# incident

plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:09:27:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10055319&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781947665 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.14.10
country_id: 226074
description:
Jun 20 09:27:28 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.14.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.176
country_id: 3469034
description:
Jun 20 09:27:36 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.176 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:09:29:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116952&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781947777 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:09:29:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6841961&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781947767 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:09:29:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10183068&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781947770 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.87.243.112
country_id: 798544
description:
Jun 20 09:32:38 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.87.243.112 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 5.38.42.66
country_id: 290557
description:
5.38.42.66 - - [20/Jun/2026:09:36:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842730&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Foembed%252F1.0%252Fembed%253Furl%253Dhttps%25253A%25252F%25252F24heureinfo.tg%25252Fsante%25252Fcoronavirus-les-ministres-de-la-sante-de-luemoa-en-conclave-jeudi%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781948172 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/wp-json/oembed/1.0/embed?url=https%3A%2F%2F24heureinfo.tg%2Fsante%2Fcoronavirus-les-ministres-de-la-sante-de-luemoa-en-conclave-jeudi%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:5.38.42.66


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:09:38:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:09:38:38 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.19
country_id: 6252001
description:
[2026-06-20 09:39:57 +0000] info [cpaneld] 64.44.59.19 NEW formationfreenet:LCKSEWZmoK2VHP3O address=64.44.59.19,app=cpaneld,creator=formationfreenet,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 44.244.45.148
country_id: 6252001
description:
44.244.45.148 - - [20/Jun/2026:09:41:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6591844&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252F9e748621ef5af3193726f97634097a23%252F1891d514c9aaf242756eccd4b76f285b%252Findex.php%253Fcmd%253Dnewupld&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781948500 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/9e748621ef5af3193726f97634097a23/1891d514c9aaf242756eccd4b76f285b/index.php?cmd=newupld" "Mozilla/5.0 (iPhone; CPU iPhone OS 14_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:44.244.45.148


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.34.124
country_id: 953987
description:
Jun 20 09:41:31 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.34.124 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:09:42:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6515303&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781948527 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:09:42:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7181258&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781948529 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.110.182
country_id: 6252001
description:
[2026-06-20 09:44:39 +0000] info [cpaneld] 82.40.110.182 - seft "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user seft (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.139.254.141
country_id: 1282988
description:
103.139.254.141 - - [20/Jun/2026:09:46:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9674134&pdata=https%253A%252F%252F24heureinfo.tg%252Ftag%252Fdio%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781948759 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/tag/dio/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.139.254.141


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 113.19.181.244
country_id: 1694008
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:09-45.113.19.181.244||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:09:45:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13277086&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781948732 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:09:45:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923019&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781948731 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:09:45:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6514842&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781948728 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.214.233.161
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/03/IMG_1504.webp 1000w, http:/togodailynews.tg/wp-content/uploads/2026/03/IMG_1504-300x200.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/03/IMG_1504-768x512.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 5.38.58.194
country_id: 290557
description:
5.38.58.194 - - [20/Jun/2026:09:52:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7117159&pdata=https%253A%252F%252F24heureinfo.tg%252Ftag%252Ftarifs-mobiles%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781949121 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/tag/tarifs-mobiles/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:5.38.58.194


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.66
country_id: 798544
description:
Jun 20 09:51:53 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.4.197
country_id: 690791
description:
Jun 20 09:52:39 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.4.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.8.122.120
country_id: 6252001
description:
2026-06-20 09:52:45 dovecot_login authenticator failed for H=(localhost.localdomain) [96.8.122.120]:34272: 535 Incorrect authentication data (set_id=test@arse.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:09:55:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:09:55:15 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:09:57:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869420&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781949471 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:09:57:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9737875&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781949474 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 59.153.18.204
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/8a756a HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:09:59:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9805465&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781949567 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:09:59:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13278313&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781949570 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.73.138.122
country_id: 953987
description:
Jun 20 10:01:12 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.73.138.122 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.253.27.219
country_id: 1880251
description:
[2026-06-20 10:02:00 +0000] info [cpaneld] 103.253.27.219 - a.kesso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.kesso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 44.201.53.135
country_id: 6252001
description:
[2026-06-20 10:02:33 +0000] info [cpaneld] 44.201.53.135 - whmcsadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user whmcsadmin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.225.61.156
country_id: 6252001
description:
2026-06-20 10:03:42 dovecot_login authenticator failed for H=wsip-68-225-61-156.pn.at.cox.net ([95.52.194.27]) [68.225.61.156]:58505: 535 Incorrect authentication data (set_id=afford@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.96.163
country_id: 3469034
description:
Jun 20 10:03:51 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.96.163 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 160.19.19.69
country_id: 1643084
description:
160.19.19.69 - - [20/Jun/2026:10:04:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051666&pdata=https%253A%252F%252F24heureinfo.tg%252Ftag%252Fgunn-edoe%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781949851 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/tag/gunn-edoe/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:160.19.19.69


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.234.161.78
country_id: 3469034
description:
Jun 20 10:03:36 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.234.161.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.199.197.255
country_id: 2017370
description:
Jun 20 10:08:56 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.199.197.255 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:10:09:23 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:10:09:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:10:10:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10144152&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781950251 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:10:10:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6525842&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781950253 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:10:13:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6843593&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781950410 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:10:13:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9792155&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781950411 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:10:13:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9946214&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781950411 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.172.194.172
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:afreximbank-nomme-haytham-el-maayergi-au-poste-de-vice-president-executif-de-global-trade-bank-evp-gtba/||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.21.243.58
country_id: 1814991
description:
Jun 20 10:15:51 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.21.243.58 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.85.184
country_id: 6252001
description:
[2026-06-20 10:15:57 +0000] info [cpaneld] 82.40.85.184 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.241.98.176
country_id: 2589581
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/plugins/google-analytics-for-wordpress/assets/js/frontend-gtag.min.js?ver=10.2.2 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.95.108.142
country_id: 953987
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/uploads/2026/01/Convergence-de-vues-entre-le-Togo-et-le-Qatar-pour-une-solution-durable-a-la-crise-dans-la-region-des-Grands-Lacs-768x536.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.241.101.188
country_id: 3658394
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&action_name=Bernard AFAWOUBO, auteur sur TOGODAILYNEWS | Page 32 sur 453&siteId=1&rec=1&rand=342753&h=18&m=18&s=7&url=http:/togodailynews.tg/author/admin/page/32/&uid=0&pid=0&visitorId=a5eb79a2dea218a2&fvts=1781950688&vc=1&idn=0&refts=0&lvts=1781950688&fullRef=undefined&send_image=1&cookie=1&res=375x812&gtms=3527&pvId=G4198H&browser=Chrome_59&os=iOS_11.0.0&device=Mobile HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.211.57.26
country_id: 2328926
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/author/togo/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.211.57.26
country_id: 2328926
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/author/togo/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.179
country_id: 3469034
description:
Jun 20 10:20:35 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.179 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.93.133.218
country_id: 3658394
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&action_name=Bernard AFAWOUBO, auteur sur TOGODAILYNEWS | Page 37 sur 453&siteId=1&rec=1&rand=542363&h=18&m=22&s=4&url=http:/togodailynews.tg/author/admin/page/37/&uid=0&pid=0&visitorId=f568d43d0279106c&fvts=1781950925&vc=1&idn=0&refts=0&lvts=1781950925&fullRef=undefined&send_image=1&cookie=1&res=375x812&gtms=8616&pvId=J7pzsr&browser=Chrome_45&os=Android_8.0&device=Mobile HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.246.208.105
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/themes/magxpress/assets/css/swiper-bundle.min.css?ver=1.0.0 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.95.174
country_id: 690791
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&ping=1&siteId=1&rec=1&rand=824619&h=18&m=22&s=34&url=http:/togodailynews.tg/author/admin/page/37/&uid=0&pid=0&visitorId=f568d43d0279106c&fvts=1781950925&vc=1&idn=0&refts=0&lvts=1781950925&fullRef=undefined&send_image=1&cookie=1&res=375x812&gtms=8616&pvId=J7pzsr&browser=Chrome_45&os=Android_8.0&device=Mobile HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 206.232.2.93
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:10-23.206.232.2.93||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-20 10:22:28 +0000] info [cpaneld] 185.55.240.13 - afxvhoxo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afxvhoxo (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.83.40.117
country_id: 1643084
description:
203.83.40.117 - - [20/Jun/2026:10:23:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7052142&pdata=https%253A%252F%252Ftogodailynews.tg%252Fauthor%252Fadmin%252Fpage%252F39%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781951017 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/author/admin/page/39/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.5011.1922 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.83.40.117


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:10:24:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-20 10:24:32 +0000] info [cpaneld] 185.55.240.13 - camaegdtomgo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:10:24:59 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.57
country_id: 1880251
description:
47.128.121.57 - - [20/Jun/2026:10:25:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9998952&pdata=https%253A%252F%252Ftogodailynews.tg%252Fauthor%252Fadmin%252Fpage%252F42%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781951157 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/author/admin/page/42/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.57


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.41.130
country_id: 6290252
description:
Jun 20 10:25:42 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.41.130 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.240.230.23
country_id: 2510769
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/uploads/2025/12/Faure-Gnassingbe.webp HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.253.27.219
country_id: 1880251
description:
[2026-06-20 10:26:51 +0000] info [cpaneld] 103.253.27.219 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:10:27:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7378274&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781951221 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:10:27:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328428&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781951223 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:10:28:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13004444&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781951300 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:10:28:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791433&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781951300 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:10:28:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923220&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781951311 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:10:28:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132639&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781951308 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.92
country_id: 1880251
description:
47.128.121.92 - - [20/Jun/2026:10:29:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13135762&pdata=https%253A%252F%252Ftogodailynews.tg%252Fauthor%252Fadmin%252Fpage%252F48%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781951368 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/author/admin/page/48/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.92


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.57
country_id: 1880251
description:
47.128.121.57 - - [20/Jun/2026:10:31:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13157834&pdata=https%253A%252F%252Ftogodailynews.tg%252Fauthor%252Fadmin%252Fpage%252F51%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781951473 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/author/admin/page/51/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.57


