98.10.175]:59217: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:48:30 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:49:34 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:49:36 dovecot_login authenticator failed for H=(IEsHjxmWS) [141.98.10.175]:56297: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:50:37 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:50:39 dovecot_login authenticator failed for H=(qdAkLrebF) [141.98.10.175]:53684: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:51:29 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:51:31 dovecot_login authenticator failed for H=(7w6DWoV) [141.98.10.175]:64521: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:16:52:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:16:53:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7235733&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781542378 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:16:52:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:16:52:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054812&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781542378 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:16:53:00 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:52:24 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.15.40.56
country_id: 1643084
description:
[2026-06-15 16:52:45 +0000] info [cpaneld] 157.15.40.56 - mesyscom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:52:26 dovecot_login authenticator failed for H=(tyMiMcv) [141.98.10.175]:59215: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:16:52:56 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:53:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 222.83.252.34
country_id: 1814991
domain: misstogo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:16-53.222.83.252.34||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:53:28 dovecot_login authenticator failed for H=(2Pla1Lo) [141.98.10.175]:55399: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.225
country_id: 2635167
description:
[2026-06-15 16:53:28 +0000] info [cpaneld] 5.230.133.225 NEW wcnyaruu:KHtXEOL4r3LCeSC6 address=5.230.133.225,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 222.83.252.34
country_id: 1814991
domain: macite.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:16-54.222.83.252.34||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:54:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:54:25 dovecot_login authenticator failed for H=(Hi4oihDvr) [141.98.10.175]:50097: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:55:51 dovecot_login authenticator failed for H=(T6MbEd9) [141.98.10.175]:53177: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-15 16:55:34 +0000] info [webmaild] 160.242.195.10 - mbataka@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.111.114
country_id: 3469034
description:
Jun 15 16:55:44 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.111.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:55:49 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:56:21 dovecot_login authenticator failed for H=(YWsF0P42NW) [141.98.10.175]:56250: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:56:19 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.12.86.29
country_id: 690791
description:
Jun 15 16:56:51 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.12.86.29 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.83.255.232
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:172.83.255.232||TA:172.83.255.232||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-15 16:57:40 +0000] info [webmaild] 160.242.195.10 - ydoni@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:57:22 dovecot_login authenticator failed for H=(KMuJugCBz) [141.98.10.175]:49581: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:57:20 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:58:37 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:58:39 dovecot_login authenticator failed for H=(tLjC7Hx) [141.98.10.175]:58368: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.203.12.19
country_id: 3996063
domain: tdn.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tg/togo-tableau-2024-onmt/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.203.12.19
country_id: 3996063
domain: tdn.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tghttp/tdn.tg/togo-tableau-2024-onmt/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-15 16:59:29 +0000] info [webmaild] 160.242.195.10 - ydoni@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:59:39 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:59:41 dovecot_login authenticator failed for H=(EC3Kvlb) [141.98.10.175]:54910: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:00:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:00:35 dovecot_login authenticator failed for H=(83VTnqWh) [141.98.10.175]:60406: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 38.25.17.107
country_id: 3932488
domain: www.dagl.tg
description:
IM360 WAF: Bad file extension||RSV:8.17||T:APACHE||MVN:REQUEST_FILENAME||MV:/communes/www.lomegolfe3.com||User:myxlsnta||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:01:36 dovecot_login authenticator failed for H=(4lTSWb4IL) [141.98.10.175]:49236: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:01:34 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 213.32.21.59
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:17-02.213.32.21.59||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:02:28 dovecot_login authenticator failed for H=(yy6sqlyzP) [141.98.10.175]:60149: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:02:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:03:44 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.233.190
country_id: 1835841
description:
2026-06-15 17:04:18 dovecot_login authenticator failed for H=([106.10.69.50]) [183.108.233.190]:57457: 535 Incorrect authentication data (set_id=accounting@armp.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.108.233.190
country_id: 1835841
description:
Jun 15 17:04:16 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.108.233.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:03:46 dovecot_login authenticator failed for H=(0hwtIcjhP) [141.98.10.175]:57762: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.145
country_id: 1269750
description:
Jun 15 17:04:30 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.145 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.145
country_id: 1269750
description:
2026-06-15 17:04:32 dovecot_login authenticator failed for H=([122.187.227.145]) [122.187.227.145]:48701: 535 Incorrect authentication data (set_id=accounting@white-ways.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 15.235.140.141
country_id: 1880251
description:
Jun 15 17:04:37 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 15.235.140.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.203.25.248
country_id: 6251999
description:
Jun 15 17:04:38 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.203.25.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.36.234.156
country_id: 1835841
description:
Jun 15 17:05:12 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.36.234.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:04:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:04:33 dovecot_login authenticator failed for H=(jXvvE3pIS) [141.98.10.175]:61584: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 15.235.140.141
country_id: 1880251
description:
2026-06-15 17:04:39 dovecot_plain authenticator failed for H=vps-be8d03b3.vps.ovh.ca (dirrbkw10oibmsqc0o90rcdruh357q5) [15.235.140.141]:52564: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 82.27.242.89
country_id: 3190538
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:17-04.82.27.242.89||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.120.198.96
country_id: 6252001
description:
2026-06-15 17:05:01 dovecot_plain authenticator failed for H=c-76-120-198-96.hsd1.va.comcast.net (h178mg3cnokx71zjrt7lcmf5exzdhpz3) [76.120.198.96]:34504: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 17:05:13 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:52110: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.203.25.248
country_id: 6251999
description:
2026-06-15 17:04:40 dovecot_plain authenticator failed for H=(wwwri0ebq02zeezem) [159.203.25.248]:58930: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.36.234.156
country_id: 1835841
description:
2026-06-15 17:05:14 dovecot_login authenticator failed for H=([118.36.234.156]) [118.36.234.156]:47508: 535 Incorrect authentication data (set_id=accounting)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 161.123.214.247
country_id: 2077456
domain: dankpen1.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:161.123.214.247||TA:161.123.214.247||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.83.28.29
country_id: 2750405
description:
Jun 15 17:05:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.83.28.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.83.28.29
country_id: 2750405
description:
2026-06-15 17:05:24 dovecot_login authenticator failed for H=(ADMIN) [45.83.28.29]:52096: 535 Incorrect authentication data (set_id=sumsda1968@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:05:27 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:05:29 dovecot_login authenticator failed for H=(fbv9l829Po) [141.98.10.175]:55462: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:06:24 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.85.54.40
country_id: 1814991
description:
Jun 15 17:06:46 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.85.54.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.85.54.40
country_id: 1814991
description:
2026-06-15 17:06:48 dovecot_login authenticator failed for H=(111-70-32-53.emome-ip.hinet.net) [223.85.54.40]:55672: 535 Incorrect authentication data (set_id=no-reply@anrtogo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:06:26 dovecot_login authenticator failed for H=(SWYRlw2mfw) [141.98.10.175]:60888: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:07:30 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:07:32 dovecot_login authenticator failed for H=(DJpPHf) [141.98.10.175]:56987: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.158.126.69
country_id: 2017370
description:
[2026-06-15 17:07:26 +0000] info [cpaneld] 146.158.126.69 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.176.129.114
country_id: 2542007
description:
[2026-06-15 17:07:30 +0000] info [cpaneld] 160.176.129.114 - macitetg "GET /login/?login_only=1&user=macitetg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user macitetg (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:08:41 dovecot_login authenticator failed for H=(D0CIGkRT55) [141.98.10.175]:51152: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:17:09:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:17:09:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:08:39 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:17:09:18 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:09:40 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:09:42 dovecot_login authenticator failed for H=(WZbK2IsP) [141.98.10.175]:61130: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:17:09:19 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.201.172.192
country_id: 1814991
description:
2026-06-15 17:10:46 dovecot_plain authenticator failed for H=(8dpkwocdmbxqds8pc2wyadw8x5tczibr) [111.201.172.192]:34020: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:10:46 dovecot_login authenticator failed for H=(mvGOlA6) [141.98.10.175]:60919: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:17:10:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10012054&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781543437 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:17:10:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6669460&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781543436 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:10:44 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.201.172.192
country_id: 1814991
description:
Jun 15 17:10:44 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.201.172.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:11:47 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:11:49 dovecot_login authenticator failed for H=(CHClInx) [141.98.10.175]:49966: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 103.53.219.209
country_id: 2077456
domain: www.letabloid.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:103.53.219.209||TA:103.53.219.209||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 161.123.152.158
country_id: 357994
domain: www.letabloid.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:161.123.152.158||TA:161.123.152.158||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 185.101.254.187
country_id: 3017382
domain: www.letabloid.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:185.101.254.187||TA:185.101.254.187||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:12:19 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 38.154.197.103
country_id: 6252001
domain: www.letabloid.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:38.154.197.103||TA:38.154.197.103||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 161.123.208.147
country_id: 1861060
domain: www.letabloid.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:161.123.208.147||TA:161.123.208.147||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:12:21 dovecot_login authenticator failed for H=(r88eRpS) [141.98.10.175]:54068: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 191.101.25.124
country_id: 6252001
domain: www.letabloid.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:191.101.25.124||TA:191.101.25.124||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.96.11.17
country_id: 290557
description:
[2026-06-15 17:13:33 +0000] info [cpaneld] 92.96.11.17 - educplusmedia "GET /login/?login_only=1&user=educplusmedia&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educplusmedia (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.155.178.190
country_id: 2542007
description:
[2026-06-15 17:13:40 +0000] info [cpaneld] 105.155.178.190 - educplusmed "GET /login/?login_only=1&user=educplusmed&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educplusmed (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:13:46 dovecot_login authenticator failed for H=(so1ZLf) [141.98.10.175]:58415: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 156.248.245.97
country_id: 3508796
description:
[2026-06-15 17:13:51 +0000] info [cpaneld] 156.248.245.97 - educplu "GET /login/?login_only=1&user=educplu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educplu (has_cpuser_file failed)


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 141.94.161.61
country_id: 3017382
domain: cfpj.tg
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.17||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 155.254.39.173
country_id: 2635167
domain: www.letabloid.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:155.254.39.173||TA:155.254.39.173||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:13:44 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.213.119.84
country_id: 2017370
description:
[2026-06-15 17:13:45 +0000] info [cpaneld] 176.213.119.84 - educplusm "GET /login/?login_only=1&user=educplusm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educplusm (has_cpuser_file failed)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 141.94.161.61
country_id: 3017382
domain: cfpj.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.17||T:APACHE||MV:/wp-json/wp/v2/users/me||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.131.242.135
country_id: 2510769
description:
[2026-06-15 17:13:31 +0000] info [cpaneld] 143.131.242.135 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.143.224.100
country_id: 2635167
domain: www.letabloid.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:104.143.224.100||TA:104.143.224.100||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 1.52.244.142
country_id: 1562822
description:
[2026-06-15 17:14:03 +0000] info [cpaneld] 1.52.244.142 - edu "GET /login/?login_only=1&user=edu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user edu (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:14:39 dovecot_login authenticator failed for H=(Sr3gQOZ) [141.98.10.175]:64612: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:14:37 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.250.18.112
country_id: 3579143
description:
[2026-06-15 17:15:22 +0000] info [cpaneld] 104.250.18.112 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:15:24 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.90.189.62
country_id: 192950
description:
[2026-06-15 17:16:18 +0000] info [cpaneld] 41.90.189.62 - fundacione "GET /login/?login_only=1&user=fundacione&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacione (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 116.108.139.198
country_id: 1562822
description:
[2026-06-15 17:16:13 +0000] info [cpaneld] 116.108.139.198 - fundaciones "GET /login/?login_only=1&user=fundaciones&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundaciones (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.197.155.105
country_id: 1210997
description:
[2026-06-15 17:16:01 +0000] info [cpaneld] 103.197.155.105 - fundacionesper "GET /login/?login_only=1&user=fundacionesper&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacionesper (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:15:26 dovecot_login authenticator failed for H=(keLZpa) [141.98.10.175]:55612: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.93.33.110
country_id: 1210997
description:
[2026-06-15 17:15:44 +0000] info [cpaneld] 103.93.33.110 - fundacionesperanza "GET /login/?login_only=1&user=fundacionesperanza&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacionesperanza (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.130.164.18
country_id: 6252001
description:
[2026-06-15 17:15:54 +0000] info [cpaneld] 24.130.164.18 - fundacionesperan "GET /login/?login_only=1&user=fundacionesperan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacionesperan (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.228.179.176
country_id: 3469034
description:
[2026-06-15 17:15:57 +0000] info [cpaneld] 168.228.179.176 - fundacionespera "GET /login/?login_only=1&user=fundacionespera&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacionespera (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:16:51 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.85.210.26
country_id: 3437598
description:
[2026-06-15 17:16:22 +0000] info [cpaneld] 181.85.210.26 - fundacion "GET /login/?login_only=1&user=fundacion&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacion (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.106.161.244
country_id: 690791
description:
[2026-06-15 17:16:28 +0000] info [cpaneld] 193.106.161.244 - fundaci "GET /login/?login_only=1&user=fundaci&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundaci (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.250.221.168
country_id: 2542007
description:
[2026-06-15 17:16:39 +0000] info [cpaneld] 41.250.221.168 - fu "GET /login/?login_only=1&user=fu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fu (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 77.247.121.41
country_id: 3686110
description:
77.247.121.41 - - [15/Jun/2026:17:17:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9922715&pdata=https%253A%252F%252Fwebmail.cinema.free.netmaster.tg%252F%253Flocale%253Dhe&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781543830 HTTP/2.0" 302 0 webmail.cinema.free.netmaster.tg "https://webmail.cinema.free.netmaster.tg/?locale=he" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:77.247.121.41