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.118.10
country_id: 2363686
description:
[2026-06-20 10:31:06 +0000] info [webmaild] 196.170.118.10 - kakue@togointerim.net "GET /cpsess7537012358/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.106.73
country_id: 3469034
description:
Jun 20 10:31:14 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.106.73 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.124.23.165
country_id: 3608932
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/05/IMG-20220504-WA0154-1.jpg 1080w, http:/togodailynews.tg/wp-content/uploads/2022/05/IMG-20220504-WA0154-1-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2022/05/IMG-20220504-WA0154-1-768x512.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2022/05/IMG-20220504-WA0154-1-1024x683.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2022/05/IMG-20220504-WA0154-1-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.161.115.129
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1327934794 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.240.14.227
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/716964 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.254.224.164
country_id: 1880251
description:
[2026-06-20 10:39:15 +0000] info [cpaneld] 54.254.224.164 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:10:40:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 178.92.9.2
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:le-togo-ne-veut-pas-dun-systeme-educatif-depourvu-dinfrastructures/||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:10:40:09 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.42.200.110
country_id: 1880251
description:
[2026-06-20 10:41:42 +0000] info [cpaneld] 152.42.200.110 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.157.233.28
country_id: 6252001
description:
2026-06-20 10:41:45 dovecot_plain authenticator failed for H=ec2-54-157-233-28.compute-1.amazonaws.com (EC2AMAZ-S0IK57A.ec2.internal) [54.157.233.28]:62005: 535 Incorrect authentication data (set_id=mawinaoui@primuscourtier.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.157.233.28
country_id: 6252001
description:
Jun 20 10:41:49 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 54.157.233.28 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:10:42:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9749603&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781952124 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:10:42:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10133144&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781952125 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:10:44:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9924757&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781952286 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:10:44:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13092761&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781952291 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.37.11.54
country_id: 3469034
description:
Jun 20 10:44:56 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.37.11.54 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.247.69.185
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&action_name=Bernard AFAWOUBO, auteur sur TOGODAILYNEWS | Page 67 sur 453&siteId=1&rec=1&rand=093642&h=18&m=45&s=17&url=http:/togodailynews.tg/author/admin/page/67/&uid=0&pid=0&visitorId=99adb57cfa03625b&fvts=1781952317&vc=1&idn=0&refts=0&lvts=1781952317&fullRef=undefined&send_image=1&cookie=1&res=375x812&gtms=5402&pvId=PmVrQL&browser=Chrome_43&os=Android_6.0&device=Mobile HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:10:44:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10327498&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781952279 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.240.13
country_id: 3017382
description:
[2026-06-20 10:47:20 +0000] info [cpaneld] 185.55.240.13 - enadamso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user enadamso (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.191.220.203
country_id: 3865483
description:
Jun 20 10:47:24 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.191.220.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.191.220.203
country_id: 3865483
description:
Jun 20 10:47:32 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.191.220.203 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 144.91.125.41
country_id: 3017382
description:
[2026-06-20 10:47:32 +0000] info [cpaneld] 144.91.125.41 - cafetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.1.9
country_id: 690791
description:
Jun 20 10:47:52 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.1.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.72.24.250
country_id: 51537
description:
Jun 20 10:47:52 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.72.24.250 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.163.135.215
country_id: 1562822
domain: www.emt.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.emt.tg/cgi-bin/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.232.225.54
country_id: 597427
description:
2026-06-20 10:48:37 dovecot_login authenticator failed for H=host-94-232-225-54.etanetas.lt [94.232.225.54]:40914: 535 Incorrect authentication data (set_id=basile.dzadu@ekeasarl.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.228.150.95
country_id: 1562822
domain: www.emt.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.emt.tg/?C=N;O=D HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.18.235.228
country_id: 1562822
domain: www.emt.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.emt.tg/?C=M;O=A HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.104.123.69
country_id: 2589581
domain: www.emt.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.emt.tg/?C=S;O=A HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.247.104.27
country_id: 1562822
domain: www.emt.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.emt.tg/?C=D;O=A HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.68
country_id: 3175395
description:
Jun 20 10:49:43 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.68 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.70.18
country_id: 3057568
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&action_name=Bernard AFAWOUBO, auteur sur TOGODAILYNEWS | Page 74 sur 453&siteId=1&rec=1&rand=489647&h=18&m=49&s=51&url=http:/togodailynews.tg/author/admin/page/74/&uid=0&pid=0&visitorId=14c929ce9446ffae&fvts=1781952591&vc=1&idn=0&refts=0&lvts=1781952591&fullRef=undefined&send_image=1&cookie=1&res=375x812&gtms=4615&pvId=bedNc0&browser=Chrome_40&os=Android_6.0&device=Mobile HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.34.189.57
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/01/linquietante-montee-en-puissance-des-ultra-riches-a-davos-750x375-1.webp 750w, http:/togodailynews.tg/wp-content/uploads/2026/01/linquietante-montee-en-puissance-des-ultra-riches-a-davos-750x375-1-300x150.webp 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.68.49.235
country_id: 2921044
description:
Jun 20 10:54:09 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.68.49.235 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.113.114.61
country_id: 3658394
description:
[2026-06-20 10:55:19 +0000] info [cpaneld] 181.113.114.61 - mesyscom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:10:55:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:10:55:46 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:10:56:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738183&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781952972 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 20.65.201.146
country_id: 6252001
description:
[2026-06-20 10:56:20 +0000] info [cpaneld] 20.65.201.146 - AWADI "POST /login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user AWADI (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.211.59.106
country_id: 2328926
description:
[2026-06-20 10:55:33 +0000] info [webmaild] 197.211.59.106 - anticorruption@otr.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.92
country_id: 1880251
description:
47.128.121.92 - - [20/Jun/2026:10:55:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935209&pdata=http%253A%252F%252Ftogodailynews.tg%252Fauthor%252Fadmin%252Fpage%252F81%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781952934 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/author/admin/page/81/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.92


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:10:56:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6516074&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781952974 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 14.165.232.52
country_id: 1562822
description:
14.165.232.52 - - [20/Jun/2026:10:56:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065518&pdata=https%253A%252F%252Ftogodailynews.tg%252Fle-mois-du-consommer-local-une-troisieme-edition-pleine-despoirs-pour-les-togolais%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781953005 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/le-mois-du-consommer-local-une-troisieme-edition-pleine-despoirs-pour-les-togolais/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2363.1887 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:14.165.232.52


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.120.51.251
country_id: 2635167
description:
[2026-06-20 10:58:29 +0000] info [whostmgrd] 31.120.51.251 - benito10 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.47.146.178
country_id: 587116
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/239886239 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.81.248.250
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/05/EPP-KADJALE2-1024x819.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/05/EPP-KADJALE2-300x240.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2024/05/EPP-KADJALE2-768x614.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2024/05/EPP-KADJALE2-1536x1229.jpg 1536w, http:/togodailynews.tg/wp-content/uploads/2024/05/EPP-KADJALE2-2048x1638.jpg 2048w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:11:00:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116653&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781953210 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:11:00:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13016686&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781953214 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:11:00:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10118598&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781953213 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.142.109.240
country_id: 2400553
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/efd6d0 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.133.222.75
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/01/G-jc-EmWkAAdr0I.webp 1199w, http:/togodailynews.tg/wp-content/uploads/2026/01/G-jc-EmWkAAdr0I-300x200.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/01/G-jc-EmWkAAdr0I-1024x683.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/01/G-jc-EmWkAAdr0I-768x512.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 209.227.239.27
country_id: 3175395
description:
209.227.239.27 - - [20/Jun/2026:11:01:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10012825&pdata=https%253A%252F%252Fmyworkafrica.com%252Fcontact&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781953305 HTTP/2.0" 302 0 myworkafrica.com "https://myworkafrica.com/contact" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.55 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:209.227.239.27


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 44.244.45.148
country_id: 6252001
description:
44.244.45.148 - - [20/Jun/2026:11:02:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6382949&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252F9e748621ef5af3193726f97634097a23%252F1891d514c9aaf242756eccd4b76f285b%252F341167fea77beadc2c68115c2bca1713%252Findex.php%253Fcmd%253Dnewupld&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781953344 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/9e748621ef5af3193726f97634097a23/1891d514c9aaf242756eccd4b76f285b/341167fea77beadc2c68115c2bca1713/index.php?cmd=newupld" "Mozilla/5.0 (Linux; Android 8.0.0; SM-G965U Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.155 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:44.244.45.148


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.9.111
country_id: 6252001
description:
[2026-06-20 11:01:43 +0000] info [whostmgrd] 195.63.9.111 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.123.221.154
country_id: 3437598
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/11/c8d7ea8af6aec31c4a276aede1d6de74_XL.webp 471w, http:/togodailynews.tg/wp-content/uploads/2025/11/c8d7ea8af6aec31c4a276aede1d6de74_XL-300x185.webp 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.24.148.121
country_id: 2017370
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/4c5e7a HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 35.166.242.236
country_id: 6252001
description:
35.166.242.236 - - [20/Jun/2026:11:05:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12949653&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252Facf2d8c858075b0500387330fbe3e107%252Fea425e05eea2788cc063ebda30164563%252F6ceb254a8cb5490cf313a3dfacf56698%252F20b8a46017f76205f06cbecfe393b213%252F714c81ee2d0a7acc45a6c14cc2395b67%252Findex.php%253Fcmd%253Dlogin&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781953506 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/acf2d8c858075b0500387330fbe3e107/ea425e05eea2788cc063ebda30164563/6ceb254a8cb5490cf313a3dfacf56698/20b8a46017f76205f06cbecfe393b213/714c81ee2d0a7acc45a6c14cc2395b67/index.php?cmd=login" "Mozilla/5.0 (Linux; Android 8.0.0; SM-G965U Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.155 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:35.166.242.236


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.113.114.61
country_id: 3658394
description:
[2026-06-20 11:06:35 +0000] info [cpaneld] 181.113.114.61 - mesyscomcom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: modsec
rule: 77896900
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 45.157.112.202
country_id: 3017382
domain: mesyscom.com
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wpadminerlzp||User:jmtctoni||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.81
country_id: 1880251
description:
47.128.121.81 - - [20/Jun/2026:11:08:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9924965&pdata=https%253A%252F%252Ftogodailynews.tg%252Fauthor%252Fadmin%252Fpage%252F98%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781953709 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/author/admin/page/98/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.81


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 35.166.242.236
country_id: 6252001
description:
35.166.242.236 - - [20/Jun/2026:11:09:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6921361&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252Facf2d8c858075b0500387330fbe3e107%252Fea425e05eea2788cc063ebda30164563%252F6ceb254a8cb5490cf313a3dfacf56698%252F20b8a46017f76205f06cbecfe393b213%252Findex.php%253Fcmd%253Dlogin%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781953773 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/acf2d8c858075b0500387330fbe3e107/ea425e05eea2788cc063ebda30164563/6ceb254a8cb5490cf313a3dfacf56698/20b8a46017f76205f06cbecfe393b213/index.php?cmd=login/" "Mozilla/5.0 (Linux; Android 8.0.0; SM-G965U Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.155 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:35.166.242.236


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:11:10:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001506&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781953805 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:11:10:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6659179&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781953804 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.224.150.85
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/02/Les-grandes-decisions-du-Conseil-des-ministres-du-19-fevrier-2026-photo-archives.webp 800w, http:/togodailynews.tg/wp-content/uploads/2026/02/Les-grandes-decisions-du-Conseil-des-ministres-du-19-fevrier-2026-photo-archives-300x225.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/02/Les-grandes-decisions-du-Conseil-des-ministres-du-19-fevrier-2026-photo-archives-768x576.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 44.244.45.148
country_id: 6252001
description:
44.244.45.148 - - [20/Jun/2026:11:11:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9725333&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252Facf2d8c858075b0500387330fbe3e107%252F662a44ecfad84f8900d4209f17cf6d72%252F3ab2e605cafab0f046b95d461a96be5c%252F66fe440de5c3e86a03793c42215f2f04%252Findex.php%253Fcmd%253Dlogin%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781953858 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/acf2d8c858075b0500387330fbe3e107/662a44ecfad84f8900d4209f17cf6d72/3ab2e605cafab0f046b95d461a96be5c/66fe440de5c3e86a03793c42215f2f04/index.php?cmd=login/" "Mozilla/5.0 (Linux; Android 8.0.0; SM-G965U Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.155 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:44.244.45.148


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:11:11:15 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:11:11:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.61.170
country_id: 6252001
description:
2026-06-20 11:11:51 dovecot_login authenticator failed for H=(dG1tqm) [191.101.61.170]:62728: 535 Incorrect authentication data (set_id=httpcafelabo.tgstephane.o@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.191.91.122
country_id: 1814991
description:
2026-06-20 11:12:46 dovecot_login authenticator failed for H=(oPDXmBpZha) [60.191.91.122]:2550: 535 Incorrect authentication data (set_id=aitogo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.191.91.122
country_id: 1814991
description:
2026-06-20 11:13:59 dovecot_login authenticator failed for H=(44yyCxzs) [60.191.91.122]:2854: 535 Incorrect authentication data (set_id=aitogo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.191.91.122
country_id: 1814991
description:
2026-06-20 11:14:48 dovecot_login authenticator failed for H=(uAZ1Ymq) [60.191.91.122]:4312: 535 Incorrect authentication data (set_id=aitogo)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.213.86
country_id: 2363686
description:
[2026-06-20 11:15:07 +0000] info [webmaild] 196.168.213.86 - kakue@togointerim.net "POST /cpsess0956995836/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.170.118.10] != Current IP Address [196.168.213.86]


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.170.43.53
country_id: 2363686
domain: leadelles.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>dans un contexte o\xc3\xb9 les initiatives citoyennes gagnent en ampleur et en impact, la reconnaissance accord\xc3\xa9e \xc3\xa0 la faea \xe2\x80\x93 femmes en action pour l\xe2\x80\x99eau et l\xe2\x80\x99assainissement \xe2\x80\x93 lors de la soir\xc3\xa9e de transformation organis\xc3\xa9e par yals vient consacrer un engagement de terrain constant en faveur de l\xe2\x80\x99eau, de l\xe2\x80\x99assainissement et du bien-\xc3\xaatre communautaire.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>le 06 juin dernier, cette distinction a mis en lumi\xc3\xa8re le r\xc3\xb4le strat\xc3\xa9gique jou\xc3\xa9 par l\xe2\x80\x99organisation dans l\xe2\x80\x99am\xc3\xa9lioration des conditions de vie des populations. \xc3\x80 travers ses actions, la faea s\xe2\x80\x99impose progressivement comme un acteur incontournable dans la promotion de solutions durables pour des communaut\xc3\xa9s plus saines, plus r\xc3\xa9silientes et mieux structur\xc3\xa9es face aux d\xc3\xa9fis li\xc3\xa9s \xc3\xa0 l\xe2\x80\x99acc\xc3\xa8s \xc3\xa0 l\xe2\x80\x99eau.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>cette reconnaissance intervient dans un cadre symbolique fort, celui de la soir\xc3\xa9e de transformation de young african leaders speakers (yals), plateforme engag\xc3\xa9e dans la valorisation du leadership des jeunes et la r\xc3\xa9v\xc3\xa9lation des potentiels \xc3\xa9mergents. l\xe2\x80\x99\xc3\xa9v\xc3\xa9nement a ainsi servi de vitrine \xc3\xa0 des initiatives porteuses de changement et d\xe2\x80\x99innovation sociale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>lire aussi</strong> :<strong> <a href=\"https://leadelles.tg/index.php/2026/06/20/leadership-feminin-au-sommet-de-la-finance-togolaise-estelle-fafa-akue-komlan-une-ascension-qui-redefinit-les-codes-bancaires/\">leadership f\xc3\xa9minin au sommet de la finance togolaise : estelle fafa akue komlan, une ascension qui red\xc3\xa9finit les codes bancaires</a></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":912,\"width\":\"840px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large is-resized\"><img src=\"https://leadelles.tg/wp-content/uploads/2026/06/faea-683x1024.jpg\" alt=\"\" class=\"wp-image-912\" style=\"width:840px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>r\xc3\xa9agissant \xc3\xa0 cette distinction, la pr\xc3\xa9sidente de la faea a exprim\xc3\xa9 sa gratitude avec des mots empreints de conviction et de reconnaissance.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>\xc2\xab nous adressons nos sinc\xc3\xa8res remerciements \xc3\xa0 yals (young african leaders speakers) pour cette distinction ainsi que pour sa mission de transformation, de r\xc3\xa9v\xc3\xa9lation des potentiels et de promotion du leadership des jeunes \xc2\xbb, a d\xc3\xa9clar\xc3\xa9 carole aghey, pr\xc3\xa9sidente de faea \xe2\x80\x93 femmes en action pour l\xe2\x80\x99eau et l\xe2\x80\x99assainissement.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>au-del\xc3\xa0 de l\xe2\x80\x99hommage, cette distinction appara\xc3\xaet comme un signal fort en faveur de la consolidation des initiatives citoyennes f\xc3\xa9minines dans les secteurs essentiels du d\xc3\xa9veloppement. elle souligne \xc3\xa9galement l\xe2\x80\x99importance des synergies entre organisations engag\xc3\xa9es pour amplifier l\xe2\x80\x99impact social.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>dans cette dynamique, la faea entend poursuivre son action avec d\xc3\xa9termination, convaincue que l\xe2\x80\x99engagement citoyen, le leadership et l\xe2\x80\x99action communautaire constituent des leviers essentiels de transformation durable des soci\xc3\xa9t\xc3\xa9s.</p>\n<!-- /wp:paragraph -->||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 44.244.45.148
country_id: 6252001
description:
44.244.45.148 - - [20/Jun/2026:11:16:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6841702&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252Facf2d8c858075b0500387330fbe3e107%252F662a44ecfad84f8900d4209f17cf6d72%252F475cbf0e239ed73967d9e29c88977295%252Findex.php%253Fcmd%253Dlogin&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781954158 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/acf2d8c858075b0500387330fbe3e107/662a44ecfad84f8900d4209f17cf6d72/475cbf0e239ed73967d9e29c88977295/index.php?cmd=login" "Mozilla/5.0 (iPhone; CPU iPhone OS 14_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:44.244.45.148


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:11:16:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10064487&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781954160 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.9.128
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/693724802 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:11:16:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13003411&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781954157 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:11:16:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7443860&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781954160 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.47.42.43
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/a3a0a3 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.191.91.122
country_id: 1814991
description:
2026-06-20 11:15:38 dovecot_login authenticator failed for H=(eOTi58) [60.191.91.122]:4893: 535 Incorrect authentication data (set_id=aitogo)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.170.43.53
country_id: 2363686
domain: leadelles.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>dans un contexte o\xc3\xb9 les initiatives citoyennes gagnent en ampleur et en impact, la reconnaissance accord\xc3\xa9e \xc3\xa0 la faea \xe2\x80\x93 femmes en action pour l\xe2\x80\x99eau et l\xe2\x80\x99assainissement \xe2\x80\x93 lors de la soir\xc3\xa9e de transformation organis\xc3\xa9e par yals vient consacrer un engagement de terrain constant en faveur de l\xe2\x80\x99eau, de l\xe2\x80\x99assainissement et du bien-\xc3\xaatre communautaire.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>le 06 juin dernier, cette distinction a mis en lumi\xc3\xa8re le r\xc3\xb4le strat\xc3\xa9gique jou\xc3\xa9 par l\xe2\x80\x99organisation dans l\xe2\x80\x99am\xc3\xa9lioration des conditions de vie des populations. \xc3\x80 travers ses actions, la faea s\xe2\x80\x99impose progressivement comme un acteur incontournable dans la promotion de solutions durables pour des communaut\xc3\xa9s plus saines, plus r\xc3\xa9silientes et mieux structur\xc3\xa9es face aux d\xc3\xa9fis li\xc3\xa9s \xc3\xa0 l\xe2\x80\x99acc\xc3\xa8s \xc3\xa0 l\xe2\x80\x99eau.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>cette reconnaissance intervient dans un cadre symbolique fort, celui de la soir\xc3\xa9e de transformation de young african leaders speakers (yals), plateforme engag\xc3\xa9e dans la valorisation du leadership des jeunes et la r\xc3\xa9v\xc3\xa9lation des potentiels \xc3\xa9mergents. l\xe2\x80\x99\xc3\xa9v\xc3\xa9nement a ainsi servi de vitrine \xc3\xa0 des initiatives porteuses de changement et d\xe2\x80\x99innovation sociale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":912,\"width\":\"840px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large is-resized\"><img src=\"https://leadelles.tg/wp-content/uploads/2026/06/faea-683x1024.jpg\" alt=\"\" class=\"wp-image-912\" style=\"width:840px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>r\xc3\xa9agissant \xc3\xa0 cette distinction, la pr\xc3\xa9sidente de la faea a exprim\xc3\xa9 sa gratitude avec des mots empreints de conviction et de reconnaissance.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>\xc2\xab nous adressons nos sinc\xc3\xa8res remerciements \xc3\xa0 yals (young african leaders speakers) pour cette distinction ainsi que pour sa mission de transformation, de r\xc3\xa9v\xc3\xa9lation des potentiels et de promotion du leadership des jeunes \xc2\xbb, a d\xc3\xa9clar\xc3\xa9 carole aghey, pr\xc3\xa9sidente de faea \xe2\x80\x93 femmes en action pour l\xe2\x80\x99eau et l\xe2\x80\x99assainissement.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>lire aussi</strong> :<strong><a href=\"https://leadelles.tg/index.php/2026/06/20/leadership-feminin-au-sommet-de-la-finance-togolaise-estelle-fafa-akue-komlan-une-ascension-qui-redefinit-les-codes-bancaires/\">leadership f\xc3\xa9minin au sommet de la finance togolaise : estelle fafa akue komlan, une ascension qui red\xc3\xa9finit les codes bancaires</a></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>au-del\xc3\xa0 de l\xe2\x80\x99hommage, cette distinction appara\xc3\xaet comme un signal fort en faveur de la consolidation des initiatives citoyennes f\xc3\xa9minines dans les secteurs essentiels du d\xc3\xa9veloppement. elle souligne \xc3\xa9galement l\xe2\x80\x99importance des synergies entre organisations engag\xc3\xa9es pour amplifier l\xe2\x80\x99impact social.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>dans cette dynamique, la faea entend poursuivre son action avec d\xc3\xa9termination, convaincue que l\xe2\x80\x99engagement citoyen, le leadership et l\xe2\x80\x99action communautaire constituent des leviers essentiels de transformation durable des soci\xc3\xa9t\xc3\xa9s.</p>\n<!-- /wp:paragraph -->||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 180.74.67.44
country_id: 1733045
description:
180.74.67.44 - - [20/Jun/2026:11:16:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13079750&pdata=https%253A%252F%252F24heureinfo.tg%252Fdiplomatie%252Fdiplomatie-deux-nouveaux-ambassadeurs-accredites-au-togo&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781954198 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/diplomatie/diplomatie-deux-nouveaux-ambassadeurs-accredites-au-togo" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:180.74.67.44


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.170.43.53
country_id: 2363686
domain: leadelles.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>dans un contexte o\xc3\xb9 les initiatives citoyennes gagnent en ampleur et en impact, la reconnaissance accord\xc3\xa9e \xc3\xa0 la faea \xe2\x80\x93 femmes en action pour l\xe2\x80\x99eau et l\xe2\x80\x99assainissement \xe2\x80\x93 lors de la soir\xc3\xa9e de transformation organis\xc3\xa9e par yals vient consacrer un engagement de terrain constant en faveur de l\xe2\x80\x99eau, de l\xe2\x80\x99assainissement et du bien-\xc3\xaatre communautaire.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>le 06 juin dernier, cette distinction a mis en lumi\xc3\xa8re le r\xc3\xb4le strat\xc3\xa9gique jou\xc3\xa9 par l\xe2\x80\x99organisation dans l\xe2\x80\x99am\xc3\xa9lioration des conditions de vie des populations. \xc3\x80 travers ses actions, la faea s\xe2\x80\x99impose progressivement comme un acteur incontournable dans la promotion de solutions durables pour des communaut\xc3\xa9s plus saines, plus r\xc3\xa9silientes et mieux structur\xc3\xa9es face aux d\xc3\xa9fis li\xc3\xa9s \xc3\xa0 l\xe2\x80\x99acc\xc3\xa8s \xc3\xa0 l\xe2\x80\x99eau.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>cette reconnaissance intervient dans un cadre symbolique fort, celui de la soir\xc3\xa9e de transformation de young african leaders speakers (yals), plateforme engag\xc3\xa9e dans la valorisation du leadership des jeunes et la r\xc3\xa9v\xc3\xa9lation des potentiels \xc3\xa9mergents. l\xe2\x80\x99\xc3\xa9v\xc3\xa9nement a ainsi servi de vitrine \xc3\xa0 des initiatives porteuses de changement et d\xe2\x80\x99innovation sociale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":912,\"width\":\"840px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large is-resized\"><img src=\"https://leadelles.tg/wp-content/uploads/2026/06/faea-683x1024.jpg\" alt=\"\" class=\"wp-image-912\" style=\"width:840px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>r\xc3\xa9agissant \xc3\xa0 cette distinction, la pr\xc3\xa9sidente de la faea a exprim\xc3\xa9 sa gratitude avec des mots empreints de conviction et de reconnaissance.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>\xc2\xab nous adressons nos sinc\xc3\xa8res remerciements \xc3\xa0 yals (young african leaders speakers) pour cette distinction ainsi que pour sa mission de transformation, de r\xc3\xa9v\xc3\xa9lation des potentiels et de promotion du leadership des jeunes \xc2\xbb, a d\xc3\xa9clar\xc3\xa9 carole aghey, pr\xc3\xa9sidente de faea \xe2\x80\x93 femmes en action pour l\xe2\x80\x99eau et l\xe2\x80\x99assainissement.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>lire aussi</strong> :<strong><a href=\"https://leadelles.tg/index.php/2026/06/20/leadership-feminin-au-sommet-de-la-finance-togolaise-estelle-fafa-akue-komlan-une-ascension-qui-redefinit-les-codes-bancaires/\">leadership f\xc3\xa9minin au sommet de la finance togolaise : estelle fafa akue komlan, une ascension qui red\xc3\xa9finit les codes bancaires</a></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>au-del\xc3\xa0 de l\xe2\x80\x99hommage, cette distinction appara\xc3\xaet comme un signal fort en faveur de la consolidation des initiatives citoyennes f\xc3\xa9minines dans les secteurs essentiels du d\xc3\xa9veloppement. elle souligne \xc3\xa9galement l\xe2\x80\x99importance des synergies entre organisations engag\xc3\xa9es pour amplifier l\xe2\x80\x99impact social.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>dans cette dynamique, la faea entend poursuivre son action avec d\xc3\xa9termination, convaincue que l\xe2\x80\x99engagement citoyen, le leadership et l\xe2\x80\x99action communautaire constituent des leviers essentiels de transformation durable des soci\xc3\xa9t\xc3\xa9s.</p>\n<!-- /wp:paragraph -->||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.255.68.89
country_id: 2589581
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/946b6a HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.208.23.33
country_id: 3625428
description:
[2026-06-20 11:24:26 +0000] info [cpaneld] 181.208.23.33 - cafetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.169.213.211
country_id: 732800
description:
Jun 20 11:25:23 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.169.213.211 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.231.255.50
country_id: 3017382
description:
[2026-06-20 11:25:42 +0000] info [cpaneld] 5.231.255.50 - glfmqhlj "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.20
country_id: 2635167
description:
[2026-06-20 11:26:22 +0000] info [cpaneld] 5.230.133.20 - apicafe "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:11:26:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9789847&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781954759 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:11:26:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7247763&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781954759 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.195.83.234
country_id: 6252001
description:
[2026-06-20 11:26:03 +0000] info [cpaneld] 134.195.83.234 - ljrwwgxg "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.230
country_id: 2635167
description:
[2026-06-20 11:25:34 +0000] info [cpaneld] 5.230.153.230 - cetitiuu "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.174.169.209
country_id: 6252001
description:
[2026-06-20 11:25:50 +0000] info [cpaneld] 107.174.169.209 - xflhqsmv "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.169.213.211
country_id: 732800
description:
Jun 20 11:25:29 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.169.213.211 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:11:25:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:11:25:39 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.195.83.109
country_id: 6252001
description:
[2026-06-20 11:25:57 +0000] info [cpaneld] 134.195.83.109 - ubwmytwf "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: User ubwmytwf has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.44.62.240
country_id: 6252001
description:
[2026-06-20 11:26:57 +0000] info [cpaneld] 64.44.62.240 - nadngfzn "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.13
country_id: 2635167
description:
[2026-06-20 11:27:06 +0000] info [cpaneld] 5.230.153.13 - dmmkifel "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.195.83.78
country_id: 6252001
description:
[2026-06-20 11:27:25 +0000] info [cpaneld] 134.195.83.78 - hsufgiqg "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: User hsufgiqg has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.185
country_id: 2635167
description:
[2026-06-20 11:27:13 +0000] info [cpaneld] 5.230.153.185 - himcuijv "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.26
country_id: 2635167
description:
[2026-06-20 11:26:35 +0000] info [cpaneld] 5.230.153.26 - arsetg "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.211.89.140
country_id: 6252001
description:
[2026-06-20 11:27:58 +0000] info [cpaneld] 173.211.89.140 - zgqykfsi "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.125
country_id: 2635167
description:
[2026-06-20 11:28:04 +0000] info [cpaneld] 5.230.153.125 - vefzejhd "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.215
country_id: 2635167
description:
[2026-06-20 11:28:08 +0000] info [cpaneld] 5.230.133.215 NEW cietg:bn_9eHz1XtS5JoV3 address=5.230.133.215,app=cpaneld,creator=cietg,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 206.232.1.93
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:11-29.206.232.1.93||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.240
country_id: 2635167
description:
[2026-06-20 11:28:33 +0000] info [cpaneld] 5.230.133.240 NEW cafetg:dFHpBTkLSUVB1MA6 address=5.230.133.240,app=cpaneld,creator=cafetg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.228
country_id: 6252001
description:
[2026-06-20 11:28:48 +0000] info [cpaneld] 64.44.62.228 NEW cafeitadm:cOQfb5gLWzbkzvFx address=64.44.62.228,app=cpaneld,creator=cafeitadm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.175.5.177
country_id: 6252001
description:
[2026-06-20 11:29:00 +0000] info [cpaneld] 107.175.5.177 - assedderetrm "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.16
country_id: 2635167
description:
[2026-06-20 11:29:36 +0000] info [cpaneld] 5.230.133.16 - muzsajnk "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.231.64.90
country_id: 3017382
description:
[2026-06-20 11:30:07 +0000] info [cpaneld] 5.231.64.90 - centif "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.122
country_id: 2635167
description:
[2026-06-20 11:30:13 +0000] info [cpaneld] 5.230.153.122 - afdim "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.212
country_id: 2635167
description:
[2026-06-20 11:30:17 +0000] info [cpaneld] 5.230.133.212 - cfpjusti "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.231.64.56
country_id: 3017382
description:
[2026-06-20 11:30:22 +0000] info [cpaneld] 5.231.64.56 - yxhnfwxr "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.94
country_id: 2635167
description:
[2026-06-20 11:30:44 +0000] info [cpaneld] 5.230.153.94 - cloudetracks "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:11:31:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804487&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781955061 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.44.62.195
country_id: 6252001
description:
[2026-06-20 11:31:09 +0000] info [cpaneld] 64.44.62.195 - fnnjmavs "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.175.5.35
country_id: 6252001
description:
[2026-06-20 11:31:02 +0000] info [cpaneld] 107.175.5.35 - ygeaivhj "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: User ygeaivhj has their account suspended. Login blocked.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:11:31:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10185574&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781955065 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.254.224.164
country_id: 1880251
description:
[2026-06-20 11:31:13 +0000] info [whostmgrd] 54.254.224.164 - test1 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 149.102.239.226
country_id: 798549
domain: derou.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:53383.derou.tg||ServerName:derou.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b38c33f970ec250b198c0a4afbe252af52aac36e||Title:0x46d95dc8||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:11:31:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923272&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781955084 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.44.62.229
country_id: 6252001
description:
[2026-06-20 11:31:51 +0000] info [cpaneld] 64.44.62.229 - myxlsnta "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.42
country_id: 2635167
description:
[2026-06-20 11:32:14 +0000] info [cpaneld] 5.230.153.42 - mvfxewjz "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.211.89.140
country_id: 6252001
description:
[2026-06-20 11:32:21 +0000] info [cpaneld] 173.211.89.140 - davetkoo "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.179
country_id: 2635167
description:
[2026-06-20 11:31:36 +0000] info [cpaneld] 5.230.153.179 - wcdxbboq "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.110
country_id: 2635167
description:
[2026-06-20 11:31:56 +0000] info [cpaneld] 5.230.133.110 NEW rbnbkmre:qJxaZP6h59IqRaJ7 address=5.230.133.110,app=cpaneld,creator=rbnbkmre,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.44.62.24
country_id: 6252001
description:
[2026-06-20 11:32:39 +0000] info [cpaneld] 64.44.62.24 - zmfpejke "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: User zmfpejke has their account suspended. Login blocked.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.234.137.115
country_id: 690791
description:
Jun 20 11:32:29 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.234.137.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.36.237
country_id: 2395170
description:
Jun 20 11:33:01 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.36.237 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.158
country_id: 2635167
description:
[2026-06-20 11:33:09 +0000] info [cpaneld] 5.230.133.158 - kygyhxkc "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.211
country_id: 2635167
description:
[2026-06-20 11:32:43 +0000] info [cpaneld] 5.230.153.211 - ylhgcaui "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.44.59.151
country_id: 6252001
description:
[2026-06-20 11:32:28 +0000] info [cpaneld] 64.44.59.151 - dgdntogo "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 170.233.243.34
country_id: 3469034
description:
170.233.243.34 - - [20/Jun/2026:11:32:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7379610&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdimas-dzikodo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781955159 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/dimas-dzikodo/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.4306.1491 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:170.233.243.34