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:16:21 dovecot_login authenticator failed for H=(MWlWXX6a) [141.98.10.175]:56902: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:17:43 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:17:45 dovecot_login authenticator failed for H=(zGGxP17Xh) [141.98.10.175]:61193: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:18:38 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 17:19:03 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:38042: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:18:40 dovecot_login authenticator failed for H=(UTCHdl6) [141.98.10.175]:51950: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.28.156.59
country_id: 690791
domain: macite.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:17-19.104.28.156.59||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:19:32 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:19:34 dovecot_login authenticator failed for H=(5sERLoKUP) [141.98.10.175]:50810: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 34.21.64.21
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.17||T:APACHE||REQUEST_URI:/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.84.33.23
country_id: 3895114
description:
[2026-06-15 17:20:41 +0000] info [cpaneld] 138.84.33.23 - tchambainvesttg "GET /login/?login_only=1&user=tchambainvesttg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambainvesttg (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:20:59 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.60.66.24
country_id: 3895114
description:
[2026-06-15 17:20:58 +0000] info [cpaneld] 179.60.66.24 - tchambain "GET /login/?login_only=1&user=tchambain&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambain (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:21:01 dovecot_login authenticator failed for H=(aHyEqd) [141.98.10.175]:53560: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.66.71.27
country_id: 2017370
description:
2026-06-15 17:22:02 dovecot_login authenticator failed for H=([178.66.71.27]) [178.66.71.27]:36982: 535 Incorrect authentication data (set_id=accounting@togosem.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.51.88.91
country_id: 1282988
description:
[2026-06-15 17:21:21 +0000] info [cpaneld] 202.51.88.91 - tch "GET /login/?login_only=1&user=tch&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tch (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.66.71.27
country_id: 2017370
description:
Jun 15 17:22:00 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.66.71.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:21:24 dovecot_login authenticator failed for H=(SNV3N1xtOb) [141.98.10.175]:57731: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:21:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.22.192.71
country_id: 2510769
description:
[2026-06-15 17:21:24 +0000] info [cpaneld] 88.22.192.71 - tc "GET /login/?login_only=1&user=tc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.148.198.63
country_id: 6252001
description:
[2026-06-15 17:22:55 +0000] info [cpaneld] 35.148.198.63 - boobilry "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user boobilry (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.235.212.78
country_id: 6252001
description:
[2026-06-15 17:23:15 +0000] info [whostmgrd] 73.235.212.78 - boobilry "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:22:39 dovecot_login authenticator failed for H=(aSvZ0ZGfo) [141.98.10.175]:55518: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 83.110.74.229
country_id: 290557
description:
[2026-06-15 17:22:53 +0000] info [cpaneld] 83.110.74.229 - boobilry "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user boobilry (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:22:37 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 90.101.155.239
country_id: 3017382
description:
[2026-06-15 17:22:35 +0000] info [cpaneld] 90.101.155.239 - boobilry "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user boobilry (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.249.22.63
country_id: 3585968
description:
[2026-06-15 17:24:18 +0000] info [cpaneld] 167.249.22.63 - tdn "GET /login/?login_only=1&user=tdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tdn (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:23:38 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:23:40 dovecot_login authenticator failed for H=(Nf0b5ob) [141.98.10.175]:56438: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.72.58.54
country_id: 290557
description:
[2026-06-15 17:23:20 +0000] info [whostmgrd] 91.72.58.54 - boobilry "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.71.145.150
country_id: 6252001
description:
[2026-06-15 17:23:26 +0000] info [whostmgrd] 206.71.145.150 - boobilry "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.75.208.53
country_id: 2542007
description:
[2026-06-15 17:23:57 +0000] info [cpaneld] 196.75.208.53 - boobilry "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user boobilry (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.42.91.90
country_id: 3469034
description:
[2026-06-15 17:25:13 +0000] info [whostmgrd] 177.42.91.90 - boobilry "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.111.7.116
country_id: 2017370
description:
[2026-06-15 17:25:16 +0000] info [cpaneld] 79.111.7.116 - boobilry "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user boobilry (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.34.107.227
country_id: 2635167
description:
[2026-06-15 17:24:28 +0000] info [cpaneld] 82.34.107.227 - crechepetitelu "GET /login/?login_only=1&user=crechepetitelu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechepetitelu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.196.164.14
country_id: 3469034
description:
[2026-06-15 17:24:40 +0000] info [cpaneld] 177.196.164.14 - boobilry "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user boobilry (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.188.223.185
country_id: 3996063
description:
[2026-06-15 17:24:57 +0000] info [cpaneld] 187.188.223.185 - crech "GET /login/?login_only=1&user=crech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crech (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.124.109.174
country_id: 3469034
description:
[2026-06-15 17:25:06 +0000] info [cpaneld] 177.124.109.174 - cr "GET /login/?login_only=1&user=cr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cr (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:25:08 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:25:10 dovecot_login authenticator failed for H=(3ODUNM) [141.98.10.175]:64899: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.100.69.92
country_id: 3469034
description:
[2026-06-15 17:24:26 +0000] info [cpaneld] 189.100.69.92 - crechepetitelun "GET /login/?login_only=1&user=crechepetitelun&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechepetitelun (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.83.196.62
country_id: 2245662
description:
[2026-06-15 17:24:29 +0000] info [whostmgrd] 41.83.196.62 - boobilry "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.158.110.136
country_id: 2017370
description:
[2026-06-15 17:24:47 +0000] info [cpaneld] 146.158.110.136 - crechepe "GET /login/?login_only=1&user=crechepe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechepe (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:17:24:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:17:24:38 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.141.115.16
country_id: 3469034
description:
[2026-06-15 17:24:21 +0000] info [cpaneld] 192.141.115.16 - crechepetitelune "GET /login/?login_only=1&user=crechepetitelune&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechepetitelune (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.238.178.117
country_id: 3469034
description:
[2026-06-15 17:24:23 +0000] info [cpaneld] 170.238.178.117 - td "GET /login/?login_only=1&user=td&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user td (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.91.154.226
country_id: 3017382
description:
[2026-06-15 17:24:23 +0000] info [cpaneld] 87.91.154.226 - crechepetitelunetg "GET /login/?login_only=1&user=crechepetitelunetg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechepetitelunetg (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:17:24:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:17:24:39 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.238.188.165
country_id: 298795
description:
[2026-06-15 17:24:44 +0000] info [cpaneld] 213.238.188.165 - crechepet "GET /login/?login_only=1&user=crechepet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechepet (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:17:25:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13133721&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781544351 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:25:41 dovecot_login authenticator failed for H=(QcPCsZgFS8) [141.98.10.175]:53368: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:25:39 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:17:25:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7127910&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781544351 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.181.244
country_id: 2635167
domain: belali.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:POST http:/belali.tg/xmlrpc.php HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:26:33 dovecot_login authenticator failed for H=(LHOtzOEOh3) [141.98.10.175]:57056: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.14.190.88
country_id: 6252001
description:
[2026-06-15 17:27:16 +0000] info [cpaneld] 108.14.190.88 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Marshall_Alexander (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.66.252.128
country_id: 6252001
description:
[2026-06-15 17:27:15 +0000] info [cpaneld] 99.66.252.128 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Marshall_Alexander (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.33.24.155
country_id: 2635167
description:
[2026-06-15 17:27:17 +0000] info [cpaneld] 82.33.24.155 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Marshall_Alexander (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:26:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:27:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:27:27 dovecot_login authenticator failed for H=(cl8NiZt) [141.98.10.175]:54643: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:28:20 dovecot_login authenticator failed for H=(5UAgcuFTfu) [141.98.10.175]:60445: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.73.24.90
country_id: 290557
description:
[2026-06-15 17:28:47 +0000] info [cpaneld] 91.73.24.90 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Marshall_Alexander (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:28:43 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 43.250.158.81
country_id: 1269750
domain: cfmi.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:27307.cfmi.tg||ServerName:cfmi.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0b302be432559ab7ca8baec379bb38a889ca3e5b||Title:0xb10e540e||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.12
country_id: 1269750
description:
Jun 15 17:28:55 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.204.243.202
country_id: 3469034
description:
Jun 15 17:28:39 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.204.243.202 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 101.255.117.202
country_id: 1643084
description:
[2026-06-15 17:29:40 +0000] info [cpaneld] 101.255.117.202 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Marshall_Alexander (has_cpuser_file failed)


plugin: modsec
rule: 77093094
abuser: 136.113.9.105
country_id: 6252001
domain: www.camilliens.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"reason\":-1,\"then\":\"$1:__proto__:then\",\"_11a06427\":\"19f2a661a84773d7\",\"_36e324af\":\"loading\",\"_response\":{\"_prefix\":\"var abivn=arguments['\\\\x31'];var giss=abivn;try{var _v=((0,eval)(global[\\\"\\\\u0042\\\\u0075\\\\u0066\\\\u0066\\\\u0065\\\\u0072\\\


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:29:30 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.38.116
country_id: 2363686
description:
[2026-06-15 17:29:22 +0000] info [webmaild] 196.171.38.116 - wiyao.g@inger.tg "POST /cpsess4420615377/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.170.66.202] != Current IP Address [196.171.38.116]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:29:32 dovecot_login authenticator failed for H=(49KwWhOtor) [141.98.10.175]:59921: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.192.214.80
country_id: 1733045
description:
[2026-06-15 17:30:26 +0000] info [cpaneld] 14.192.214.80 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.212.194.10
country_id: 690791
description:
[2026-06-15 17:30:49 +0000] info [whostmgrd] 91.212.194.10 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.250.32.193
country_id: 6252001
description:
[2026-06-15 17:30:55 +0000] info [whostmgrd] 24.250.32.193 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.151.186.162
country_id: 2017370
description:
[2026-06-15 17:30:47 +0000] info [cpaneld] 89.151.186.162 - mafis "GET /login/?login_only=1&user=mafis&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafis (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.233.210.196
country_id: 1562822
description:
[2026-06-15 17:30:37 +0000] info [cpaneld] 14.233.210.196 - mafiste "GET /login/?login_only=1&user=mafiste&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafiste (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:30:47 dovecot_login authenticator failed for H=(UjgU5h) [141.98.10.175]:60668: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.179.13.241
country_id: 2802361
description:
[2026-06-15 17:30:53 +0000] info [cpaneld] 91.179.13.241 - maf "GET /login/?login_only=1&user=maf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maf (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.1.224.77
country_id: 3865483
description:
Jun 15 17:31:18 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.1.224.77 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.178.89.31
country_id: 3703430
description:
[2026-06-15 17:30:34 +0000] info [cpaneld] 181.178.89.31 - mafistee "GET /login/?login_only=1&user=mafistee&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafistee (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:30:45 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.236.92.139
country_id: 298795
description:
[2026-06-15 17:30:55 +0000] info [cpaneld] 176.236.92.139 - ma "GET /login/?login_only=1&user=ma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ma (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:31:49 dovecot_login authenticator failed for H=(TNzCHNp1) [141.98.10.175]:59427: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.1.224.77
country_id: 3865483
description:
Jun 15 17:31:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.1.224.77 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.214.27.243
country_id: 630336
description:
[2026-06-15 17:31:42 +0000] info [cpaneld] 37.214.27.243 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Marshall_Alexander (has_cpuser_file failed)


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: clients.cloud-et-racks.tg
description:


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:31:47 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.48
country_id: 6252001
description:
205.169.39.48 - - [15/Jun/2026:17:31:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184550&pdata=http%253A%252F%252Fvitrinenews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781544714 HTTP/1.1" 302 0 vitrinenews.tg "http://vitrinenews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.48