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.56
country_id: 2635167
description:
[2026-06-20 11:33:00 +0000] info [cpaneld] 5.230.133.56 - uubplgpf "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.14
country_id: 2635167
description:
[2026-06-20 11:33:44 +0000] info [cpaneld] 5.230.153.14 - afgqjhmw "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.33
country_id: 2635167
description:
[2026-06-20 11:33:54 +0000] info [cpaneld] 5.230.153.33 - arsjawjaz "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.83.78
country_id: 6252001
description:
[2026-06-20 11:34:16 +0000] info [cpaneld] 134.195.83.78 NEW tgkkwsvr:UT3fHfyN0xl_zd19 address=134.195.83.78,app=cpaneld,creator=tgkkwsvr,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.175.5.35
country_id: 6252001
description:
[2026-06-20 11:34:51 +0000] info [cpaneld] 107.175.5.35 - tubobkfl "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.231.255.50
country_id: 3017382
description:
[2026-06-20 11:35:00 +0000] info [cpaneld] 5.231.255.50 - rdlizssu "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.148
country_id: 2635167
description:
[2026-06-20 11:35:05 +0000] info [cpaneld] 5.230.133.148 - jvrzfkho "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.167
country_id: 2635167
description:
[2026-06-20 11:35:20 +0000] info [cpaneld] 5.230.153.167 - fgbegmfv "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.114
country_id: 2635167
description:
[2026-06-20 11:36:13 +0000] info [cpaneld] 5.230.133.114 - nwvfmxat "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.51.88.60
country_id: 1282988
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/08/Association.jpeg 720w, http:/togodailynews.tg/wp-content/uploads/2021/08/Association-300x218.jpeg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.168
country_id: 3017382
description:
[2026-06-20 11:35:49 +0000] info [cpaneld] 5.231.64.168 NEW kpmg:ddiKNJZjxaNNxrb4 address=5.231.64.168,app=cpaneld,creator=kpmg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.8.215
country_id: 3469034
description:
Jun 20 11:36:24 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.8.215 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.74
country_id: 2635167
description:
[2026-06-20 11:36:36 +0000] info [cpaneld] 5.230.153.74 - lhxhatyj "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.254
country_id: 2635167
description:
[2026-06-20 11:36:42 +0000] info [cpaneld] 5.230.153.254 NEW vuvwskxh:glaKYUybc_pp9itf address=5.230.153.254,app=cpaneld,creator=vuvwskxh,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.108
country_id: 2635167
description:
[2026-06-20 11:37:16 +0000] info [cpaneld] 5.230.153.108 NEW utkxprkk:J116cIyGOf41EEqN address=5.230.153.108,app=cpaneld,creator=utkxprkk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.8.215
country_id: 3469034
description:
Jun 20 11:36:32 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.8.215 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.211
country_id: 2635167
description:
[2026-06-20 11:38:25 +0000] info [cpaneld] 5.230.153.211 - dxsiclpd "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.174.169.229
country_id: 6252001
description:
[2026-06-20 11:37:37 +0000] info [cpaneld] 107.174.169.229 NEW libertepansel:LBsjcNFoep1bs_Zz address=107.174.169.229,app=cpaneld,creator=libertepansel,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.35.101.108
country_id: 1880251
description:
2026-06-20 11:37:59 dovecot_plain authenticator failed for H=(d2grkf50l0dstyx7gtzstpiamtcuneyj) [213.35.101.108]:34562: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.177
country_id: 2635167
description:
[2026-06-20 11:39:09 +0000] info [cpaneld] 5.230.133.177 - jmtctoni "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 173.211.89.140
country_id: 6252001
description:
[2026-06-20 11:39:55 +0000] info [cpaneld] 173.211.89.140 NEW tqbcalqt:MholSI9NBz2h5M4J address=173.211.89.140,app=cpaneld,creator=tqbcalqt,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.208.23.33
country_id: 3625428
description:
[2026-06-20 11:40:42 +0000] info [cpaneld] 181.208.23.33 - cafetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.74.66.15
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/469996200 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 192.140.77.168
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/618376615 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.117
country_id: 2635167
description:
[2026-06-20 11:40:29 +0000] info [cpaneld] 5.230.133.117 - moodlefreenetmas "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.223
country_id: 6252001
description:
[2026-06-20 11:40:43 +0000] info [cpaneld] 64.44.62.223 NEW netfreenet:K2G61FsfJQ1qGMw1 address=64.44.62.223,app=cpaneld,creator=netfreenet,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.33
country_id: 2635167
description:
[2026-06-20 11:41:12 +0000] info [cpaneld] 5.230.153.33 - neliam "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.230
country_id: 2635167
description:
[2026-06-20 11:41:22 +0000] info [cpaneld] 5.230.153.230 NEW gsizyncj:DTFY3rALrw3HgBhc address=5.230.153.230,app=cpaneld,creator=gsizyncj,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:11:41:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9933461&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781955711 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.175.5.84
country_id: 6252001
description:
[2026-06-20 11:42:16 +0000] info [cpaneld] 107.175.5.84 - pnls "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:11:41:39 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:11:41:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.211.89.138
country_id: 6252001
description:
[2026-06-20 11:41:47 +0000] info [cpaneld] 173.211.89.138 - pmalabvi "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:11:41:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923442&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781955712 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.200.22.140
country_id: 1562822
description:
2026-06-20 11:42:29 dovecot_plain authenticator failed for H=(i62ojp6q9zdz0ugbjoup) [103.200.22.140]:54746: 535 Incorrect authentication data (set_id=kpip@emt.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.38
country_id: 2635167
description:
[2026-06-20 11:42:29 +0000] info [cpaneld] 5.230.153.38 - qjzcsoob "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.255
country_id: 3469034
description:
Jun 20 11:42:40 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.255 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.136
country_id: 2635167
description:
[2026-06-20 11:43:03 +0000] info [cpaneld] 5.230.153.136 - qfaclpeg "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.44.59.151
country_id: 6252001
description:
[2026-06-20 11:43:19 +0000] info [cpaneld] 64.44.59.151 - bighostingsnbd "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.195.83.16
country_id: 6252001
description:
[2026-06-20 11:44:27 +0000] info [cpaneld] 134.195.83.16 - waywcbyw "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.167
country_id: 2635167
description:
[2026-06-20 11:43:32 +0000] info [cpaneld] 5.230.153.167 - sxoyfjqv "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.78
country_id: 3017382
description:
[2026-06-20 11:43:58 +0000] info [cpaneld] 5.231.255.78 NEW aneos:xuZwotrp0kzmDfgf address=5.231.255.78,app=cpaneld,creator=aneos,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.195.83.207
country_id: 6252001
description:
[2026-06-20 11:44:37 +0000] info [cpaneld] 134.195.83.207 - elmkvzcm "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.23
country_id: 2635167
description:
[2026-06-20 11:44:57 +0000] info [cpaneld] 5.230.153.23 - ulduzncs "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.133.20
country_id: 2635167
description:
[2026-06-20 11:45:13 +0000] info [cpaneld] 5.230.133.20 - wttzshhf "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: User wttzshhf has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.175.5.140
country_id: 6252001
description:
[2026-06-20 11:45:21 +0000] info [cpaneld] 107.175.5.140 - cipvzfnv "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:11:46:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6515657&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781955958 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:11:46:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10185876&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781955958 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.231.64.143
country_id: 3017382
description:
[2026-06-20 11:46:03 +0000] info [cpaneld] 5.231.64.143 - aogodmm "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.231.255.233
country_id: 3017382
description:
[2026-06-20 11:46:15 +0000] info [cpaneld] 5.231.255.233 - xdkbrmjc "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.231.255.143
country_id: 3017382
description:
[2026-06-20 11:45:31 +0000] info [cpaneld] 5.231.255.143 - togoinrdceh "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.154
country_id: 2635167
description:
[2026-06-20 11:45:35 +0000] info [cpaneld] 5.230.133.154 NEW ecukpqcm:Ofe6eyaMAMEAmVBu address=5.230.133.154,app=cpaneld,creator=ecukpqcm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.18
country_id: 2635167
description:
[2026-06-20 11:46:48 +0000] info [cpaneld] 5.230.153.18 - aopsacai "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.175.229.192
country_id: 2921044
description:
[2026-06-20 11:46:44 +0000] info [cpaneld] 5.175.229.192 NEW cietg:PzLW1hDDe9sK3soT address=5.175.229.192,app=cpaneld,creator=cietg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.227
country_id: 2635167
description:
[2026-06-20 11:48:19 +0000] info [cpaneld] 5.230.153.227 NEW sodigaz:HMBul8S5UcRNqAhX address=5.230.153.227,app=cpaneld,creator=sodigaz,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.42.200.110
country_id: 1880251
description:
[2026-06-20 11:49:19 +0000] info [cpaneld] 152.42.200.110 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.123.124.226
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/12/WhatsApp-Image-2024-12-07-at-16.14.43.jpeg 737w, http:/togodailynews.tg/wp-content/uploads/2024/12/WhatsApp-Image-2024-12-07-at-16.14.43-300x191.jpeg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.136
country_id: 2635167
domain: letempsdaider.org
description:
IM360 WAF: Possible phishing page detected||SC:/home/utkxprkk/public_html/.799879871641801.php||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.13
country_id: 2635167
description:
[2026-06-20 11:51:22 +0000] info [cpaneld] 5.230.153.13 NEW tqbcalqt:44g8hHt15wcJEp5p address=5.230.153.13,app=cpaneld,creator=tqbcalqt,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.229
country_id: 2635167
description:
[2026-06-20 11:51:24 +0000] info [cpaneld] 5.230.153.229 NEW tgkkwsvr:T6autKocRle3HEsh address=5.230.153.229,app=cpaneld,creator=tgkkwsvr,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.24
country_id: 6252001
description:
[2026-06-20 11:50:43 +0000] info [cpaneld] 64.44.62.24 NEW utkxprkk:3gYk0gFSRqJFF0qh address=64.44.62.24,app=cpaneld,creator=utkxprkk,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.133
country_id: 2635167
domain: fomda.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/tgkkwsvr/public_html/.761961273551815.php||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.211.52.202
country_id: 2328926
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1167527528 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.33
country_id: 2635167
domain: letempsdaider.org
description:
IM360 WAF: Possible phishing page detected||SC:/home/utkxprkk/public_html/.835415091749313.php||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.254.163.126
country_id: 458258
description:
Jun 20 11:52:38 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.254.163.126 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 87.201.116.176
country_id: 290557
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1119917110 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.28.77.250
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/diplomatie/page/1347724381 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.121.234.210
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/diplomatie/page/295483657 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.56
country_id: 3017382
description:
[2026-06-20 11:52:41 +0000] info [cpaneld] 5.231.64.56 NEW utkxprkk:ATLPNk8NUYBz8euR address=5.231.64.56,app=cpaneld,creator=utkxprkk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.83.109
country_id: 6252001
description:
[2026-06-20 11:53:10 +0000] info [cpaneld] 134.195.83.109 NEW sodigaz:ECKExUIy18NpN61b address=134.195.83.109,app=cpaneld,creator=sodigaz,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.225
country_id: 2635167
description:
[2026-06-20 11:53:16 +0000] info [cpaneld] 5.230.133.225 NEW utkxprkk:o9JmBJcF1kcDiWI9 address=5.230.133.225,app=cpaneld,creator=utkxprkk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.66
country_id: 798544
description:
Jun 20 11:53:38 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.101.235
country_id: 3865483
description:
Jun 20 11:53:52 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.101.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.30
country_id: 732800
description:
Jun 20 11:54:26 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.30
country_id: 732800
description:
Jun 20 11:54:32 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.30 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:11:56:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724249&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781956563 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:11:56:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9858917&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781956563 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:11:55:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:11:55:32 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.180.149.199
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/diplomatie/page/469442016 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.83.16
country_id: 6252001
description:
[2026-06-20 11:58:40 +0000] info [cpaneld] 134.195.83.16 NEW naduwpdk:TvU9qi1CpKkE_zuc address=134.195.83.16,app=cpaneld,creator=naduwpdk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 35.166.242.236
country_id: 6252001
description:
35.166.242.236 - - [20/Jun/2026:12:00:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13263508&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252Facf2d8c858075b0500387330fbe3e107%252Fea425e05eea2788cc063ebda30164563%252F0e3d26786953aa33eaa79d2011a94992%252F223e0c8cca861474d24cfd8905cb5776%252F40636423c4130eeb315603afd55740c9%252Findex.php%253Fcmd%253Dnewupld%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781956842 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/acf2d8c858075b0500387330fbe3e107/ea425e05eea2788cc063ebda30164563/0e3d26786953aa33eaa79d2011a94992/223e0c8cca861474d24cfd8905cb5776/40636423c4130eeb315603afd55740c9/index.php?cmd=newupld/" "Mozilla/5.0 (Linux; Android 8.0.0; SM-G965U Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.155 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:35.166.242.236


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.65.60
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-usa-faure-gnassingbe-et-florizelle-liser-renforcent-le-partenariat-economique/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.65.60
country_id: 99237
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/togo-usa-faure-gnassingbe-et-florizelle-liser-renforcent-le-partenariat-economique/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.42
country_id: 3469034
description:
Jun 20 12:00:35 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.42 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:12:01:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7456158&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781956892 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:12:01:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7302083&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781956888 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.160.225.40
country_id: 272103
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/diplomatie/page/loading HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 180.74.225.59
country_id: 1733045
description:
180.74.225.59 - - [20/Jun/2026:12:03:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6788708&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-vers-un-renforcement-des-chaines-de-valeurs-en-ressources-humaines%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781957027 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-vers-un-renforcement-des-chaines-de-valeurs-en-ressources-humaines/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:180.74.225.59


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.231.121.75
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/diplomatie/page/7d6e79 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.84.144
country_id: 2921044
description:
[2026-06-20 12:10:50 +0000] info [cpaneld] 217.181.84.144 - scan@togosem.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.178.14
country_id: 3175395
description:
Jun 20 12:12:17 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.178.14 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:12:11:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:12:11:33 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.9.33
country_id: 3469034
description:
Jun 20 12:11:57 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.9.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.178.14
country_id: 3175395
description:
Jun 20 12:12:30 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.178.14 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:12:12:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7128932&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781957552 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:12:12:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6787993&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781957553 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 113.211.214.29
country_id: 1733045
description:
113.211.214.29 - - [20/Jun/2026:12:13:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6788760&pdata=http%253A%252F%252Ftogodailynews.tg%252Fwp-json%252Foembed%252F1.0%252Fembed%253Furl%253Dhttp%25253A%25252F%25252Ftogodailynews.tg%25252Fcooperation-les-officiels-kazakhstanais-saluent-la-vision-de-developpement-de-faure-gnassingbe%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781957632 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/wp-json/oembed/1.0/embed?url=http%3A%2F%2Ftogodailynews.tg%2Fcooperation-les-officiels-kazakhstanais-saluent-la-vision-de-developpement-de-faure-gnassingbe%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:113.211.214.29


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:12:16:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6647651&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781957815 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:12:16:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10392682&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781957815 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:12:17:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184806&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781957817 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.123.208.239
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/12/WhatsApp-Image-2024-12-07-at-15.56.03-1-1024x768.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/12/WhatsApp-Image-2024-12-07-at-15.56.03-1-300x225.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2024/12/WhatsApp-Image-2024-12-07-at-15.56.03-1-768x576.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2024/12/WhatsApp-Image-2024-12-07-at-15.56.03-1.jpeg 1040w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 177.104.18.42
country_id: 3469034
description:
177.104.18.42 - - [20/Jun/2026:12:19:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10339435&pdata=https%253A%252F%252Fwebmail.otf-boutique.free.netmaster.tg%252F%253Flocale%253Dzh_tw&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781957995 HTTP/2.0" 302 0 webmail.otf-boutique.free.netmaster.tg "https://webmail.otf-boutique.free.netmaster.tg/?locale=zh_tw" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:177.104.18.42


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 86.99.180.6
country_id: 290557
description:
86.99.180.6 - - [20/Jun/2026:12:20:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855574&pdata=https%253A%252F%252F24heureinfo.tg%252Fsante%252Fchr-tsevie-trois-jours-de-sit-in-du-personnel-contre-les-detournements-2&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781958003 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/sante/chr-tsevie-trois-jours-de-sit-in-du-personnel-contre-les-detournements-2" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:86.99.180.6


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.171.5.203
country_id: 2363686
description:
[2026-06-20 12:20:06 +0000] info [cpaneld] 196.171.5.203 NEW pnls:wsz2xYc9AUlMM6GO address=196.171.5.203,app=cpaneld,creator=pnls,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.66.4.9
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/diplomatie/page/dad7cd HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.168.0.74
country_id: 3469034
description:
Jun 20 12:24:16 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.168.0.74 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.251.255.240
country_id: 1168579
description:
103.251.255.240 - - [20/Jun/2026:12:24:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13213083&pdata=https%253A%252F%252Ftogodailynews.tg%252Fiatf-2025-les-tpme-togolaises-de-demarquent&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781958258 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/iatf-2025-les-tpme-togolaises-de-demarquent" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.251.255.240


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.168.0.74
country_id: 3469034
description:
Jun 20 12:24:30 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.168.0.74 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:12:24:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:12:24:44 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.215.62.202
country_id: 3895114
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/diplomatie/page/566d68 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:12:26:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934739&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781958393 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:12:26:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6854041&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781958395 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.208
country_id: 2635167
description:
[2026-06-20 12:27:32 +0000] info [cpaneld] 5.230.153.208 NEW cinemafreenetmas:s0HUFnMU53CzrEG5 address=5.230.153.208,app=cpaneld,creator=cinemafreenetmas,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.20
country_id: 2635167
domain: cinema.free.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/cinemafreenetmas/public_html/.455414697671018.php||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.5.45.29
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/12/WhatsApp-Image-2024-12-07-at-16.14.42.jpeg 657w, http:/togodailynews.tg/wp-content/uploads/2024/12/WhatsApp-Image-2024-12-07-at-16.14.42-300x214.jpeg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 98.97.53.146
country_id: 6251999
domain: certlogisticstogo.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/certlogisticstogo.com/contact/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.58.120.15
country_id: 614540
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/635c5a HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:12:32:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724295&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781958729 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:12:32:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7104367&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781958733 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 180.75.243.219
country_id: 1733045
description:
180.75.243.219 - - [20/Jun/2026:12:31:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053533&pdata=https%253A%252F%252Fcivilemagazine.tg%252Ftag%252Fac-barracuda%252F%253Famp%253D1&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781958701 HTTP/2.0" 302 0 civilemagazine.tg "https://civilemagazine.tg/tag/ac-barracuda/?amp=1" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.9104.1484 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:180.75.243.219