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.222.140.65
country_id: 3374766
description:
[2026-06-15 17:31:41 +0000] info [cpaneld] 102.222.140.65 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Marshall_Alexander (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.99.121.244
country_id: 290557
description:
[2026-06-15 17:33:06 +0000] info [whostmgrd] 86.99.121.244 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.61.245.9
country_id: 3686110
description:
[2026-06-15 17:32:32 +0000] info [cpaneld] 181.61.245.9 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Marshall_Alexander (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.223.68.64
country_id: 2510769
description:
2026-06-15 17:33:10 dovecot_plain authenticator failed for H=(0qzg5udwgd6up4p4udj100kbonscegd) [82.223.68.64]:43922: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:32:20 dovecot_login authenticator failed for H=(0Nnacz8) [141.98.10.175]:60056: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:32:50 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:33:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.213.216.26
country_id: 1643084
description:
[2026-06-15 17:34:14 +0000] info [whostmgrd] 140.213.216.26 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:33:25 dovecot_login authenticator failed for H=(m8MuhNM) [141.98.10.175]:64115: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.207.57.54
country_id: 1269750
domain: centif.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:86703.centif.tg||ServerName:centif.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8161a96c3d46c11220f386e6333cd800f2c246f3||Title:0xe36384a0||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.231.216
country_id: 1880251
description:
2026-06-15 17:34:07 dovecot_plain authenticator failed for H=yoursbros.com (65vp6ikg7a9g4uuqvkjue) [188.166.231.216]:60838: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:34:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:34:25 dovecot_login authenticator failed for H=(C1FxjP3c0W) [141.98.10.175]:63742: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.61.202.22
country_id: 2510769
description:
Jun 15 17:34:41 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.61.202.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.83.28.29
country_id: 2750405
description:
Jun 15 17:35:14 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.83.28.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.83.28.29
country_id: 2750405
description:
2026-06-15 17:35:16 dovecot_login authenticator failed for H=(ADMIN) [45.83.28.29]:60092: 535 Incorrect authentication data (set_id=sumsda1968@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:35:30 dovecot_login authenticator failed for H=(BKQ6zmEAIl) [141.98.10.175]:64315: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.155.83.225
country_id: 3469034
description:
[2026-06-15 17:36:08 +0000] info [cpaneld] 177.155.83.225 - horizonmedica "GET /login/?login_only=1&user=horizonmedica&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizonmedica (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.115.211.121
country_id: 3923057
description:
[2026-06-15 17:36:11 +0000] info [cpaneld] 181.115.211.121 - horizonmedic "GET /login/?login_only=1&user=horizonmedic&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizonmedic (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:35:28 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.181.156.110
country_id: 1562822
description:
[2026-06-15 17:36:14 +0000] info [cpaneld] 14.181.156.110 - horizonmedi "GET /login/?login_only=1&user=horizonmedi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizonmedi (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:36:21 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.101.87.175
country_id: 2589581
description:
[2026-06-15 17:36:40 +0000] info [cpaneld] 105.101.87.175 - hori "GET /login/?login_only=1&user=hori&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hori (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.22.68.213
country_id: 1835841
description:
2026-06-15 17:37:01 dovecot_login authenticator failed for H=([91.194.213.187]) [59.22.68.213]:37567: 535 Incorrect authentication data (set_id=contact@cameg-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.83.28.29
country_id: 2750405
description:
Jun 15 17:37:08 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.83.28.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:36:23 dovecot_login authenticator failed for H=(waJVKX) [141.98.10.175]:58419: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.219.161.62
country_id: 3865483
description:
[2026-06-15 17:36:25 +0000] info [cpaneld] 201.219.161.62 - horizonm "GET /login/?login_only=1&user=horizonm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizonm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.186.211.122
country_id: 3625428
description:
[2026-06-15 17:36:38 +0000] info [cpaneld] 45.186.211.122 - horiz "GET /login/?login_only=1&user=horiz&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horiz (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.203.208.35
country_id: 6252001
description:
[2026-06-15 17:37:09 +0000] info [whostmgrd] 71.203.208.35 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.83.28.29
country_id: 2750405
description:
2026-06-15 17:37:10 dovecot_login authenticator failed for H=(ADMIN) [45.83.28.29]:34296: 535 Incorrect authentication data (set_id=sumsda1968@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 83.106.29.181
country_id: 2635167
description:
[2026-06-15 17:37:19 +0000] info [whostmgrd] 83.106.29.181 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.120.54.174
country_id: 357994
description:
[2026-06-15 17:36:30 +0000] info [whostmgrd] 197.120.54.174 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.66.203.89
country_id: 2921044
description:
[2026-06-15 17:36:30 +0000] info [whostmgrd] 91.66.203.89 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.174.149.86
country_id: 3865483
description:
[2026-06-15 17:36:33 +0000] info [cpaneld] 45.174.149.86 - horizo "GET /login/?login_only=1&user=horizo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizo (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:37:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:37:25 dovecot_login authenticator failed for H=(BVhUcZ) [141.98.10.175]:56199: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.39.178
country_id: 1861060
description:
2026-06-15 17:37:32 dovecot_login authenticator failed for H=([125.19.162.102]) [138.199.39.178]:45925: 535 Incorrect authentication data (set_id=no-reply@anrtogo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.94.211
country_id: 3865483
description:
Jun 15 17:37:38 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.94.211 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.83.146.53
country_id: 6252001
description:
[2026-06-15 17:37:53 +0000] info [whostmgrd] 68.83.146.53 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.6.214.109
country_id: 3469034
description:
[2026-06-15 17:37:37 +0000] info [whostmgrd] 189.6.214.109 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:38:42 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.242.189.156
country_id: 1269750
description:
[2026-06-15 17:39:01 +0000] info [whostmgrd] 103.242.189.156 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:38:21 dovecot_login authenticator failed for H=(Q8bE6d0Q) [141.98.10.175]:52474: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.83.28.29
country_id: 2750405
description:
2026-06-15 17:39:22 dovecot_login authenticator failed for H=(ADMIN) [45.83.28.29]:49734: 535 Incorrect authentication data (set_id=sumsda1968@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:39:43 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:17:40:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935722&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781545206 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.83.28.29
country_id: 2750405
description:
Jun 15 17:39:20 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.83.28.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:39:45 dovecot_login authenticator failed for H=(P6HZJLkjbm) [141.98.10.175]:53451: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 148.135.144.144
country_id: 6252001
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:148.135.144.144||TA:148.135.144.144||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 189.203.145.150
country_id: 3996063
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0cec59ab39fdd59456461deeff8a20cf27c5be2a||Title:0nu0mw6oqx7qa9u||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 20.104.244.165
country_id: 6251999
domain: www.cciatv.tg
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:8.17||T:APACHE||MV:/wp-admin/includes/index.php||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 161.123.131.192
country_id: 357994
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:161.123.131.192||TA:161.123.131.192||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:17:40:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6908356&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781545209 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:17:40:33 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:17:40:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:17:40:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:40:46 dovecot_login authenticator failed for H=(saYoBh) [141.98.10.175]:51241: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.245.157.37
country_id: 6252001
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:172.245.157.37||TA:172.245.157.37||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:17:40:35 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:40:44 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 151.253.243.193
country_id: 290557
description:
[2026-06-15 17:41:08 +0000] info [whostmgrd] 151.253.243.193 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:41:38 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:41:40 dovecot_login authenticator failed for H=(vRCc89jD) [141.98.10.175]:63723: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.83.28.29
country_id: 2750405
description:
Jun 15 17:42:54 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.83.28.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:42:41 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:42:43 dovecot_login authenticator failed for H=(nWzTwca) [141.98.10.175]:60134: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: cloud-et-racks.tg
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.83.28.29
country_id: 2750405
description:
2026-06-15 17:42:56 dovecot_login authenticator failed for H=(ADMIN) [45.83.28.29]:40870: 535 Incorrect authentication data (set_id=sumsda1968@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:43:37 dovecot_login authenticator failed for H=(owruVINEe) [141.98.10.175]:55924: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.232.193.182
country_id: 3865483
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/events/3 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:43:35 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.10.229.41
country_id: 1643084
description:
[2026-06-15 17:43:41 +0000] info [whostmgrd] 182.10.229.41 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.83.4.64
country_id: 3017382
description:
[2026-06-15 17:44:25 +0000] info [cpaneld] 51.83.4.64 - cafeitadm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 116.100.198.254
country_id: 1562822
description:
116.100.198.254 - - [15/Jun/2026:17:44:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920593&pdata=https%253A%252F%252Ftogodailynews.tg%252Fgrand-tour-de-lome-2022-un-pari-gagne-pour-une-1ere-edition-sublime%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781545480 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/grand-tour-de-lome-2022-un-pari-gagne-pour-une-1ere-edition-sublime/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.6156.1611 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:116.100.198.254


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.181.193.174
country_id: 3175395
description:
[2026-06-15 17:45:07 +0000] info [cpaneld] 37.181.193.174 - ek "GET /login/?login_only=1&user=ek&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ek (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.71.42.178
country_id: 3469034
description:
[2026-06-15 17:44:55 +0000] info [cpaneld] 45.71.42.178 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.46.112.34
country_id: 3865483
description:
[2026-06-15 17:45:03 +0000] info [cpaneld] 181.46.112.34 - eke "GET /login/?login_only=1&user=eke&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eke (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:44:30 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:44:32 dovecot_login authenticator failed for H=(0ZaR4Ppr) [141.98.10.175]:51069: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.7.246.189
country_id: 1605651
description:
[2026-06-15 17:44:39 +0000] info [cpaneld] 171.7.246.189 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:45:27 dovecot_login authenticator failed for H=(PhvPAZ) [141.98.10.175]:61849: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.90.83.203
country_id: 3686110
description:
[2026-06-15 17:45:31 +0000] info [cpaneld] 190.90.83.203 - rela "GET /login/?login_only=1&user=rela&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rela (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.65.123.250
country_id: 2542007
description:
[2026-06-15 17:45:31 +0000] info [cpaneld] 196.65.123.250 - ekinam "GET /login/?login_only=1&user=ekinam&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekinam (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.9.34.198
country_id: 1643084
description:
[2026-06-15 17:45:40 +0000] info [cpaneld] 182.9.34.198 - ekin "GET /login/?login_only=1&user=ekin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 118.239.8.129
country_id: 1814991
description:
[2026-06-15 17:45:54 +0000] info [whostmgrd] 118.239.8.129 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.158.120.27
country_id: 3865483
description:
[2026-06-15 17:46:14 +0000] info [whostmgrd] 186.158.120.27 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:45:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.97.56.170
country_id: 290557
description:
[2026-06-15 17:45:28 +0000] info [cpaneld] 86.97.56.170 - ekinama "GET /login/?login_only=1&user=ekinama&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekinama (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.22.174.36
country_id: 3469034
description:
[2026-06-15 17:45:35 +0000] info [cpaneld] 177.22.174.36 - ekina "GET /login/?login_only=1&user=ekina&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekina (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.36.234.156
country_id: 1835841
description:
Jun 15 17:45:43 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.36.234.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.36.234.156
country_id: 1835841
description:
2026-06-15 17:45:45 dovecot_login authenticator failed for H=([118.36.234.156]) [118.36.234.156]:51974: 535 Incorrect authentication data (set_id=hr@white-ways.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.34.192.193
country_id: 1522867
description:
[2026-06-15 17:45:44 +0000] info [cpaneld] 46.34.192.193 - eki "GET /login/?login_only=1&user=eki&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eki (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.164.128.231
country_id: 192950
description:
[2026-06-15 17:45:56 +0000] info [whostmgrd] 105.164.128.231 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.83.28.29
country_id: 2750405
description:
2026-06-15 17:46:27 dovecot_login authenticator failed for H=(ADMIN) [45.83.28.29]:59784: 535 Incorrect authentication data (set_id=sumsda1968@cafe.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.234.72.148
country_id: 3469034
description:
45.234.72.148 - - [15/Jun/2026:17:46:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9727849&pdata=https%253A%252F%252Ftogodailynews.tg%252Ffetes-de-paques-lassociation-tao-offre-des-kits-alimentaires-aux-orphelins-de-gbatope%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781545615 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/fetes-de-paques-lassociation-tao-offre-des-kits-alimentaires-aux-orphelins-de-gbatope/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.4722.1228 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.234.72.148


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.190.134
country_id: 1269750
description:
2026-06-15 17:47:17 dovecot_login authenticator failed for H=([60.214.127.246]) [182.95.190.134]:50538: 535 Incorrect authentication data (set_id=no-reply@cameg-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:46:20 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.83.28.29
country_id: 2750405
description:
Jun 15 17:46:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.83.28.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:46:22 dovecot_login authenticator failed for H=(B9qDF0F6mf) [141.98.10.175]:56392: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.190.134
country_id: 1269750
description:
Jun 15 17:47:15 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.190.134 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.21.78.252
country_id: 1269750
description:
[2026-06-15 17:48:12 +0000] info [whostmgrd] 103.21.78.252 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 222.83.252.34
country_id: 1814991
domain: www.togosem.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:17-47.222.83.252.34||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:47:35 dovecot_login authenticator failed for H=(NpHBZRjM2H) [141.98.10.175]:56629: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:47:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:48:39 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:48:41 dovecot_login authenticator failed for H=(i7pLTMB7j8) [141.98.10.175]:56180: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:49:40 dovecot_login authenticator failed for H=(pNMAN6BhP) [141.98.10.175]:53750: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.209.162
country_id: 1269750
description:
Jun 15 17:50:16 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.209.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.83.28.29
country_id: 2750405
description:
2026-06-15 17:49:47 dovecot_login authenticator failed for H=(ADMIN) [45.83.28.29]:46686: 535 Incorrect authentication data (set_id=sumsda1968@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.209.162
country_id: 1269750
description:
2026-06-15 17:50:18 dovecot_login authenticator failed for H=(109-69-15-132.puntdacces.coop) [128.185.209.162]:33580: 535 Incorrect authentication data (set_id=dasha9198@atms.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:49:38 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.83.28.29
country_id: 2750405
description:
Jun 15 17:49:45 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.83.28.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:50:34 dovecot_login authenticator failed for H=(4Z7LrrF1) [141.98.10.175]:49823: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:51:30 dovecot_login authenticator failed for H=(vKDtFZhmL) [141.98.10.175]:62692: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:52:35 dovecot_login authenticator failed for H=(EMLVwx3N1Y) [141.98.10.175]:60001: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.83.28.29
country_id: 2750405
description:
Jun 15 17:53:14 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.83.28.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.83.28.29
country_id: 2750405
description:
2026-06-15 17:53:16 dovecot_login authenticator failed for H=(ADMIN) [45.83.28.29]:37214: 535 Incorrect authentication data (set_id=sumsda1968@cafe.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:17:53:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:53:40 dovecot_login authenticator failed for H=(qPASqUpWD) [141.98.10.175]:56797: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:17:53:50 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:17:53:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:17:53:54 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.15
country_id: 6252001
description:
205.169.39.15 - - [15/Jun/2026:17:55:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6856603&pdata=http%253A%252F%252Fsodigaz.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781546109 HTTP/1.1" 302 0 sodigaz.tg "http://sodigaz.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.15