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:12:32:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9724828&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781958745 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.16.91.93
country_id: 1269750
description:
Jun 20 12:34:03 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.16.91.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.177.93.172
country_id: 6252001
description:
Jun 20 12:34:47 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 54.177.93.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.177.93.172
country_id: 6252001
description:
2026-06-20 12:34:49 dovecot_plain authenticator failed for H=ec2-54-177-93-172.us-west-1.compute.amazonaws.com (i6a3fiv7xs4tif9vl44u5s8a) [54.177.93.172]:36632: 535 Incorrect authentication data (set_id=hkanaza@otr.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.97.6.144
country_id: 1527747
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/80737a HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 175.107.215.151
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/09/IMG-20210928-WA01492-1024x583.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2021/09/IMG-20210928-WA01492-300x171.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2021/09/IMG-20210928-WA01492-768x437.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2021/09/IMG-20210928-WA01492.jpg 1080w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.166
country_id: 6252001
description:
[2026-06-20 12:38:13 +0000] info [cpaneld] 64.44.59.166 NEW utkxprkk:CWTrSzFBEwdJ50yG address=64.44.59.166,app=cpaneld,creator=utkxprkk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.42
country_id: 2635167
description:
[2026-06-20 12:38:13 +0000] info [cpaneld] 5.230.153.42 NEW tgkkwsvr:W0U5peWsi9V41xHd address=5.230.153.42,app=cpaneld,creator=tgkkwsvr,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.18
country_id: 2635167
description:
[2026-06-20 12:38:13 +0000] info [cpaneld] 5.230.153.18 NEW cietg:PETCoLj9W14TuhzZ address=5.230.153.18,app=cpaneld,creator=cietg,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 134.195.83.207
country_id: 6252001
domain: soena.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/expirefreenetmas/public_html/.508846225781380.php||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.231.255.112
country_id: 3017382
domain: letempsdaider.org
description:
IM360 WAF: Possible phishing page detected||SC:/home/utkxprkk/public_html/.491681705118463.php||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.102
country_id: 6252001
description:
[2026-06-20 12:38:13 +0000] info [cpaneld] 64.44.59.102 NEW sodigaz:S8wkI_24kEC73V2G address=64.44.59.102,app=cpaneld,creator=sodigaz,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.151
country_id: 6252001
description:
[2026-06-20 12:38:12 +0000] info [cpaneld] 64.44.59.151 NEW aneos:bUJlc7Fx4tPNvVHH address=64.44.59.151,app=cpaneld,creator=aneos,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.179
country_id: 2635167
description:
[2026-06-20 12:38:15 +0000] info [cpaneld] 5.230.153.179 NEW utkxprkk:j7OnaOhexpL329e6 address=5.230.153.179,app=cpaneld,creator=utkxprkk,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.169
country_id: 2635167
domain: fomda.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/tgkkwsvr/public_html/.310199252553294.php||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.223
country_id: 2635167
description:
[2026-06-20 12:38:13 +0000] info [cpaneld] 5.230.133.223 NEW vuvwskxh:aeu6tpXN64YahNXn address=5.230.133.223,app=cpaneld,creator=vuvwskxh,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.68.2.159
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/2140352484 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.71.117
country_id: 6252001
description:
[2026-06-20 12:39:42 +0000] info [whostmgrd] 217.181.71.117 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 185.213.83.147
country_id: 1643084
description:
[2026-06-20 12:39:58 +0000] info [cpaneld] 185.213.83.147 NEW utkxprkk:ch4BxyPCKQmLnkdN address=185.213.83.147,app=cpaneld,creator=utkxprkk,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.117.163.21
country_id: 1168579
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2cf1b2b89025949a7489e69e8b8ee009b0afe3e7||Title:zoz5pvk0xmv4klpdq||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:12:41:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:12:41:02 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:12:42:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6843076&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781959323 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:12:42:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6775965&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781959323 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 68.10.175.128
country_id: 6252001
domain: sp-eau.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/sp-eau.tg/wp-json/wp/v2/posts HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.97.130
country_id: 798544
description:
Jun 20 12:43:01 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.97.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.41.244.238
country_id: 3865483
description:
Jun 20 12:43:31 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.41.244.238 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.21.251.50
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/09/IMG-20210928-WA01512-1024x583.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2021/09/IMG-20210928-WA01512-300x171.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2021/09/IMG-20210928-WA01512-768x437.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2021/09/IMG-20210928-WA01512.jpg 1080w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.48.106
country_id: 6252001
domain: ariana.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ariana.tg/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:12:46:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6473322&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781959564 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.8.170
country_id: 2017370
description:
2026-06-20 12:50:29 dovecot_plain authenticator failed for H=(donally) [31.173.8.170]:22078: 535 Incorrect authentication data (set_id=hr@cameg-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.230
country_id: 3469034
description:
Jun 20 12:51:31 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.44.242
country_id: 2300660
description:
Jun 20 12:52:44 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.44.242 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.117.163.21
country_id: 1168579
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:42d32f7953b65009103f46221a0f9c5e48912ec3||Title:6iqb1p99dsi5r2d8||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.117.163.21
country_id: 1168579
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7134d9a9c52c22bfe95d2de452f52ebe08f876c6||Title:u61wsa93pjwuzio0||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.117.163.21
country_id: 1168579
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bf2e431fa06e05ec69459c9e3b16527fe2a0ce12||Title:y83vglqjypk9y6q||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:12:55:27 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:12:55:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:12:58:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7181464&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781960316 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:12:58:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923683&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781960318 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.171.11.166
country_id: 2363686
domain: civilemagazine.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.19||T:APACHE||MV:/wp-json/wp/v2/users/10?context=view&_fields=id%2Cname&_locale=user||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:13:02:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9882002&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781960541 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.117.163.21
country_id: 1168579
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:318b49f0cbda96c010372d9793c0f8eb6c8bc43a||Title:pf7ft4wqb7srca||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.218.217.235
country_id: 6252001
description:
[2026-06-20 13:03:21 +0000] info [cpaneld] 13.218.217.235 - pduusmyf "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.117.163.18
country_id: 1168579
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:324e95cba45c4eb7c844ef404adaeb314be5be9b||Title:eb1wn42dal8rc9j||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:13:02:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10056133&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781960545 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:13:02:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9868436&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781960554 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.117.163.21
country_id: 1168579
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:19a05cfb97ec0019da2175db7e400599c7764522||Title:sr8ofhehevtbcxz||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 5.193.238.172
country_id: 290557
description:
5.193.238.172 - - [20/Jun/2026:13:05:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6908315&pdata=https%253A%252F%252Ftogodailynews.tg%252Fassemblee-nationale-les-deputes-examinent-le-projet-de-loi-de-finances-2021%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781960741 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/assemblee-nationale-les-deputes-examinent-le-projet-de-loi-de-finances-2021/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:5.193.238.172


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.97.183
country_id: 3865483
description:
Jun 20 13:06:36 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.97.183 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 180.75.252.15
country_id: 1733045
description:
180.75.252.15 - - [20/Jun/2026:13:06:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10382233&pdata=https%253A%252F%252F24heureinfo.tg%252Ftag%252Fgrand-marche%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781960804 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/tag/grand-marche/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:180.75.252.15


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:13:10:47 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:13:10:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:13:14:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10250080&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781961255 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:13:14:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10274460&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781961255 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 198.13.46.245
country_id: 1861060
domain: sia-togo.tg
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:8.19||T:APACHE||MV:/wp-admin/maint/index.php||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.58.124
country_id: 2363686
description:
[2026-06-20 13:16:55 +0000] info [webmaild] 196.171.58.124 - info@matosshop.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:13:16:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6906734&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781961397 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.26
country_id: 2635167
description:
[2026-06-20 13:17:12 +0000] info [cpaneld] 5.230.153.26 NEW doufelg:8p4jJrVfkYLwSwfH address=5.230.153.26,app=cpaneld,creator=doufelg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:13:16:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985317&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781961393 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.253.159.70
country_id: 732800
description:
Jun 20 13:18:12 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.253.159.70 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 110.34.22.145
country_id: 1282988
domain: tdn.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tg/togo-a-aklakou-4-individus-arretes-en-possession-dun-sac-plein-des-tetes-humaines-ames-sensibles-sabstenir/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 110.34.22.145
country_id: 1282988
domain: tdn.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tghttp/tdn.tg/togo-a-aklakou-4-individus-arretes-en-possession-dun-sac-plein-des-tetes-humaines-ames-sensibles-sabstenir/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.248
country_id: 3469034
description:
Jun 20 13:17:53 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.248 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 198.13.46.245
country_id: 1861060
domain: mail.confortis.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.19||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/conforwellty/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.7.130
country_id: 2395170
description:
Jun 20 13:18:38 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.7.130 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.184.245.42
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:67025.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:83bc5e73ada9d9f25e36cf3ffa45ca4fa6ab4f14||Title:0x5710f8c2||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 144.91.125.41
country_id: 3017382
description:
[2026-06-20 13:19:35 +0000] info [cpaneld] 144.91.125.41 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.184.245.42
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.com.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1063693d5aa9b2915c52ff4917ec0151b353f616||Title:0xb68d2503||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.184.245.42
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.com.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8696e23c3a1ab6072af20f09657fb15f14541bbe||Title:0x09f48301||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.184.245.42
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.com.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9a5dcd0d32d61105c60f8200c242f4805f6cc5a8||Title:0x52869e87||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.184.245.42
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.com.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:22f58922e1199370c1ac3722a93f087d8c97e7cf||Title:0x35d44bb5||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:13:25:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.159.75.50
country_id: 1814991
description:
27.159.75.50 - - [20/Jun/2026:13:26:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6843290&pdata=http%253A%252F%252Fgatti.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781961958 HTTP/1.1" 302 0 gatti.free.netmaster.tg "http://gatti.free.netmaster.tg/" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.159.75.50


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 123.6.49.18
country_id: 1814991
description:
123.6.49.18 - - [20/Jun/2026:13:25:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9868952&pdata=https%253A%252F%252Fhaplucia-togo.tg%252Fstatistiques%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781961925 HTTP/2.0" 302 0 haplucia-togo.tg "https://haplucia-togo.tg/statistiques/" "Mozilla/5.0 (Linux; U; Android 8.1.0; zh-cn; MI 8 Build/OPM1.171019.011) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.108 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:123.6.49.18


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:13:25:33 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.184.245.42
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.com.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e3811b4be3d1bc929de747d4a46f8f5060d51fbc||Title:0x36705ec4||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.184.245.42
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.com.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d69933e03aef7098b43bc28af745ae354f5a8041||Title:0x3ec45013||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.184.245.42
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.com.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ff63c4e33ed071aa7e3724bfedf50b2288e79434||Title:0x94774852||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.184.245.42
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.com.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b154c2b9ce360270f8dd83a44cac3db419509916||Title:0x6858a970||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:13:29:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791596&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781962165 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.52.211.184
country_id: 1694008
description:
Jun 20 13:28:48 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.52.211.184 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 198.13.37.241
country_id: 1861060
domain: gstock.soena.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.19||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/expirefreenetmas/public_html/wp-content||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:13:29:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10197910&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781962168 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:13:30:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7105125&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781962199 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.184.245.42
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.com.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b1f488df54dfecb09025fdf7a365ae844d3a6204||Title:0x01ab7f0a||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:13:30:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869165&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781962199 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.32.62.47
country_id: 1861060
domain: autodiscover.tps.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.19||T:APACHE||MV:/wp-content/uploads/index.php||SC:proxy:http://127.0.0.1/cgi-sys/autodiscover.cgi||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.21.16
country_id: 2300660
description:
Jun 20 13:30:58 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.21.16 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.184.245.42
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.com.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7fb60234ea4224c408cd5ae72c9a7caf4f9ec250||Title:0xfb904fd8||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.184.245.42
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.com.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:002e5164a8ab8d1e2f7eeca1ab65c7deba29e982||Title:0x3d4b2421||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 146.19.44.154
country_id: 6252001
domain: www.arse.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:https://)D*c%T4K6XjC!JM.www.arse.tg||Method:wp.getUsersBlogs