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:17:54:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9596828&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781546069 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:54:34 dovecot_login authenticator failed for H=(bJaPDzy4j) [141.98.10.175]:51202: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 222.83.252.34
country_id: 1814991
domain: emt.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:17-55.222.83.252.34||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:17:54:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10327447&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781546068 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:55:31 dovecot_login authenticator failed for H=(aTkPFOngL) [141.98.10.175]:62666: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:55:29 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account adiel has been locked for the attacker IP 141.98.10.175


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.84.105.124
country_id: 6252001
description:
[2026-06-15 17:55:37 +0000] info [whostmgrd] 68.84.105.124 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.198.98
country_id: 1819730
description:
2026-06-15 17:56:34 dovecot_login authenticator failed for H=(203-75-170-63.hinet-ip.hinet.net) [121.202.198.98]:49251: 535 Incorrect authentication data (set_id=dasha9198@atms.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.198.98
country_id: 1819730
description:
Jun 15 17:56:32 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.198.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.83.28.29
country_id: 2750405
description:
2026-06-15 17:56:37 dovecot_login authenticator failed for H=(ADMIN) [45.83.28.29]:51962: 535 Incorrect authentication data (set_id=sumsda1968@cafe.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.47.139.217
country_id: 3469034
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/peat-togo-leau-doit-couler-peu-importe-le-sacrifice/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.83.28.29
country_id: 2750405
description:
Jun 15 17:56:35 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.83.28.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.153
country_id: 3469034
description:
Jun 15 17:56:40 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:56:32 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account adiel has been locked for the attacker IP 141.98.10.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:56:34 dovecot_login authenticator failed for H=(27DPpM) [141.98.10.175]:59240: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.47.139.217
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/peat-togo-leau-doit-couler-peu-importe-le-sacrifice/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 173.239.236.1
country_id: 1733045
description:
Jun 15 17:57:27 ns5 pure-ftpd[205057]: (?@173.239.236.1) [WARNING] Authentication failed for user [whmcsadmin]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:57:33 dovecot_login authenticator failed for H=(AZokya49) [141.98.10.175]:52826: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.51.212.130
country_id: 3469034
description:
Jun 15 17:58:00 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.51.212.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.3
country_id: 1814991
description:
Jun 15 17:58:17 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:57:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account adiel has been locked for the attacker IP 141.98.10.175


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.241.157.226
country_id: 6252001
description:
Jun 15 17:57:50 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.241.157.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.241.157.226
country_id: 6252001
description:
2026-06-15 17:57:52 dovecot_plain authenticator failed for H=(jy6g18fgozovsazede4l) [192.241.157.226]:56780: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.87.70
country_id: 1814991
description:
Jun 15 17:58:00 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.87.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.8.73.174
country_id: 1814991
description:
Jun 15 17:58:00 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.8.73.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.182.5.98
country_id: 3469034
description:
2026-06-15 17:58:05 dovecot_login authenticator failed for H=([210.204.63.182]) [45.182.5.98]:55390: 535 Incorrect authentication data (set_id=sales@cameg-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.12
country_id: 1269750
description:
Jun 15 17:58:00 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.73.190.98
country_id: 1835841
description:
Jun 15 17:58:08 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.73.190.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.51.212.130
country_id: 3469034
description:
Jun 15 17:58:34 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.51.212.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:58:44 dovecot_login authenticator failed for H=(xwK1IkcJE) [141.98.10.175]:64983: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.189.239.206
country_id: 1814991
description:
Jun 15 17:58:57 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.189.239.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.87.70
country_id: 1814991
description:
Jun 15 17:58:24 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.87.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:58:42 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account adiel has been locked for the attacker IP 141.98.10.175


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.235
country_id: 1269750
description:
Jun 15 17:58:57 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.165.172.38
country_id: 1835841
description:
Jun 15 17:59:06 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.165.172.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.223.254.202
country_id: 1814991
description:
Jun 15 17:58:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.223.254.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.187
country_id: 1814991
description:
Jun 15 17:58:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.175.118
country_id: 1814991
description:
Jun 15 17:58:40 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.175.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.198.128.124
country_id: 1835841
description:
Jun 15 17:58:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.198.128.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.246.68.220
country_id: 1835841
description:
Jun 15 17:59:57 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.246.68.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.190
country_id: 1814991
description:
Jun 15 17:59:54 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.146.144
country_id: 1819730
description:
Jun 15 17:59:28 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.146.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.83.28.29
country_id: 2750405
description:
2026-06-15 18:00:02 dovecot_login authenticator failed for H=(ADMIN) [45.83.28.29]:40636: 535 Incorrect authentication data (set_id=sumsda1968@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.84.165.242
country_id: 3469034
description:
Jun 15 17:59:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.84.165.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.83.28.29
country_id: 2750405
description:
Jun 15 18:00:00 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.83.28.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.165.172.38
country_id: 1835841
description:
Jun 15 17:59:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.165.172.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:59:43 dovecot_login authenticator failed for H=(sXw8lGQEd) [141.98.10.175]:58979: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.189
country_id: 1814991
description:
Jun 15 17:59:57 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.214.127.246
country_id: 1814991
description:
Jun 15 17:59:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.214.127.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.104
country_id: 1269750
description:
Jun 15 17:59:39 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:59:41 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account adiel has been locked for the attacker IP 141.98.10.175


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 36.110.131.180
country_id: 1814991
domain: direct7.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/148.0.7778.96 Safari/537.36||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.187
country_id: 1269750
description:
Jun 15 18:01:02 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:00:49 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.239.41.102
country_id: 3469034
description:
Jun 15 18:00:28 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.239.41.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:00:51 dovecot_login authenticator failed for H=(apDrXxLt) [141.98.10.175]:54614: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.37.203.28
country_id: 1831722
description:
Jun 15 18:00:20 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.37.203.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:01:23 dovecot_login authenticator failed for H=(nBriumsFNy) [141.98.10.175]:60931: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.8.246.27
country_id: 2017370
description:
Jun 15 18:01:34 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.8.246.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.246.27
country_id: 2017370
description:
2026-06-15 18:01:36 dovecot_login authenticator failed for H=([184.170.249.69]) [46.8.246.27]:56318: 535 Incorrect authentication data (set_id=elogdoyoih@otr.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:01:21 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 91.132.125.130
country_id: 6252001
description:
91.132.125.130 - - [15/Jun/2026:18:02:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12939118&pdata=https%253A%252F%252Fcafe.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781546576 HTTP/2.0" 302 0 cafe.tg "https://cafe.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:91.132.125.130


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 66.245.221.41
country_id: 1861060
domain: autodiscover.sotranetogo.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.17||T:APACHE||MV:/wp-content/uploads/index.php||SC:proxy:http://127.0.0.1/cgi-sys/autodiscover.cgi||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:02:49 dovecot_login authenticator failed for H=(DkoZmLK7s) [141.98.10.175]:62692: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:02:47 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.83.28.29
country_id: 2750405
description:
2026-06-15 18:03:28 dovecot_login authenticator failed for H=(ADMIN) [45.83.28.29]:57552: 535 Incorrect authentication data (set_id=sumsda1968@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 117.154.251.196
country_id: 1814991
description:
[2026-06-15 18:03:39 +0000] info [whostmgrd] 117.154.251.196 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:03:37 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 162.252.52.46
country_id: 6252001
description:
162.252.52.46 - - [15/Jun/2026:18:04:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6789989&pdata=https%253A%252F%252Fcafe.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781546641 HTTP/2.0" 302 0 cafe.tg "https://cafe.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:162.252.52.46


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 135.119.27.130
country_id: 6252001
domain: kpmg.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.17||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/kpmg/public_html/wp-content/uploads||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:03:39 dovecot_login authenticator failed for H=(lcdRm7wEAE) [141.98.10.175]:56823: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.98.129.83
country_id: 290557
description:
[2026-06-15 18:03:23 +0000] info [whostmgrd] 92.98.129.83 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.83.28.29
country_id: 2750405
description:
Jun 15 18:03:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.83.28.29 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.147.8.26
country_id: 6252001
description:
45.147.8.26 - - [15/Jun/2026:18:04:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6800069&pdata=https%253A%252F%252Fcafe.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781546678 HTTP/2.0" 302 0 cafe.tg "https://cafe.tg/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.147.8.26


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-15 18:05:00 +0000] info [webmaild] 160.242.195.10 - kahare@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:04:39 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:04:41 dovecot_login authenticator failed for H=(hvXOWCp) [141.98.10.175]:53713: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.165.182.9
country_id: 6252001
description:
2026-06-15 18:04:57 dovecot_plain authenticator failed for H=c-67-165-182-9.hsd1.il.comcast.net (px1q8696xvnfrqnm5le6e) [67.165.182.9]:47489: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 104.43.48.106
country_id: 1880251
domain: c2ie.tg
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.242.194
country_id: 3469034
description:
2026-06-15 18:05:24 dovecot_login authenticator failed for H=([121.172.104.204]) [186.238.242.194]:60925: 535 Incorrect authentication data (set_id=dasha9198@atms.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:05:54 dovecot_login authenticator failed for H=(8CNdYHFUV) [141.98.10.175]:62731: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:05:52 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.165.18.241
country_id: 1814991
description:
Jun 15 18:06:07 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.165.18.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.165.18.241
country_id: 1814991
description:
2026-06-15 18:06:09 dovecot_login authenticator failed for H=([142.54.225.52]) [180.165.18.241]:59386: 535 Incorrect authentication data (set_id=dasha9198)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.238.242.194
country_id: 3469034
description:
Jun 15 18:05:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.238.242.194 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:18:07:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:18:07:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:06:25 dovecot_login authenticator failed for H=(JWaqUUD) [141.98.10.175]:60542: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.83.28.29
country_id: 2750405
description:
Jun 15 18:06:50 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.83.28.29 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.142.137.161
country_id: 2542007
description:
[2026-06-15 18:06:56 +0000] info [whostmgrd] 41.142.137.161 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:06:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:18:07:05 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:18:07:07 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.83.28.29
country_id: 2750405
description:
2026-06-15 18:06:52 dovecot_login authenticator failed for H=(ADMIN) [45.83.28.29]:42730: 535 Incorrect authentication data (set_id=sumsda1968@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:07:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:07:24 dovecot_login authenticator failed for H=(fLQwn0zA) [141.98.10.175]:64506: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:08:47 dovecot_login authenticator failed for H=(2IILluP5pN) [141.98.10.175]:57096: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.177.200.96
country_id: 298795
description:
[2026-06-15 18:08:35 +0000] info [whostmgrd] 78.177.200.96 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 36.83.136.191
country_id: 1643084
description:
[2026-06-15 18:09:10 +0000] info [whostmgrd] 36.83.136.191 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:08:45 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:18:09:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6777962&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781546980 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:09:47 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:18:09:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7194726&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781546981 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:09:49 dovecot_login authenticator failed for H=(NDYXikzKU) [141.98.10.175]:52693: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:10:47 dovecot_login authenticator failed for H=(lZ42OP) [141.98.10.175]:53591: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:10:45 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.164.205.181
country_id: 3865483
domain: www.tdn.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.tdn.tg/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:11:49 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:11:51 dovecot_login authenticator failed for H=(T0VOH8h) [141.98.10.175]:52311: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:12:21 dovecot_login authenticator failed for H=(XMhi6qO) [141.98.10.175]:61812: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-15 18:12:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:3090: 535 Incorrect authentication data (set_id=rebels@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:12:54 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.32.88
country_id: 298795
description:
Jun 15 18:13:11 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.32.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 18:12:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:50196: 535 Incorrect authentication data (set_id=yc@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 18:12:49 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:13:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:13:25 dovecot_login authenticator failed for H=(FA7uMhL) [141.98.10.175]:56064: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.32.88
country_id: 298795
description:
Jun 15 18:13:24 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.32.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:14:43 dovecot_login authenticator failed for H=(xSLvN3w) [141.98.10.175]:57399: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:14:41 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:15:32 dovecot_login authenticator failed for H=(GGnPYyQ91) [141.98.10.175]:54286: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:15:30 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:16:27 dovecot_login authenticator failed for H=(4X6buvvps) [141.98.10.175]:53137: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:16:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:17:21 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:17:23 dovecot_login authenticator failed for H=(jqQFRvk) [141.98.10.175]:54051: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:18:49 dovecot_login authenticator failed for H=(iMY8i8p) [141.98.10.175]:59005: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.174.19.53
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/de-lombre-a-la-lumiere-les-femmes-togolaises-saffirment-grace-a-lenergie/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.174.19.53
country_id: 1562822
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/de-lombre-a-la-lumiere-les-femmes-togolaises-saffirment-grace-a-lenergie/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:18:47 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.63.234
country_id: 6252001
description:
2026-06-15 18:19:02 dovecot_plain authenticator failed for H=c-73-137-63-234.hsd1.ga.comcast.net (onptne8v6ob9un6ixd2mbu9) [73.137.63.234]:54578: 535 Incorrect authentication data (set_id=mointie.konlambigue@emt.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.163.98
country_id: 1880251
description:
[2026-06-15 18:19:39 +0000] info [whostmgrd] 104.28.163.98 - anadebfreenetmas "POST /login/ HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:19:41 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:19:43 dovecot_login authenticator failed for H=(rJfBvMY) [141.98.10.175]:53921: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.240.102.68
country_id: 6252001
description:
Jun 15 18:20:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 162.240.102.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:20:41 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:20:43 dovecot_login authenticator failed for H=(T5GZun1lEs) [141.98.10.175]:55379: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 41.207.188.29
country_id: 2363686
description:
41.207.188.29 - - [15/Jun/2026:18:21:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9858714&pdata=https%253A%252F%252Flaunetogo.tg%252Fstrategie-de-transformation-la-banque-mondiale-et-les-ptf-derriere-la-vision-du-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781547673 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/strategie-de-transformation-la-banque-mondiale-et-les-ptf-derriere-la-vision-du-togo/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:41.207.188.29


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.240.102.68
country_id: 6252001
description:
2026-06-15 18:20:35 dovecot_login authenticator failed for H=(vps-13116434.franquiaadonairh.com) [162.240.102.68]:55638: 535 Incorrect authentication data (set_id=aime.d@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:21:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 93.177.94.230
country_id: 6252001
description:
93.177.94.230 - - [15/Jun/2026:18:21:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9921131&pdata=https%253A%252F%252Fcafe.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781547708 HTTP/2.0" 302 0 cafe.tg "https://cafe.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:93.177.94.230


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 37.63.16.68
country_id: 732800
domain: togomedia24.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:18-21.37.63.16.68||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 3.80.216.18
country_id: 6252001
description:
[2026-06-15 18:22:15 +0000] info [cpaneld] 3.80.216.18 - arsetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:21:35 dovecot_login authenticator failed for H=(LfgGuJqH) [141.98.10.175]:55879: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:18:22:18 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:18:22:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:22:28 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:22:30 dovecot_login authenticator failed for H=(FMyGjcR) [141.98.10.175]:54004: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.97.108
country_id: 1814991
description:
Jun 15 18:23:17 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.97.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.97.108
country_id: 1814991
description:
2026-06-15 18:23:19 dovecot_login authenticator failed for H=([111.61.97.108]) [111.61.97.108]:17220: 535 Incorrect authentication data (set_id=media@soena.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:23:24 dovecot_login authenticator failed for H=(5bKCctUi) [141.98.10.175]:55803: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77093094
abuser: 100.52.195.126
country_id: 6252001
domain: www.en.crepsad.tg
description:


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:23:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:24:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:24:33 dovecot_login authenticator failed for H=(xKcjsQFmW) [141.98.10.175]:62369: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:25:36 dovecot_login authenticator failed for H=(2kMrXy) [141.98.10.175]:61195: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:25:34 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:18:25:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9594729&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781547934 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:26:30 dovecot_login authenticator failed for H=(3tkWg76GPb) [141.98.10.175]:53531: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.60
country_id: 2017370
description:
Jun 15 18:26:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.60
country_id: 2017370
description:
2026-06-15 18:26:33 dovecot_login authenticator failed for H=([94.16.17.139]) [178.178.222.60]:39180: 535 Incorrect authentication data (set_id=hr@anrtogo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:26:28 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.208.204.132
country_id: 1643084
description:
[2026-06-15 18:26:59 +0000] info [cpaneld] 103.208.204.132 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.135
country_id: 2635167
description:
[2026-06-15 18:27:15 +0000] info [cpaneld] 5.230.133.135 NEW wcnyaruu:ul9nYcXf_FuuWuon address=5.230.133.135,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.87.216.144
country_id: 6252001
description:
212.87.216.144 - - [15/Jun/2026:18:27:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10250695&pdata=https%253A%252F%252Fcafe.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781548043 HTTP/2.0" 302 0 cafe.tg "https://cafe.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.87.216.144


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:27:27 dovecot_login authenticator failed for H=(aRIEXU3) [141.98.10.175]:55713: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.103.121.241
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:18-28.146.103.121.241||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:27:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:28:19 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:28:21 dovecot_login authenticator failed for H=(WKXnGT0w) [141.98.10.175]:50262: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:29:21 dovecot_login authenticator failed for H=(d1jCZEmguL) [141.98.10.175]:61442: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:29:48 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:30:50 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:30:52 dovecot_login authenticator failed for H=(NiFsm8G) [141.98.10.175]:57688: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:31:45 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:31:47 dovecot_login authenticator failed for H=(yVS36Qusg) [141.98.10.175]:56063: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77093094
abuser: 100.52.195.126
country_id: 6252001
domain: www.enora.sodigaz.tg
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:32:34 dovecot_login authenticator failed for H=(VC1OqEkpw) [141.98.10.175]:52453: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.103.121.241
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:18-32.146.103.121.241||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:32:32 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.7.100.82
country_id: 298795
description:
[2026-06-15 18:33:45 +0000] info [cpaneld] 95.7.100.82 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.231.127.179
country_id: 294640
description:
[2026-06-15 18:34:07 +0000] info [cpaneld] 176.231.127.179 - davakconsul "GET /login/?login_only=1&user=davakconsul&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davakconsul (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 121.122.95.63
country_id: 1733045
description:
[2026-06-15 18:34:01 +0000] info [cpaneld] 121.122.95.63 - davakconsult "GET /login/?login_only=1&user=davakconsult&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davakconsult (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.87.200.138
country_id: 953987
description:
[2026-06-15 18:34:12 +0000] info [cpaneld] 41.87.200.138 - davakconsu "GET /login/?login_only=1&user=davakconsu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davakconsu (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:33:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.172.92.172
country_id: 2750405
description:
[2026-06-15 18:33:58 +0000] info [cpaneld] 109.172.92.172 - davakconsulti "GET /login/?login_only=1&user=davakconsulti&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davakconsulti (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:33:33 dovecot_login authenticator failed for H=(LNUe3Clk) [141.98.10.175]:65280: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.67.27.217
country_id: 3932488
description:
[2026-06-15 18:33:49 +0000] info [cpaneld] 181.67.27.217 - davakconsulting "GET /login/?login_only=1&user=davakconsulting&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davakconsulting (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.172.68.247
country_id: 3017382
description:
[2026-06-15 18:34:42 +0000] info [cpaneld] 176.172.68.247 - dav "GET /login/?login_only=1&user=dav&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dav (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.244.193.87
country_id: 3508796
description:
[2026-06-15 18:34:30 +0000] info [cpaneld] 74.244.193.87 - davakc "GET /login/?login_only=1&user=davakc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davakc (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:34:28 dovecot_login authenticator failed for H=(7XaRvgQ) [141.98.10.175]:59363: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.189.217.84
country_id: 3865483
description:
[2026-06-15 18:34:26 +0000] info [cpaneld] 45.189.217.84 - davakco "GET /login/?login_only=1&user=davakco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davakco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.85.252.104
country_id: 3469034
description:
[2026-06-15 18:34:35 +0000] info [cpaneld] 177.85.252.104 - davak "GET /login/?login_only=1&user=davak&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davak (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.185.159.52
country_id: 953987
description:
[2026-06-15 18:34:40 +0000] info [cpaneld] 197.185.159.52 - dava "GET /login/?login_only=1&user=dava&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dava (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.29.220.48
country_id: 6252001
description:
Jun 15 18:34:41 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.29.220.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:34:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.29.220.48
country_id: 6252001
description:
2026-06-15 18:34:43 dovecot_plain authenticator failed for H=pool-108-29-220-48.nycmny.fios.verizon.net (7w99gwdvpmeef3gbuj3zp7f84c) [108.29.220.48]:40523: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.163.213.174
country_id: 1562822
description:
[2026-06-15 18:34:48 +0000] info [cpaneld] 14.163.213.174 - da "GET /login/?login_only=1&user=da&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user da (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.63.26.191
country_id: 3686110
description:
[2026-06-15 18:34:21 +0000] info [cpaneld] 181.63.26.191 - davakcon "GET /login/?login_only=1&user=davakcon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davakcon (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:35:35 dovecot_login authenticator failed for H=(GQVDTPC) [141.98.10.175]:56279: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 3.80.216.18
country_id: 6252001
description:
[2026-06-15 18:35:35 +0000] info [cpaneld] 3.80.216.18 - arsetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.177.210.193
country_id: 3469034
description:
2026-06-15 18:36:13 dovecot_login authenticator failed for H=(ipmapt-72-195-101-102.oc.oc.cox.net) [45.177.210.193]:59655: 535 Incorrect authentication data (set_id=felix.barigao@arse.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.177.210.193
country_id: 3469034
description:
Jun 15 18:36:11 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.177.210.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:35:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:36:32 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:36:34 dovecot_login authenticator failed for H=(YpILHnz4) [141.98.10.175]:52972: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 38.156.230.18
country_id: 3686110
description:
38.156.230.18 - - [15/Jun/2026:18:37:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7038875&pdata=https%253A%252F%252Fcivilemagazine.tg%252Ftag%252Fsfi%252F%253Famp%253D1&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781548630 HTTP/2.0" 302 0 civilemagazine.tg "https://civilemagazine.tg/tag/sfi/?amp=1" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.7467.1356 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:38.156.230.18


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:37:38 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:18:37:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.126.241.209
country_id: 3437598
description:
[2026-06-15 18:37:56 +0000] info [cpaneld] 181.126.241.209 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.60.66.109
country_id: 3895114
description:
[2026-06-15 18:38:07 +0000] info [cpaneld] 179.60.66.109 - togomedia2 "GET /login/?login_only=1&user=togomedia2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomedia2 (has_cpuser_file failed)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:18:37:53 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.124.11.199
country_id: 3469034
description:
[2026-06-15 18:38:15 +0000] info [cpaneld] 177.124.11.199 - togomed "GET /login/?login_only=1&user=togomed&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomed (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.237.121.214
country_id: 99237
description:
[2026-06-15 18:38:02 +0000] info [cpaneld] 212.237.121.214 - togomedia24tg "GET /login/?login_only=1&user=togomedia24tg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomedia24tg (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:37:40 dovecot_login authenticator failed for H=(mSKWcq9) [141.98.10.175]:53247: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.26.30.63
country_id: 2017370
description:
[2026-06-15 18:38:10 +0000] info [cpaneld] 95.26.30.63 - togomedia "GET /login/?login_only=1&user=togomedia&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomedia (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.244.108.250
country_id: 2589581
description:
[2026-06-15 18:37:58 +0000] info [cpaneld] 154.244.108.250 - togomedia24 "GET /login/?login_only=1&user=togomedia24&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomedia24 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.201.239.7
country_id: 99237
description:
[2026-06-15 18:38:23 +0000] info [cpaneld] 62.201.239.7 - togom "GET /login/?login_only=1&user=togom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.39.109.86
country_id: 3469034
description:
[2026-06-15 18:38:32 +0000] info [cpaneld] 189.39.109.86 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 131.0.207.242
country_id: 3469034
description:
[2026-06-15 18:38:37 +0000] info [cpaneld] 131.0.207.242 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:38:44 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:38:46 dovecot_login authenticator failed for H=(9dDcW3UJ34) [141.98.10.175]:62831: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:39:45 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:39:47 dovecot_login authenticator failed for H=(G91Wj0vsDr) [141.98.10.175]:63511: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:40:37 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:40:39 dovecot_login authenticator failed for H=(a8pHzVLXK) [141.98.10.175]:62284: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.241.106
country_id: 2750405
description:
Jun 15 18:40:53 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.241.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.241.106
country_id: 2750405
description:
2026-06-15 18:40:55 dovecot_login authenticator failed for H=server.fusionmail.shop (tQgYp4N6) [91.92.241.106]:60978: 535 Incorrect authentication data (set_id=africapanditogo)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 85.251.205.191
country_id: 2510769
description:
85.251.205.191 - - [15/Jun/2026:18:42:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7194055&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fremise-de-diplomes-iaec%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781548935 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/remise-de-diplomes-iaec/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.9223.1273 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:85.251.205.191