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.184.245.42
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.com.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e7cd37ad9e06d7537ead1d116bf5d1b3cde8b329||Title:0x207741f4||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.112
country_id: 3017382
description:
[2026-06-20 13:33:11 +0000] info [cpaneld] 5.231.255.112 NEW hgfdcvbnk:Ej9D7TlG11vjoqG2 address=5.231.255.112,app=cpaneld,creator=hgfdcvbnk,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.184.245.42
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.com.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8fc2922856bb6ab40ebde3f822cb5aefe4f6ee2d||Title:0xaa9abb37||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.184.245.42
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.com.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5b7f111f207b848c3fd904fcb6bbb6109fd649e4||Title:0x9f471260||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 198.13.37.241
country_id: 1861060
domain: centif.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.19||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/centif/public_html/wp-content||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.184.245.42
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.com.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ed5a2972aa86c06ba9f1abb22774cfdb4ddb9db5||Title:0x514fedff||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.184.245.42
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.com.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:09daa779e8164e6f0ca65e5333dd8a1d742269fe||Title:0x69d1336c||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.184.245.42
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.com.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2793649a7e34968f0dc337c4b52b2ef0ecadc474||Title:0xc1d63ab6||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:13:39:27 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 206.232.3.254
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:13-38.206.232.3.254||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:13:39:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.184.245.42
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.com.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3693d3cfce632c0b2fe8b06813bcb0018af6094f||Title:0xf1dd8403||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.184.245.42
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.com.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9b393018a49f5cc3ffd2e86a539b198fdcac2e46||Title:0x25957c27||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.184.245.42
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.com.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ea0f1ced7b4c32a88efd231ae5852575baa97bc3||Title:0x6203c21b||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.146.184.102
country_id: 272103
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/932761407 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.126
country_id: 3175395
description:
Jun 20 13:45:05 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.140.73
country_id: 690791
description:
Jun 20 13:45:11 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.140.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.250.111
country_id: 3469034
description:
Jun 20 13:45:25 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.250.111 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:13:44:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7038150&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781963083 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:13:44:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9924762&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781963087 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:13:45:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6525807&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781963095 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.75.168.35
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/10935458 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:13:46:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6341991&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781963180 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:13:46:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9922712&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781963184 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.250.111
country_id: 3469034
description:
Jun 20 13:45:31 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.250.111 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.16
country_id: 2635167
description:
[2026-06-20 13:48:43 +0000] info [cpaneld] 5.230.133.16 NEW tqbcalqt:JWug6oFPsXfXrjzd address=5.230.133.16,app=cpaneld,creator=tqbcalqt,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.255
country_id: 3469034
description:
Jun 20 13:49:20 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.255 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.255
country_id: 3469034
description:
Jun 20 13:49:35 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.255 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.148.251
country_id: 2363686
description:
2026-06-20 13:50:55 dovecot_login authenticator failed for H=(Yoga) [102.64.148.251]:63388: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.47.125
country_id: 2300660
description:
Jun 20 13:54:05 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.47.125 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:13:54:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:13:54:38 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.229.85.68
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/11/images-1.jpg 225w, http:/togodailynews.tg/wp-content/uploads/2023/11/images-1-150x150.jpg 150w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 51.210.118.219
country_id: 3017382
domain: civilemagazine.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/131.0.0.0 Safari/537.36||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.255.197.170
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/ab816c HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.203.178.241
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/11/ob_e80325_img-20181106-103100-572.jpg 997w, http:/togodailynews.tg/wp-content/uploads/2023/11/ob_e80325_img-20181106-103100-572-300x273.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2023/11/ob_e80325_img-20181106-103100-572-768x699.jpg 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.22.72.185
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1904360234 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.142.134.253
country_id: 146669
description:
Jun 20 13:56:52 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.142.134.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.85.61.209
country_id: 3469034
description:
Jun 20 13:56:40 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.85.61.209 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.70.21
country_id: 6252001
description:
[2026-06-20 13:58:19 +0000] info [cpaneld] 217.181.70.21 - prince "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user prince (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.76.208
country_id: 3469034
description:
Jun 20 13:58:48 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.76.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.136
country_id: 3469034
description:
Jun 20 13:59:03 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.136 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:14:00:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9947287&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781964003 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.135
country_id: 3469034
description:
Jun 20 14:00:07 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.135 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:13:59:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10196590&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781963989 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:13:59:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7510163&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781963987 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:14:02:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7052393&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781964120 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:14:02:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9857942&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781964120 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.238.178.167
country_id: 3469034
description:
[2026-06-20 14:02:16 +0000] info [cpaneld] 170.238.178.167 - togointerim "GET /login/?login_only=1&user=togointerim&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointerim (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.109.97.251
country_id: 3469034
description:
[2026-06-20 14:02:21 +0000] info [cpaneld] 179.109.97.251 - togointerimnet "GET /login/?login_only=1&user=togointerimnet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointerimnet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.202.220.141
country_id: 290557
description:
[2026-06-20 14:02:29 +0000] info [cpaneld] 94.202.220.141 - togoint "GET /login/?login_only=1&user=togoint&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoint (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.33.117.231
country_id: 3508796
description:
[2026-06-20 14:02:34 +0000] info [cpaneld] 186.33.117.231 - togoin "GET /login/?login_only=1&user=togoin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.46.186.28
country_id: 3865483
description:
[2026-06-20 14:02:47 +0000] info [cpaneld] 181.46.186.28 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.172.11.151
country_id: 1269750
description:
Jun 20 14:03:32 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.172.11.151 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 213.169.213.241
country_id: 6252001
domain: haplucia-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:213.169.213.241||TA:213.169.213.241||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 216.173.80.153
country_id: 6251999
domain: haplucia-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:216.173.80.153||TA:216.173.80.153||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.162.20.110
country_id: 3865483
description:
Jun 20 14:06:35 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.162.20.110 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 119.13.157.103
country_id: 1831722
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/02/WhatsApp-Image-2024-02-17-at-11.09.45-1024x750.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/02/WhatsApp-Image-2024-02-17-at-11.09.45-300x220.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2024/02/WhatsApp-Image-2024-02-17-at-11.09.45-768x563.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2024/02/WhatsApp-Image-2024-02-17-at-11.09.45.jpeg 1280w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.59.35.94
country_id: 1269750
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/02/images-5.webp 304w, http:/togodailynews.tg/wp-content/uploads/2026/02/images-5-300x164.webp 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.105.2.16
country_id: 719819
description:
Jun 20 14:07:42 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.105.2.16 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:14:11:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:14:11:09 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.59.20.136
country_id: 4566966
description:
2026-06-20 14:12:50 dovecot_plain authenticator failed for H=(WIN-BGU86CDI74S) [172.59.20.136]:58896: 535 Incorrect authentication data (set_id=pnlowa@otr.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.49.154.102
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/7a7f8a HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:14:16:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13266883&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781964971 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:14:16:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7194310&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781964974 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:14:16:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13201303&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781964974 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:14:17:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6931868&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781965062 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:14:17:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10263913&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781965062 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.70.182.62
country_id: 3175395
description:
[2026-06-20 14:19:24 +0000] info [whostmgrd] 146.70.182.62 - c1565738c "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.27
country_id: 3017382
description:
[2026-06-20 14:19:34 +0000] info [cpaneld] 5.231.64.27 NEW formationfreenet:1NgeVt2Tl7ALLVok address=5.231.64.27,app=cpaneld,creator=formationfreenet,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.83.58.162
country_id: 6252001
description:
[2026-06-20 14:21:56 +0000] info [cpaneld] 23.83.58.162 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 3.0.93.62
country_id: 1880251
description:
[2026-06-20 14:23:15 +0000] info [webmaild] 3.0.93.62 - stephane@sitewebofficiel.tg "GET /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.125.68
country_id: 690791
description:
Jun 20 14:25:25 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.125.68 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.29.15.54
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/5d8faa HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.125.68
country_id: 690791
description:
Jun 20 14:25:31 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.125.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.134.49
country_id: 690791
description:
Jun 20 14:26:24 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.134.49 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.166.159.173
country_id: 1643084
description:
103.166.159.173 - - [20/Jun/2026:14:26:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7237066&pdata=https%253A%252F%252Fwebmail.s2ci.free.netmaster.tg%252F%253Flocale%253Dpt&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781965577 HTTP/2.0" 302 0 webmail.s2ci.free.netmaster.tg "https://webmail.s2ci.free.netmaster.tg/?locale=pt" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.166.159.173


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.134.49
country_id: 690791
description:
Jun 20 14:26:30 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.134.49 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:14:26:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:14:26:32 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.216.84.69
country_id: 934292
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/999b9d HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.34.220
country_id: 1269750
description:
Jun 20 14:26:44 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.34.220 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 66.146.235.226
country_id: 6252001
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:66.146.235.226||TA:66.146.235.226||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:14:29:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6997914&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781965790 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 193.169.219.59
country_id: 6252001
domain: togoagropoles.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togoagropoles.tg/cgi-sys/suspendedpage.cgi HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.60.138
country_id: 2300660
description:
Jun 20 14:33:27 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.60.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.228.245.110
country_id: 3469034
description:
2026-06-20 14:33:59 dovecot_plain authenticator failed for H=([69.172.210.47]) [45.228.245.110]:53526: 535 Incorrect authentication data (set_id=support@togointerim.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.60.138
country_id: 2300660
description:
Jun 20 14:33:34 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.60.138 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:14:33:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7313557&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781966028 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:14:33:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10142360&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781966027 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.245
country_id: 3017382
description:
[2026-06-20 14:35:19 +0000] info [cpaneld] 5.231.255.245 NEW tgkkwsvr:Zr3cOrS0eMpX46xZ address=5.231.255.245,app=cpaneld,creator=tgkkwsvr,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.85.128
country_id: 2921044
description:
[2026-06-20 14:36:44 +0000] info [whostmgrd] 217.181.85.128 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.162.164.94
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/8ea0ab HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.54
country_id: 6252001
description:
205.169.39.54 - - [20/Jun/2026:14:40:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9816211&pdata=http%253A%252F%252Fsophie-immobilier.tg.154-70-82-246.cpanel.site&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781966426 HTTP/1.1" 302 0 sophie-immobilier.tg.154-70-82-246.cpanel.site "http://sophie-immobilier.tg.154-70-82-246.cpanel.site/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.54


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:14:42:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.17.32.63
country_id: 3437598
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/02/WhatsApp-Image-2024-02-17-at-11.09.34.jpeg 1280w, http:/togodailynews.tg/wp-content/uploads/2024/02/WhatsApp-Image-2024-02-17-at-11.09.34-300x208.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2024/02/WhatsApp-Image-2024-02-17-at-11.09.34-1024x710.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/02/WhatsApp-Image-2024-02-17-at-11.09.34-768x533.jpeg 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.9.186
country_id: 3469034
description:
Jun 20 14:42:55 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.9.186 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:14:42:31 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:14:43:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9933926&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781966603 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:14:43:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738597&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781966608 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:14:43:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6787946&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781966607 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.229
country_id: 6252001
description:
[2026-06-20 14:43:56 +0000] info [cpaneld] 64.44.62.229 NEW formationfreenet:llsBPJEMK5nWxuMU address=64.44.62.229,app=cpaneld,creator=formationfreenet,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.211.23.124
country_id: 3625428
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/events/8 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.79.131.229
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/9b9e98 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.138.69.94
country_id: 3077311
description:
Jun 20 14:47:12 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.138.69.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.7.237
country_id: 690791
description:
Jun 20 14:47:22 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.7.237 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:14:48:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6710891&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781966908 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.42.202.134
country_id: 1210997
description:
103.42.202.134 - - [20/Jun/2026:14:48:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9857179&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Foembed%252F1.0%252Fembed%253Fformat%253Dxml%2526url%253Dhttps%25253A%25252F%25252F24heureinfo.tg%25252Fsociete%25252Fle-prix-nobel-de-medecine-decerne-a-deux-chercheurs-pour-leurs-travaux-sur-le-cancer%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781966909 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/wp-json/oembed/1.0/embed?format=xml&url=https%3A%2F%2F24heureinfo.tg%2Fsociete%2Fle-prix-nobel-de-medecine-decerne-a-deux-chercheurs-pour-leurs-travaux-sur-le-cancer%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.42.202.134


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:14:48:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6867565&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781966911 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.40
country_id: 3469034
description:
Jun 20 14:50:01 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.40 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.230.96.253
country_id: 1880251
description:
43.230.96.253 - - [20/Jun/2026:14:50:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10249575&pdata=https%253A%252F%252Ftogodailynews.tg%252F%253Fp%253D24843&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781967002 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/?p=24843" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.230.96.253


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.153.189.18
country_id: 6252001
domain: tourney.fishing
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tourney.fishing/.env.example HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 104.232.222.55
country_id: 2802361
domain: wellcity.tg
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 12; M2102J20SG Build/SKQ1.211006.001; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/118.0.0.0 Mobile Safari/537.36 musical_ly_2023002030 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/musical_ly app_version/30.2.3 ByteLocale/ru-RU ByteFullLocale/ru-RU Region/US Spark/1.3.5.7-bugfix AppVersion/30.2.3 BytedanceWebview/d8a21c6||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 187.108.210.164
country_id: 3469034
description:
187.108.210.164 - - [20/Jun/2026:14:53:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985317&pdata=https%253A%252F%252Fcfpj.tg%252Fnwyj-10867netid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781967200 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/nwyj-10867netid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:187.108.210.164


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.174.16.193
country_id: 357994
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/778571 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.153.189.18
country_id: 6252001
domain: www.curvecare.shop
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.curvecare.shop/pi.php HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.61.9.13
country_id: 3865483
description:
Jun 20 14:55:48 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.61.9.13 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:14:57:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:14:57:59 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 198.163.193.165
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/7f766d HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.82.52.136
country_id: 3469034
description:
Jun 20 14:59:39 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.82.52.136 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:14:59:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7052184&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781967591 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:14:59:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7247507&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781967590 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:14:59:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9792613&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781967592 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.191.131.231
country_id: 1282988
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/11/WhatsApp-Image-2023-11-27-at-12.10.47.jpeg 1280w, http:/togodailynews.tg/wp-content/uploads/2023/11/WhatsApp-Image-2023-11-27-at-12.10.47-300x200.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2023/11/WhatsApp-Image-2023-11-27-at-12.10.47-1024x683.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2023/11/WhatsApp-Image-2023-11-27-at-12.10.47-768x512.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2023/11/WhatsApp-Image-2023-11-27-at-12.10.47-272x182.jpeg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.13
country_id: 3469034
description:
Jun 20 15:02:04 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.13 has been locked due to Imunify RBL


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 212.119.46.135
country_id: 294640
domain: sia-togo.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:Ajatovivi0883.sia-togo.tg||Method:wp.getUsersBlogs


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.84.253
country_id: 6252001
description:
[2026-06-20 15:02:28 +0000] info [cpaneld] 82.40.84.253 - contactmairieaneho "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user contactmairieaneho (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.115
country_id: 3175395
description:
Jun 20 15:01:42 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.115 has been locked due to Imunify RBL


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 212.119.46.135
country_id: 294640
domain: sia-togo.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:Turbolte.sia-togo.tg||Method:blogger.getUsersBlogs