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:41:37 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.241.106
country_id: 2750405
description:
Jun 15 18:41:34 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.241.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.241.106
country_id: 2750405
description:
2026-06-15 18:41:36 dovecot_login authenticator failed for H=server.fusionmail.shop (RdLGQsUbDK) [91.92.241.106]:63717: 535 Incorrect authentication data (set_id=africapanditogo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:41:39 dovecot_login authenticator failed for H=(Sqeo3fpqv) [141.98.10.175]:59105: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:42:52 dovecot_login authenticator failed for H=(TRR0Jgb) [141.98.10.175]:56458: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.45.140
country_id: 2363686
description:
[2026-06-15 18:42:20 +0000] info [webmaild] 196.170.45.140 - wages@wages.tg "GET /cpsess7353698058/?=undefined&login=1&post_login=36253595934670 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.168.0.186] != Current IP Address [196.170.45.140]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:42:50 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.71.242.1
country_id: 285570
description:
[2026-06-15 18:43:44 +0000] info [cpaneld] 188.71.242.1 - jcdc "GET /login/?login_only=1&user=jcdc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user jcdc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.211.166.50
country_id: 3895114
description:
[2026-06-15 18:43:25 +0000] info [cpaneld] 190.211.166.50 - jcdconsul "GET /login/?login_only=1&user=jcdconsul&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user jcdconsul (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 3.80.216.18
country_id: 6252001
description:
[2026-06-15 18:44:06 +0000] info [cpaneld] 3.80.216.18 - stephane "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user stephane (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.45.140
country_id: 2363686
description:
[2026-06-15 18:44:13 +0000] info [webmaild] 196.170.45.140 - wages@wages.tg "GET /cpsess7353698058/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.168.0.186] != Current IP Address [196.170.45.140]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:43:21 dovecot_login authenticator failed for H=(iR6Kkd) [141.98.10.175]:61739: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.19.121.138
country_id: 2017370
description:
[2026-06-15 18:43:32 +0000] info [cpaneld] 195.19.121.138 - jcdcons "GET /login/?login_only=1&user=jcdcons&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user jcdcons (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:43:47 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.181.128.131
country_id: 3865483
description:
[2026-06-15 18:43:52 +0000] info [cpaneld] 45.181.128.131 - jc "GET /login/?login_only=1&user=jc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user jc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.117.164.61
country_id: 2510769
description:
[2026-06-15 18:43:27 +0000] info [cpaneld] 79.117.164.61 - jcdconsu "GET /login/?login_only=1&user=jcdconsu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user jcdconsu (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.0.186
country_id: 2363686
description:
[2026-06-15 18:44:13 +0000] info [webmaild] 196.168.0.186 - wages@wages.tg "GET /cpsess7353698058/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.150.146.81
country_id: 3469034
description:
[2026-06-15 18:43:49 +0000] info [cpaneld] 170.150.146.81 - jcd "GET /login/?login_only=1&user=jcd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user jcd (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:18:44:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13397401&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781549055 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 153.67.187.66
country_id: 3865483
description:
[2026-06-15 18:44:48 +0000] info [cpaneld] 153.67.187.66 - togofarm "GET /login/?login_only=1&user=togofarm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togofarm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.3.105.193
country_id: 2921044
description:
[2026-06-15 18:44:50 +0000] info [cpaneld] 77.3.105.193 - togofarmtg "GET /login/?login_only=1&user=togofarmtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togofarmtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.237.119.84
country_id: 99237
description:
[2026-06-15 18:44:53 +0000] info [cpaneld] 212.237.119.84 - togofar "GET /login/?login_only=1&user=togofar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togofar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.5.111.179
country_id: 298795
description:
[2026-06-15 18:44:57 +0000] info [cpaneld] 95.5.111.179 - togofa "GET /login/?login_only=1&user=togofa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togofa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.127.84.149
country_id: 1210997
description:
[2026-06-15 18:45:04 +0000] info [cpaneld] 103.127.84.149 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.45.140
country_id: 2363686
description:
[2026-06-15 18:44:23 +0000] info [webmaild] 196.170.45.140 - wages@wages.tg "GET /cpsess4457685102/3rdparty/roundcube/plugins/return_to_webmail/skins/elastic/return_to_webmail.css?s=1749492914 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.168.0.186] != Current IP Address [196.170.45.140]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.206.172.112
country_id: 99237
description:
[2026-06-15 18:45:00 +0000] info [cpaneld] 185.206.172.112 - togof "GET /login/?login_only=1&user=togof&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togof (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2.241.212.41
country_id: 2921044
description:
[2026-06-15 18:45:10 +0000] info [cpaneld] 2.241.212.41 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:44:40 dovecot_login authenticator failed for H=(V9yp7H) [141.98.10.175]:52262: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:44:38 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.191.95.238
country_id: 3469034
description:
[2026-06-15 18:44:42 +0000] info [cpaneld] 38.191.95.238 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.0.186
country_id: 2363686
description:
[2026-06-15 18:45:23 +0000] info [webmaild] 196.168.0.186 - wages@wages.tg "GET /cpsess4426779072/?=undefined&login=1&post_login=36253595934670 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.170.45.140] != Current IP Address [196.168.0.186]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:45:29 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:45:31 dovecot_login authenticator failed for H=(7EAgntI) [141.98.10.175]:51081: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.117.167.207
country_id: 2510769
description:
[2026-06-15 18:45:34 +0000] info [cpaneld] 79.117.167.207 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.12.168.191
country_id: 3895114
description:
[2026-06-15 18:45:59 +0000] info [cpaneld] 190.12.168.191 - vitrin "GET /login/?login_only=1&user=vitrin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitrin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.118.82.200
country_id: 2542007
description:
[2026-06-15 18:46:03 +0000] info [cpaneld] 196.118.82.200 - vitr "GET /login/?login_only=1&user=vitr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.192.27.26
country_id: 2017370
description:
[2026-06-15 18:46:11 +0000] info [cpaneld] 37.192.27.26 - vi "GET /login/?login_only=1&user=vi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vi (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.45.140
country_id: 2363686
description:
[2026-06-15 18:45:33 +0000] info [webmaild] 196.170.45.140 - wages@wages.tg "GET /cpsess4426779072/?=undefined&login=1&post_login=36253595934670 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.168.0.186] != Current IP Address [196.170.45.140]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.51.30.118
country_id: 3865483
description:
[2026-06-15 18:45:39 +0000] info [cpaneld] 38.51.30.118 - vitrinenewstg "GET /login/?login_only=1&user=vitrinenewstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitrinenewstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.231.164.189
country_id: 3996063
description:
[2026-06-15 18:45:49 +0000] info [cpaneld] 189.231.164.189 - vitrinene "GET /login/?login_only=1&user=vitrinene&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitrinene (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.23.94.242
country_id: 3865483
description:
[2026-06-15 18:46:08 +0000] info [cpaneld] 181.23.94.242 - vit "GET /login/?login_only=1&user=vit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vit (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:46:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.168.0.186
country_id: 2363686
description:
[2026-06-15 18:46:30 +0000] info [webmaild] 196.168.0.186 - wages@wages.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.170.45.140
country_id: 2363686
description:
[2026-06-15 18:46:23 +0000] info [webmaild] 196.170.45.140 - wages@wages.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:46:28 dovecot_login authenticator failed for H=(CcJAv8Smb) [141.98.10.175]:58347: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:47:21 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:47:23 dovecot_login authenticator failed for H=(2JUzMoNWHk) [141.98.10.175]:57189: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.152.99
country_id: 3469034
description:
2026-06-15 18:47:49 dovecot_plain authenticator failed for H=([10.44.153.3]) [104.28.152.99]:40067: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 3.80.216.18
country_id: 6252001
description:
[2026-06-15 18:47:46 +0000] info [cpaneld] 3.80.216.18 - einguval "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user einguval (has_cpuser_file failed)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.171.34.157
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/wp-content/plugins/onesignal-free-web-push-notifications/sdk_files/onesignalsdkworker.js?appid=8efd3276-8d5b-4b62-bbd3-6ed125ca9f51&sdkversion=160606||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:48:49 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2.217.140.140
country_id: 2635167
description:
[2026-06-15 18:48:41 +0000] info [whostmgrd] 2.217.140.140 - camaegdtomgo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:48:21 dovecot_login authenticator failed for H=(Xi39Qw) [141.98.10.175]:55476: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 95.95.214.132
country_id: 2264397
description:
95.95.214.132 - - [15/Jun/2026:18:48:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9606500&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcote-divoire-voici-les-nouveaux-prix-des-produits-petroliers-pour-fevrier-2026%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781549316 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/cote-divoire-voici-les-nouveaux-prix-des-produits-petroliers-pour-fevrier-2026/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.9062.1078 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:95.95.214.132


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:49:21 dovecot_login authenticator failed for H=(kbRxSbNA0) [141.98.10.175]:63652: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:49:42 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 3.80.216.18
country_id: 6252001
description:
[2026-06-15 18:50:42 +0000] info [cpaneld] 3.80.216.18 - yvwaocrr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yvwaocrr (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:50:40 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:50:42 dovecot_login authenticator failed for H=(nuJcCa) [141.98.10.175]:53344: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:51:34 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 3.80.216.18
country_id: 6252001
description:
[2026-06-15 18:51:48 +0000] info [cpaneld] 3.80.216.18 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:51:36 dovecot_login authenticator failed for H=(cwDu65r) [141.98.10.175]:60656: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:52:32 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 3.80.216.18
country_id: 6252001
description:
[2026-06-15 18:53:15 +0000] info [cpaneld] 3.80.216.18 - crepsad "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:52:34 dovecot_login authenticator failed for H=(zLNYdLhKK) [141.98.10.175]:54801: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:18:53:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:18:53:05 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 3.80.216.18
country_id: 6252001
description:
[2026-06-15 18:53:09 +0000] info [cpaneld] 3.80.216.18 - pharma "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pharma (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 194.180.237.235
country_id: 6252001
description:
194.180.237.235 - - [15/Jun/2026:18:54:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10394217&pdata=https%253A%252F%252Fcafe.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781549638 HTTP/2.0" 302 0 cafe.tg "https://cafe.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:194.180.237.235


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:53:30 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:53:32 dovecot_login authenticator failed for H=(f7X21PH8) [141.98.10.175]:50769: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:54:29 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:54:31 dovecot_login authenticator failed for H=(OD3xxv5a) [141.98.10.175]:61430: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:55:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:55:25 dovecot_login authenticator failed for H=(HSGiL4fZO2) [141.98.10.175]:54119: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 41.207.189.253
country_id: 2363686
description:
[2026-06-15 18:56:02 +0000] info [webmaild] 41.207.189.253 - kakue@togointerim.net "POST /cpsess5529419790/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.170.118.10] != Current IP Address [41.207.189.253]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:18:56:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6515818&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781549813 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:56:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:56:24 dovecot_login authenticator failed for H=(pRYw4y91) [141.98.10.175]:50248: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 94.103.183.201
country_id: 2017370
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:94.103.183.201||TA:94.103.183.201||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:57:36 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:57:38 dovecot_login authenticator failed for H=(76dsGp9) [141.98.10.175]:52504: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 94.103.183.201
country_id: 2017370
domain: butodra.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:18-58.94.103.183.201||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:58:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 3.80.216.18
country_id: 6252001
description:
[2026-06-15 18:58:21 +0000] info [cpaneld] 3.80.216.18 - dev03 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dev03 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:58:25 dovecot_login authenticator failed for H=(rcJ5HwXnaW) [141.98.10.175]:57611: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 140.235.170.29
country_id: 6252001
description:
140.235.170.29 - - [15/Jun/2026:18:58:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6647649&pdata=https%253A%252F%252Fcafe.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781549926 HTTP/2.0" 302 0 cafe.tg "https://cafe.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:140.235.170.29


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.245.110.21
country_id: 6252001
description:
2026-06-15 19:00:08 dovecot_plain authenticator failed for H=(vudyqx8qgjxdrlu66ep2gw5ef) [172.245.110.21]:35812: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:59:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:59:25 dovecot_login authenticator failed for H=(aGWhdBlsmT) [141.98.10.175]:51281: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.213.93
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/ecobank-sierra-leone-signe-deux-financements-miniers-strategiques/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.213.93
country_id: 1562822
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/ecobank-sierra-leone-signe-deux-financements-miniers-strategiques/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:00:47 dovecot_login authenticator failed for H=(RyzuMa5BO) [141.98.10.175]:54625: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:00:45 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:01:47 dovecot_login authenticator failed for H=(cJ2LR785c) [141.98.10.175]:64762: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:01:45 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:02:20 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:02:22 dovecot_login authenticator failed for H=(dVy6niL) [141.98.10.175]:63189: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 34.16.241.179
country_id: 6252001
domain: mail.sotranetogo.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/wordpress/.git/config||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 173.214.173.120
country_id: 6252001
domain: besteva1.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/143.0.7499.169 Safari/537.36||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:03:47 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:03:49 dovecot_login authenticator failed for H=(cWDjrOnV3) [141.98.10.175]:54032: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:04:41 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:04:43 dovecot_login authenticator failed for H=(fQcM9iyc5J) [141.98.10.175]:63652: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:05:46 dovecot_login authenticator failed for H=(Ub8idgr1b) [141.98.10.175]:59609: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:05:44 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 178.52.93.212
country_id: 163843
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3b02b662e781b8bd15edbb49388fb8423cd2cc68||Title:fwh1qtg7def9tqg||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:06:37 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:06:39 dovecot_login authenticator failed for H=(guZ2xD) [141.98.10.175]:52005: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:07:29 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:07:31 dovecot_login authenticator failed for H=(hFjkjE2Tz) [141.98.10.175]:60783: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 178.52.93.212
country_id: 163843
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9fa7802b7dc27568b6374b9d39f177af3df7e24d||Title:oh4p8fz0ns1v2wuu7l||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:08:28 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:08:30 dovecot_login authenticator failed for H=(zJ6O5S0zpY) [141.98.10.175]:55533: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 178.52.93.212
country_id: 163843
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f5d15bb6812b9cb2ea329382cb3be80d82a64331||Title:atua4ktrftg2powqxj||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:09:49 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 178.52.93.212
country_id: 163843
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:47beec4c35154a04051132b977e72c49f2ad9216||Title:uvsq6trrl3e7rrkcdk||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:19:09:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:09:23 dovecot_login authenticator failed for H=(YMvknx) [141.98.10.175]:62673: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:19:09:35 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.112.65.146
country_id: 2661886
description:
[2026-06-15 19:10:35 +0000] info [cpaneld] 213.112.65.146 - togocarrierebet "GET /login/?login_only=1&user=togocarrierebet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocarrierebet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.191.112.218
country_id: 337996
description:
[2026-06-15 19:10:46 +0000] info [cpaneld] 196.191.112.218 - togocarrier "GET /login/?login_only=1&user=togocarrier&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocarrier (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.6.19.195
country_id: 3625428
description:
[2026-06-15 19:11:02 +0000] info [cpaneld] 190.6.19.195 - togoc "GET /login/?login_only=1&user=togoc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.60.64.254
country_id: 3895114
description:
[2026-06-15 19:11:13 +0000] info [cpaneld] 179.60.64.254 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.81.93.236
country_id: 3469034
description:
[2026-06-15 19:10:51 +0000] info [cpaneld] 170.81.93.236 - togocarri "GET /login/?login_only=1&user=togocarri&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocarri (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:10:20 dovecot_login authenticator failed for H=(0Upf4BE) [141.98.10.175]:56306: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.218.159.42
country_id: 3932488
description:
[2026-06-15 19:10:41 +0000] info [cpaneld] 201.218.159.42 - togocarriereb "GET /login/?login_only=1&user=togocarriereb&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocarriereb (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.176.196.248
country_id: 3865483
description:
[2026-06-15 19:10:44 +0000] info [cpaneld] 201.176.196.248 - togocarriere "GET /login/?login_only=1&user=togocarriere&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocarriere (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:10:47 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.163.89.253
country_id: 3895114
description:
[2026-06-15 19:10:59 +0000] info [cpaneld] 181.163.89.253 - togoca "GET /login/?login_only=1&user=togoca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 42.114.206.90
country_id: 1562822
description:
[2026-06-15 19:11:06 +0000] info [cpaneld] 42.114.206.90 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.145.128.127
country_id: 294640
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:45.145.128.127||TA:45.145.128.127||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.201.32.239
country_id: 290291
description:
[2026-06-15 19:10:56 +0000] info [cpaneld] 88.201.32.239 - togocar "GET /login/?login_only=1&user=togocar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocar (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 178.52.93.212
country_id: 163843
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c8a12bb20fbb7227a8fc709afb52f5d5469f1c45||Title:rfycrrwcsg1gq4||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.46.115.163
country_id: 3686110
description:
[2026-06-15 19:10:31 +0000] info [cpaneld] 201.46.115.163 - togocarrierebeto "GET /login/?login_only=1&user=togocarrierebeto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocarrierebeto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.154.23.1
country_id: 2635167
description:
[2026-06-15 19:10:48 +0000] info [cpaneld] 86.154.23.1 - togocarrie "GET /login/?login_only=1&user=togocarrie&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocarrie (has_cpuser_file failed)


plugin: modsec
rule: 77350907
name: IM360 WAF: OAST callback pattern detected
abuser: 146.70.142.130
country_id: 1269750
domain: cafe.tg
description:
IM360 WAF: OAST callback pattern detected||MV:/admin/actions/app/resource-js?url=https://d8l9gdao12pqut97md70idefhsok95pzw.oast.site/cpresources/x.js||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.77.130.247
country_id: 174982
description:
[2026-06-15 19:10:24 +0000] info [cpaneld] 5.77.130.247 - togocarrierebetons "GET /login/?login_only=1&user=togocarrierebetons&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocarrierebetons (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:11:46 dovecot_login authenticator failed for H=(o5o4NQNMWf) [141.98.10.175]:63119: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 178.52.93.212
country_id: 163843
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0b59d0f0a1d976480a59466cf030a4ec76647dbc||Title:iv66q83m5ykuti||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:11:44 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 178.52.93.212
country_id: 163843
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:lucashd.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:edefc56cc41e9ba926e4ffa223d7bc68ed00c3c0||Title:wcbxpr3ztax1em||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:12:43 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:12:45 dovecot_login authenticator failed for H=(r0XiDiC0) [141.98.10.175]:57042: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:19:13:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054810&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781550787 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:13:43 dovecot_login authenticator failed for H=(EOppAb) [141.98.10.175]:50700: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:13:41 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:14:42 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:14:44 dovecot_login authenticator failed for H=(fzKgd7) [141.98.10.175]:61952: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:15:38 dovecot_login authenticator failed for H=(PpPC7V4j) [141.98.10.175]:53889: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:15:36 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:16:37 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:16:39 dovecot_login authenticator failed for H=(g8lMAY9un) [141.98.10.175]:49260: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.106.190
country_id: 3175395
description:
Jun 15 19:16:54 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.106.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:17:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.64.220.79
country_id: 2363686
description:
[2026-06-15 19:17:35 +0000] info [cpaneld] 102.64.220.79 - vuvwskxh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 102.64.220.79
country_id: 2363686
description:
[2026-06-15 19:17:41 +0000] info [cpaneld] 102.64.220.79 NEW cipvzfnv:jfJxKZbfwUqjS0_1 address=102.64.220.79,app=cpaneld,creator=cipvzfnv,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.165.35.16
country_id: 3175395
description:
[2026-06-15 19:17:53 +0000] info [cpaneld] 94.165.35.16 - lv "GET /login/?login_only=1&user=lv&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lv (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:17:33 dovecot_login authenticator failed for H=(liaRktF20J) [141.98.10.175]:57960: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.70.38.90
country_id: 285570
description:
[2026-06-15 19:17:43 +0000] info [cpaneld] 188.70.38.90 - lvdt "GET /login/?login_only=1&user=lvdt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lvdt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.42.183.20
country_id: 3895114
description:
[2026-06-15 19:17:51 +0000] info [cpaneld] 181.42.183.20 - lvd "GET /login/?login_only=1&user=lvd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lvd (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.64.220.79
country_id: 2363686
description:
[2026-06-15 19:18:04 +0000] info [cpaneld] 102.64.220.79 - cipvzfnv "GET / HTTP/1.1" DEFERRED LOGIN cpaneld: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:18:20 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:18:22 dovecot_login authenticator failed for H=(yKNM6r) [141.98.10.175]:50098: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 117.5.146.72
country_id: 1562822
description:
[2026-06-15 19:18:23 +0000] info [cpaneld] 117.5.146.72 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77093094
abuser: 100.52.195.126
country_id: 6252001
domain: www.f.pnls.tg
description:


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.208.87.63
country_id: 3469034
description:
[2026-06-15 19:18:47 +0000] info [cpaneld] 186.208.87.63 - uco "GET /login/?login_only=1&user=uco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user uco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.28.15.224
country_id: 3686110
description:
[2026-06-15 19:18:37 +0000] info [cpaneld] 190.28.15.224 - ucoang "GET /login/?login_only=1&user=ucoang&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucoang (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.243.26.189
country_id: 6290252
description:
[2026-06-15 19:18:43 +0000] info [cpaneld] 77.243.26.189 - ucoa "GET /login/?login_only=1&user=ucoa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucoa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.34.33.231
country_id: 1522867
description:
[2026-06-15 19:18:41 +0000] info [cpaneld] 5.34.33.231 - ucoan "GET /login/?login_only=1&user=ucoan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucoan (has_cpuser_file failed)


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 34.182.143.25
country_id: 6252001
domain: autodiscover.sotranetogo.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/sendgrid/.env.production||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:19:42 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 45.41.173.222
country_id: 6252001
domain: 24heureinfo.tg
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS_NAMES:gt;If you cherished this post and you would like to obtain extra info concerning ||MV:gt;If you cherished this post and you would like to obtain extra info concerning ||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:19:44 dovecot_login authenticator failed for H=(UC23y5w) [141.98.10.175]:52939: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:20:34 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:20:36 dovecot_login authenticator failed for H=(Eu8Lwtkb) [141.98.10.175]:55002: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:21:36 dovecot_login authenticator failed for H=(trcYG2r) [141.98.10.175]:49640: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 72.255.23.101
country_id: 1168579
description:
72.255.23.101 - - [15/Jun/2026:19:22:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10448234&pdata=https%253A%252F%252Fcpanel.ccit.tg%252F%253Flocale%253Dvi&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781551332 HTTP/2.0" 302 0 cpanel.ccit.tg "https://cpanel.ccit.tg/?locale=vi" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:72.255.23.101


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:21:34 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.241
country_id: 3469034
description:
Jun 15 19:21:34 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:22:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:22:33 dovecot_login authenticator failed for H=(gyb0hpe4i) [141.98.10.175]:50922: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 79.116.226.204
country_id: 2510769
description:
79.116.226.204 - - [15/Jun/2026:19:22:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10317168&pdata=https%253A%252F%252Ftogodailynews.tg%252Felectricite-la-ceet-annonce-des-perturbations-dans-le-yoto-et-le-bas-mono-le-16-avril%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781551356 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/electricite-la-ceet-annonce-des-perturbations-dans-le-yoto-et-le-bas-mono-le-16-avril/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2390.1951 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:79.116.226.204


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.159
country_id: 3017382
description:
[2026-06-15 19:22:46 +0000] info [cpaneld] 5.231.64.159 NEW wcnyaruu:E0sM3ZC5m_k4FRzF address=5.231.64.159,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 190.213.155.86
country_id: 3573591
description:
190.213.155.86 - - [15/Jun/2026:19:24:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13134229&pdata=https%253A%252F%252Fmacite.tg%252Fcategory%252Ftourisme%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781551447 HTTP/2.0" 302 0 macite.tg "https://macite.tg/category/tourisme/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2320.1079 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:190.213.155.86


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:23:36 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:23:38 dovecot_login authenticator failed for H=(dhJvtV4ob) [141.98.10.175]:55054: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:19:23:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:19:23:43 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:24:32 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:24:34 dovecot_login authenticator failed for H=(fbzKu8A) [141.98.10.175]:49180: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:25:31 dovecot_login authenticator failed for H=(iqTPtXgW) [141.98.10.175]:53981: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:25:29 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.214.124.244
country_id: 3469034
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/events/8 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.29.120
country_id: 2363686
description:
[2026-06-15 19:26:16 +0000] info [webmaild] 196.170.29.120 - emt@emt.tg "GET /cpsess6657688824/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:26:23 dovecot_login authenticator failed for H=(e8gZ3xN7iT) [141.98.10.175]:53822: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:26:21 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:19:27:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9859442&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781551639 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:27:45 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:27:47 dovecot_login authenticator failed for H=(PMVIwoh7k4) [141.98.10.175]:49195: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.215.136.134
country_id: 6252001
description:
Jun 15 19:28:42 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.215.136.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.215.136.134
country_id: 6252001
description:
2026-06-15 19:28:44 dovecot_plain authenticator failed for H=ip-74-215-136-134.dynamic.fuse.net (cdryfr253o9gtnzeccxwe7j) [74.215.136.134]:40421: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:28:38 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:28:40 dovecot_login authenticator failed for H=(EmAT7ceh) [141.98.10.175]:56982: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:29:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:29:33 dovecot_login authenticator failed for H=(SZvezfJYC) [141.98.10.175]:54571: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:30:31 dovecot_login authenticator failed for H=(JfrR5Ye) [141.98.10.175]:55371: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:30:29 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:31:34 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:31:36 dovecot_login authenticator failed for H=(y6ispWR) [141.98.10.175]:58760: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:32:28 dovecot_login authenticator failed for H=(JRJgB4d9d) [141.98.10.175]:55717: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.137.95.118
country_id: 6252001
description:
[2026-06-15 19:32:44 +0000] info [cpaneld] 73.137.95.118 - iyfttuec "GET / HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:32:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:33:28 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:33:30 dovecot_login authenticator failed for H=(geD5IBD) [141.98.10.175]:49913: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.225.195.34
country_id: 3865483
description:
Jun 15 19:34:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.225.195.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:34:29 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:34:31 dovecot_login authenticator failed for H=(tTtBRDzF0) [141.98.10.175]:60046: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:35:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:35:24 dovecot_login authenticator failed for H=(Hm7YR3kuR) [141.98.10.175]:53639: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:36:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.176
country_id: 1880251
description:
47.128.96.176 - - [15/Jun/2026:19:36:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988970&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcafe-yoka-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781552216 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cafe-yoka-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.176


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:36:28 dovecot_login authenticator failed for H=(wFMzrQjCn) [141.98.10.175]:61933: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:19:37:23 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:37:32 dovecot_login authenticator failed for H=(6Zxgwc) [141.98.10.175]:65442: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:37:30 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 206.232.103.133
country_id: 6252001
domain: crepsad.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:206.232.103.133||TA:206.232.103.133||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:19:37:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.210.132.62
country_id: 6252001
domain: crepsad.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:192.210.132.62||TA:192.210.132.62||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:38:33 dovecot_login authenticator failed for H=(rxKQbdLLb) [141.98.10.175]:51387: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:38:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.142
country_id: 1880251
description:
47.128.96.142 - - [15/Jun/2026:19:39:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856621&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdemande-de-duplication-des-certificats-de-nationalite-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781552379 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/demande-de-duplication-des-certificats-de-nationalite-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.142


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:39:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:39:24 dovecot_login authenticator failed for H=(8KEqWMnQe5) [141.98.10.175]:54482: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:40:43 dovecot_login authenticator failed for H=(qGHvMA) [141.98.10.175]:51033: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:40:41 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.169
country_id: 1880251
description:
47.128.96.169 - - [15/Jun/2026:19:41:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935210&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fjeune-assassine-a-adakpame%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781552462 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/jeune-assassine-a-adakpame/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.169


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.151
country_id: 1880251
description:
47.128.96.151 - - [15/Jun/2026:19:41:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7182997&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Faugustin-kossi%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781552490 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/augustin-kossi/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.151


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.172
country_id: 1880251
description:
47.128.96.172 - - [15/Jun/2026:19:41:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10013126&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Finscription-a-luniversite-de-lome-ul%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781552496 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/inscription-a-luniversite-de-lome-ul/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.172


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:41:40 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:19:42:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9868188&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781552528 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.190
country_id: 1880251
description:
47.128.96.190 - - [15/Jun/2026:19:41:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803673&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcafe-yoka-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781552481 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cafe-yoka-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.190


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:41:42 dovecot_login authenticator failed for H=(T8uOCk0WI0) [141.98.10.175]:60252: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:42:35 dovecot_login authenticator failed for H=(Yh9MJCF) [141.98.10.175]:55609: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 34.185.189.167
country_id: 2921044
domain: mail.conseilnsaftogo.org
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/wp-content/.git/config||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.189
country_id: 1880251
description:
47.128.96.189 - - [15/Jun/2026:19:42:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131351&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcafe-yoka-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781552557 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cafe-yoka-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.189


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.181
country_id: 1880251
description:
47.128.96.181 - - [15/Jun/2026:19:43:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10382277&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Finscription-a-luniversite-de-lome-ul%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781552594 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/inscription-a-luniversite-de-lome-ul/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.181


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.120
country_id: 1880251
description:
47.128.96.120 - - [15/Jun/2026:19:42:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12937577&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmediatheque-de-linstitut-francais-du-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781552544 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/mediatheque-de-linstitut-francais-du-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.120


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:42:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:43:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 31.134.11.183
country_id: 241170
description:
31.134.11.183 - - [15/Jun/2026:19:43:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10055064&pdata=https%253A%252F%252Fcafe.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781552631 HTTP/2.0" 302 0 cafe.tg "https://cafe.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:31.134.11.183


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:43:33 dovecot_login authenticator failed for H=(946AFBTT) [141.98.10.175]:62655: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.169
country_id: 1880251
description:
47.128.96.169 - - [15/Jun/2026:19:43:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10445205&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvehicules-blindes-de-roch-kabore-cribles-de-balles%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781552628 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/vehicules-blindes-de-roch-kabore-cribles-de-balles/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.169


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.141
country_id: 1880251
description:
47.128.96.141 - - [15/Jun/2026:19:44:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9986457&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-augmentation-prix-produits-petroliers-2026%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781552694 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-augmentation-prix-produits-petroliers-2026/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.141


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:44:29 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:44:31 dovecot_login authenticator failed for H=(UvehPpFxYL) [141.98.10.175]:50068: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.133
country_id: 1880251
description:
47.128.96.133 - - [15/Jun/2026:19:44:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6397337&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fnouveaux-variants-de-coronavirus%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781552675 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/nouveaux-variants-de-coronavirus/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.133


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:45:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:45:28 dovecot_login authenticator failed for H=(qzWah2fY8Y) [141.98.10.175]:64370: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.183
country_id: 1880251
description:
47.128.96.183 - - [15/Jun/2026:19:45:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9936540&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconference-interafricaine-des-marches-dassurances-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781552740 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/conference-interafricaine-des-marches-dassurances-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.183


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 77.83.27.224
country_id: 6252001
description:
77.83.27.224 - - [15/Jun/2026:19:45:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6382278&pdata=https%253A%252F%252Fcafe.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781552758 HTTP/2.0" 302 0 cafe.tg "https://cafe.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:77.83.27.224


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.35.67.103
country_id: 831053
description:
[2026-06-15 19:45:56 +0000] info [whostmgrd] 37.35.67.103 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:46:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:46:25 dovecot_login authenticator failed for H=(e1fBJBrX) [141.98.10.175]:51705: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:47:20 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:47:22 dovecot_login authenticator failed for H=(ngFa8Qwrg) [141.98.10.175]:52978: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:48:43 dovecot_login authenticator failed for H=(sSgViB2b) [141.98.10.175]:51598: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:48:41 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:49:28 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:49:30 dovecot_login authenticator failed for H=(yyaMuT4T5V) [141.98.10.175]:62422: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:50:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:50:27 dovecot_login authenticator failed for H=(97KM7PWR) [141.98.10.175]:60936: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 125.212.158.221
country_id: 1562822
description:
[2026-06-15 19:52:04 +0000] info [cpaneld] 125.212.158.221 - caissederetrait "GET /login/?login_only=1&user=caissederetrait&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissederetrait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.43.79.245
country_id: 2623032
description:
[2026-06-15 19:52:00 +0000] info [cpaneld] 92.43.79.245 - caissederetraite "GET /login/?login_only=1&user=caissederetraite&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissederetraite (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:51:39 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:51:41 dovecot_login authenticator failed for H=(pU18BJFp) [141.98.10.175]:54594: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.225.201.168
country_id: 1562822
description:
[2026-06-15 19:52:10 +0000] info [cpaneld] 171.225.201.168 - caissederetrai "GET /login/?login_only=1&user=caissederetrai&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissederetrai (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 153.51.224.42
country_id: 3625428
description:
[2026-06-15 19:52:15 +0000] info [cpaneld] 153.51.224.42 - caissederetr "GET /login/?login_only=1&user=caissederetr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissederetr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 139.64.98.237
country_id: 102358
description:
[2026-06-15 19:51:51 +0000] info [cpaneld] 139.64.98.237 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.107.81.235
country_id: 290557
description:
[2026-06-15 19:52:19 +0000] info [cpaneld] 5.107.81.235 - caissederet "GET /login/?login_only=1&user=caissederet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissederet (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 181.115.172.93
country_id: 3923057
description:
2026-06-15 19:51:25 H=([0.0.0.0]) [181.115.172.93]:57375 F=<John@4452.com> rejected RCPT <info@cndh-togo.org>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 114.130.96.198
country_id: 1210997
description:
[2026-06-15 19:52:36 +0000] info [cpaneld] 114.130.96.198 - caisse "GET /login/?login_only=1&user=caisse&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caisse (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:52:40 dovecot_login authenticator failed for H=(MZMYRot) [141.98.10.175]:55076: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.224.153.135
country_id: 3658394
description:
[2026-06-15 19:52:47 +0000] info [cpaneld] 45.224.153.135 - cais "GET /login/?login_only=1&user=cais&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cais (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.100.190.15
country_id: 3658394
description:
[2026-06-15 19:52:53 +0000] info [cpaneld] 157.100.190.15 - cai "GET /login/?login_only=1&user=cai&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cai (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:19:53:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.227.152.183
country_id: 3865483
description:
[2026-06-15 19:52:27 +0000] info [cpaneld] 45.227.152.183 - caisseder "GET /login/?login_only=1&user=caisseder&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caisseder (has_cpuser_file failed)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:19:53:18 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 131.196.114.36
country_id: 3658394
description:
[2026-06-15 19:52:32 +0000] info [cpaneld] 131.196.114.36 - caissed "GET /login/?login_only=1&user=caissed&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissed (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:52:38 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.51.30.128
country_id: 3865483
description:
[2026-06-15 19:52:41 +0000] info [cpaneld] 38.51.30.128 - caiss "GET /login/?login_only=1&user=caiss&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caiss (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.234.244.146
country_id: 3658394
description:
[2026-06-15 19:52:56 +0000] info [cpaneld] 177.234.244.146 - ca "GET /login/?login_only=1&user=ca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.24.61.127
country_id: 99237
description:
[2026-06-15 19:52:22 +0000] info [cpaneld] 185.24.61.127 - caissedere "GET /login/?login_only=1&user=caissedere&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissedere (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:53:30 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:53:32 dovecot_login authenticator failed for H=(8lSLNdowkL) [141.98.10.175]:53059: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:54:29 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:54:31 dovecot_login authenticator failed for H=(1T8sC4ZH) [141.98.10.175]:53112: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:55:23 dovecot_login authenticator failed for H=(jyxgO5X6Dj) [141.98.10.175]:65083: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.164.199
country_id: 2363686
description:
2026-06-15 19:55:26 dovecot_plain authenticator failed for H=([192.168.1.71]) [102.64.164.199]:12094: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:55:21 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:19:56:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13267100&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781553402 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:56:47 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:56:21 dovecot_login authenticator failed for H=(fASIW7) [141.98.10.175]:50351: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:57:45 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 156.38.81.6
country_id: 2363686
description:
[2026-06-15 19:57:49 +0000] info [cpaneld] 156.38.81.6 NEW himcuijv:WuTtNjKvIiJ5kglL address=156.38.81.6,app=cpaneld,creator=root,method=handle_form_login,path=loadsession:himcuijv:ALue68n8HcRu7BuJ:create_user_session,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:57:47 dovecot_login authenticator failed for H=(s7g9rmI72) [141.98.10.175]:50461: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:58:45 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.115.78.223
country_id: 6252001
description:
2026-06-15 19:58:33 dovecot_plain authenticator failed for H=c-73-115-78-223.hsd1.tx.comcast.net (vikgkrto9v32q3xmzlfaz5t) [73.115.78.223]:53968: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:58:47 dovecot_login authenticator failed for H=(zyD5qpHbL) [141.98.10.175]:50713: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:59:44 dovecot_login authenticator failed for H=(cATaUi0nio) [141.98.10.175]:51093: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:59:42 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: modsec
rule: 77350923
name: IM360 WAF: Apache Struts OGNL injection
abuser: 45.3.44.36
country_id: 2510769
domain: webdisk.marketplace.netmaster.tg
description:
IM360 WAF: Apache Struts OGNL injection||MV:/?debug=1&error=${T(java.lang.Runtime).getRuntime().exec('id')}&input=${T(java.lang.Runtime).getRuntime().exec('id')}||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 34.7.7.190
country_id: 2750405
domain: ftp.cloud-and-racks.tg
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/backend/.git/config||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:00:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:00:35 dovecot_login authenticator failed for H=(P3RKVGI) [141.98.10.175]:63899: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:01:32 dovecot_login authenticator failed for H=(KPxGelN) [141.98.10.175]:64796: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:01:30 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.199.32.174
country_id: 3469034
description:
Jun 15 20:03:20 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.199.32.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:02:24 dovecot_login authenticator failed for H=(fKg74fc6qs) [141.98.10.175]:49157: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:02:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.199.32.174
country_id: 3469034
description:
2026-06-15 20:03:22 dovecot_login authenticator failed for H=([74.119.147.213]) [200.199.32.174]:51098: 535 Incorrect authentication data (set_id=felix.barigao@arse.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:03:44 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:03:46 dovecot_login authenticator failed for H=(5mXtBWHM2) [141.98.10.175]:53055: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.236
country_id: 130758
description:
Jun 15 20:04:57 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:04:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:04:35 dovecot_login authenticator failed for H=(J0wSbbG) [141.98.10.175]:53786: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.164.199
country_id: 2363686
description:
2026-06-15 20:04:35 dovecot_plain authenticator failed for H=([192.168.1.71]) [102.64.164.199]:9140: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.236
country_id: 130758
description:
2026-06-15 20:04:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.236]:49562: 535 Incorrect authentication data (set_id=qamemcached)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.117.155.41
country_id: 1269750
description:
2026-06-15 20:05:37 dovecot_login authenticator failed for H=([196.28.226.124]) [103.117.155.41]:37454: 535 Incorrect authentication data (set_id=elogdoyoih@otr.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:05:48 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.117.155.41
country_id: 1269750
description:
Jun 15 20:05:35 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.117.155.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:05:22 dovecot_login authenticator failed for H=(JuumEiuXJ) [141.98.10.175]:61224: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.155.118
country_id: 1269750
description:
2026-06-15 20:06:29 dovecot_login authenticator failed for H=([119.51.247.186]) [182.95.155.118]:39958: 535 Incorrect authentication data (set_id=inf@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:06:49 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.155.118
country_id: 1269750
description:
Jun 15 20:06:27 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.155.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:06:51 dovecot_login authenticator failed for H=(UmYI4KQZeS) [141.98.10.175]:62196: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.221
country_id: 3175395
description:
Jun 15 20:07:40 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:07:47 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:07:20 dovecot_login authenticator failed for H=(sOcFh4RZy) [141.98.10.175]:51726: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:20:08:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:20:08:09 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 181.165.250.75
country_id: 3865483
description:
181.165.250.75 - - [15/Jun/2026:20:09:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6579566&pdata=https%253A%252F%252Fmacite.tg%252F2023%252F05%252F02%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781554139 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2023/05/02/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.7727.1345 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:181.165.250.75


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:08:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:08:24 dovecot_login authenticator failed for H=(6GktEaJ3) [141.98.10.175]:50906: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 172.83.255.254
country_id: 6252001
description:
172.83.255.254 - - [15/Jun/2026:20:10:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054250&pdata=https%253A%252F%252Fcafe.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781554215 HTTP/2.0" 302 0 cafe.tg "https://cafe.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:172.83.255.254


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 88.241.84.201
country_id: 298795
description:
88.241.84.201 - - [15/Jun/2026:20:09:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9922962&pdata=https%253A%252F%252Fwebmail.elisco.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781554159 HTTP/2.0" 302 0 webmail.elisco.free.netmaster.tg "https://webmail.elisco.free.netmaster.tg/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:88.241.84.201


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:09:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:09:24 dovecot_login authenticator failed for H=(Ud2PgRfJE) [141.98.10.175]:64271: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:10:26 dovecot_login authenticator failed for H=(puT8xw2j) [141.98.10.175]:63820: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 41.207.188.29
country_id: 2363686
description:
41.207.188.29 - - [15/Jun/2026:20:10:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6318748&pdata=https%253A%252F%252Flaunetogo.tg%252Fconvention-aerienne-africaine-a-lome-faure-gnassingbe-plaide-pour-un-ciel-vert-digital-et-createur-demplois%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781554226 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/convention-aerienne-africaine-a-lome-faure-gnassingbe-plaide-pour-un-ciel-vert-digital-et-createur-demplois/" "Mozilla/5.0 (Linux; Android 10; MAR-LX1A; HMSCore 6.15.6.332; GMSCore 26.20.31) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.196 HuaweiBrowser/17.0.4.304 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:41.207.188.29


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:20:10:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934438&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781554256 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