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:15:04:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065256&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781967869 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:15:04:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9870743&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781967869 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.118.70.215
country_id: 1210997
domain: www.mesyscom.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mesyscom.com/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.118.70.215
country_id: 1210997
domain: www.mesyscom.comhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mesyscom.comhttp/www.mesyscom.com/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.70.53.60
country_id: 6252001
description:
54.70.53.60 - - [20/Jun/2026:15:10:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9660269&pdata=http%253A%252F%252Fwww.sotranetogo.com.154-70-82-246.cpanel.site&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781968249 HTTP/1.1" 302 0 www.sotranetogo.com.154-70-82-246.cpanel.site "http://www.sotranetogo.com.154-70-82-246.cpanel.site/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.70.53.60


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:15:11:10 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:15:11:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 148.227.73.84
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/06/IMG-20210605-WA0000.jpg 921w, http:/togodailynews.tg/wp-content/uploads/2021/06/IMG-20210605-WA0000-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2021/06/IMG-20210605-WA0000-768x513.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2021/06/IMG-20210605-WA0000-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.71.187.124
country_id: 6252001
description:
54.71.187.124 - - [20/Jun/2026:15:14:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7117978&pdata=http%253A%252F%252Fsotranetogo.com.154-70-82-246.cpanel.site&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781968468 HTTP/1.1" 302 0 sotranetogo.com.154-70-82-246.cpanel.site "http://sotranetogo.com.154-70-82-246.cpanel.site/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.71.187.124


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.118.70.234
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1574793273 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:15:15:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9749913&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781968540 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:15:15:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7301016&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781968539 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:15:15:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7039595&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781968541 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.195.8.90
country_id: 3469034
description:
Jun 20 15:17:47 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.195.8.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.209.66
country_id: 933860
description:
Jun 20 15:17:57 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.209.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.49.95.30
country_id: 3469034
description:
Jun 20 15:18:02 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.49.95.30 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.60.205.184
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/04/Eau-potable.webp 790w, http:/togodailynews.tg/wp-content/uploads/2025/04/Eau-potable-300x180.webp 300w, http:/togodailynews.tg/wp-content/uploads/2025/04/Eau-potable-768x462.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.240
country_id: 2635167
description:
[2026-06-20 15:17:28 +0000] info [cpaneld] 5.230.133.240 NEW tqbcalqt:zEMMPTplvUcVW8RB address=5.230.133.240,app=cpaneld,creator=tqbcalqt,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.219
country_id: 2635167
description:
[2026-06-20 15:17:30 +0000] info [cpaneld] 5.230.153.219 NEW vuvwskxh:AL9nelO0jsRrBBKT address=5.230.153.219,app=cpaneld,creator=vuvwskxh,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.112.25
country_id: 6252001
description:
Jun 20 15:17:39 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.112.25 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.86.17
country_id: 6252001
description:
[2026-06-20 15:18:51 +0000] info [cpaneld] 82.40.86.17 - afxvhoxo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afxvhoxo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.92.16
country_id: 6252001
description:
[2026-06-20 15:18:57 +0000] info [cpaneld] 82.40.92.16 - togoinrdceh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 203.215.178.2
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/bien-etre-yoto-nest-plus-un-petit-village-isole/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 203.215.178.2
country_id: 1168579
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/bien-etre-yoto-nest-plus-un-petit-village-isole/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.126.205
country_id: 6252001
description:
[2026-06-20 15:20:05 +0000] info [cpaneld] 82.40.126.205 - sprocaadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:15:19:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13132697&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781968785 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.6.225
country_id: 6252001
description:
[2026-06-20 15:19:57 +0000] info [whostmgrd] 195.63.6.225 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.164.56.90
country_id: 6252001
description:
[2026-06-20 15:19:59 +0000] info [cpaneld] 23.164.56.90 - cloudetracks "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.143
country_id: 798544
description:
Jun 20 15:20:23 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.19.183
country_id: 2300660
description:
Jun 20 15:19:31 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.19.183 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:15:19:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9608045&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781968784 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.88.180
country_id: 6252001
description:
[2026-06-20 15:19:57 +0000] info [cpaneld] 82.40.88.180 - camaegdtomgo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.106.30.154
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1075482036 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 188.130.159.141
country_id: 1522867
description:
2026-06-20 15:21:23 H=([188.130.159.141]) [188.130.159.141]:14084 F=<home@white-ways.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.143
country_id: 798544
description:
Jun 20 15:20:30 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.143 has been locked due to Imunify RBL


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.173.173.131
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:renforcement-du-systeme-educatif-le-gouvernement-recrute-4501-enseignants/||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.253.159.81
country_id: 732800
description:
Jun 20 15:22:16 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.253.159.81 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.34.79.123
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1044838798 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.85.63.8
country_id: 3469034
description:
Jun 20 15:22:40 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.85.63.8 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 223.123.77.8
country_id: 1168579
description:
223.123.77.8 - - [20/Jun/2026:15:22:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7258985&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Framadan-en-cote-divoire%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781968962 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ramadan-en-cote-divoire/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.4294.1143 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:223.123.77.8


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.140.42
country_id: 690791
description:
Jun 20 15:22:59 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.140.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.253.159.81
country_id: 732800
description:
Jun 20 15:22:29 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.253.159.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.124.2
country_id: 226074
description:
Jun 20 15:22:35 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.124.2 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.64.160.107
country_id: 2363686
description:
102.64.160.107 - - [20/Jun/2026:15:23:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7236242&pdata=https%253A%252F%252Fchuso.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781968978 HTTP/2.0" 302 0 chuso.tg "https://chuso.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.64.160.107


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.64.169.98
country_id: 2363686
description:
[2026-06-20 15:23:07 +0000] info [cpaneld] 102.64.169.98 - uljcqiuy "GET /cpsess5772218405/frontend/jupiter/filemanager/editit.html?file=front_layout.php&fileop=&dir=%2Fhome%2Fuljcqiuy%2Fpublic_html%2FApp%2FViews&dirop=&charset=&file_charset=_DETECT_&baseurl=&basedir=&edit=1 HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [102.64.175.56] != Current IP Address [102.64.169.98]


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:15:25:04 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:15:25:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-20 15:25:39 +0000] info [cpaneld] 102.54.238.57 - primuscourtiertg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user primuscourtiertg (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 62.61.175.59
country_id: 286963
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/719751384 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.207.231.161
country_id: 2245662
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/02/NSCT-CHEQUE.jpg 1040w, http:/togodailynews.tg/wp-content/uploads/2024/02/NSCT-CHEQUE-300x225.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2024/02/NSCT-CHEQUE-1024x768.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/02/NSCT-CHEQUE-768x576.jpg 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.84.21.186
country_id: 798549
description:
Jun 20 15:28:58 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.84.21.186 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:15:30:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7193502&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781969444 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 193.202.81.55
country_id: 294640
domain: butodra.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:DdWiN@CZ3v47.butodra.tg||Method:wp.getUsersBlogs


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:15:30:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9595025&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781969436 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:15:30:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13004489&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781969435 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.186.8.52
country_id: 798544
description:
Jun 20 15:30:38 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.186.8.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.148.251
country_id: 2363686
description:
2026-06-20 15:31:34 dovecot_login authenticator failed for H=(Yoga) [102.64.148.251]:60463: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 193.202.81.55
country_id: 294640
domain: butodra.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:butodra.butodra.tg||Method:blogger.getUsersBlogs


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 89.40.30.9
country_id: 587116
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/62439747 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.36.18
country_id: 2395170
description:
Jun 20 15:33:10 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.36.18 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.16.218
country_id: 6251999
description:
[2026-06-20 15:32:41 +0000] info [whostmgrd] 195.63.16.218 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.153.199.101
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/ad9ea4 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:15:33:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9790310&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781969616 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:15:33:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12961894&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781969611 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.173.196
country_id: 6252001
domain: afrique-distribution.net
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/afrique-distribution.net/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.98.183.239
country_id: 290557
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/672940372 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:15:39:08 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:15:39:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.44.242
country_id: 2300660
description:
Jun 20 15:41:25 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.44.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.44.242
country_id: 2300660
description:
Jun 20 15:41:31 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.44.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.12.1
country_id: 798544
description:
Jun 20 15:41:36 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.12.1 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:15:45:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6776987&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781970310 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:15:45:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054296&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781970303 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:15:45:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6657685&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781970309 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.51
country_id: 6252001
description:
205.169.39.51 - - [20/Jun/2026:15:45:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9868694&pdata=http%253A%252F%252Fmetaart.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781970322 HTTP/1.1" 302 0 metaart.tg "http://metaart.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.51


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [20/Jun/2026:15:45:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856413&pdata=http%253A%252F%252Fmetaart.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781970324 HTTP/1.1" 302 0 metaart.tg "http://metaart.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 185.213.83.144
country_id: 1643084
description:
[2026-06-20 15:44:57 +0000] info [cpaneld] 185.213.83.144 NEW vuvwskxh:071jbntv5Zg77lf_ address=185.213.83.144,app=cpaneld,creator=vuvwskxh,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.6.200.93
country_id: 3469034
description:
Jun 20 15:45:04 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.6.200.93 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 3.85.80.207
country_id: 6252001
domain: 24heureinfo.tg
description:
IM360 WAF: Possible XSS in arguments||MV:sig1=(\"@authority\" \"signature-agent\");created=1781970330;keyid=\"qdc6-vlwad4yd6yremqpjilim3bxffja_vhgl5qa71e\";alg=\"ed25519\";expires=1781970360;nonce=\"dxvub6jpexow 1aferjchhgdm25vsjmkp7etkd4mkocx on2hlykftljcuvne7j6\";tag=\"web-bot-auth\"||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.175.5.98
country_id: 6252001
description:
[2026-06-20 15:45:48 +0000] info [cpaneld] 107.175.5.98 NEW zykoahbv:bNIUq3w0DVxscaoF address=107.175.5.98,app=cpaneld,creator=zykoahbv,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.253
country_id: 2635167
domain: delxia.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/zykoahbv/public_html/.761846378574182.php||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 150.136.98.82
country_id: 6252001
description:
[2026-06-20 15:46:32 +0000] info [cpaneld] 150.136.98.82 - mouss "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mouss (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.86.34
country_id: 6252001
description:
[2026-06-20 15:46:32 +0000] info [cpaneld] 82.40.86.34 - wgqhqbem "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.71.175
country_id: 6252001
description:
[2026-06-20 15:46:32 +0000] info [cpaneld] 217.181.71.175 - cvajhehu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cvajhehu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.126.93
country_id: 6252001
description:
[2026-06-20 15:46:32 +0000] info [cpaneld] 82.40.126.93 - hcbcmrio "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User hcbcmrio has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.105.16
country_id: 6252001
description:
[2026-06-20 15:46:32 +0000] info [cpaneld] 82.40.105.16 - tqttxcvn "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tqttxcvn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.56.240.221
country_id: 6252001
description:
[2026-06-20 15:46:33 +0000] info [cpaneld] 100.56.240.221 - lxsenjdd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lxsenjdd (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:15:47:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001519&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781970444 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.110.107
country_id: 6252001
description:
[2026-06-20 15:46:32 +0000] info [cpaneld] 82.40.110.107 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.123.254
country_id: 6252001
description:
[2026-06-20 15:46:33 +0000] info [cpaneld] 82.40.123.254 - lxsenjdd_farms "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lxsenjdd_farms (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:15:47:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10314088&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781970445 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.89.195.183
country_id: 6252001
description:
47.89.195.183 - - [20/Jun/2026:15:47:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13026458&pdata=http%253A%252F%252F154.70.82.244%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781970444 HTTP/1.1" 302 0 154.70.82.244 "http://154.70.82.244:2082/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.89.195.183


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 223.123.125.11
country_id: 1168579
description:
223.123.125.11 - - [20/Jun/2026:15:47:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10458735&pdata=https%253A%252F%252Ftogodailynews.tg%252Fwp-json%252Foembed%252F1.0%252Fembed%253Furl%253Dhttps%25253A%25252F%25252Ftogodailynews.tg%25252Felectrification-au-togo-vers-linstallation-de-50-000-lampadaires-solaires-dans-plusieurs-localites-du-pays%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781970472 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/wp-json/oembed/1.0/embed?url=https%3A%2F%2Ftogodailynews.tg%2Felectrification-au-togo-vers-linstallation-de-50-000-lampadaires-solaires-dans-plusieurs-localites-du-pays%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:223.123.125.11


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.82.188
country_id: 6251999
description:
[2026-06-20 15:50:18 +0000] info [whostmgrd] 217.181.82.188 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 157.22.72.239
country_id: 2635167
domain: emt.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:SXWok*rKSIuEOewWe2IT@OttoHelpIe@.emt.tg||Method:wp.getUsersBlogs


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.144.79.102
country_id: 1269750
description:
2026-06-20 15:51:40 dovecot_login authenticator failed for H=([180.173.121.150]) [59.144.79.102]:50858: 535 Incorrect authentication data (set_id=collectetvabackend@otr.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.144.79.102
country_id: 1269750
description:
Jun 20 15:51:38 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.144.79.102 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.4.4
country_id: 6252001
description:
[2026-06-20 15:55:27 +0000] info [cpaneld] 195.63.4.4 - ygeaivhj "GET / HTTP/1.1" FAILED LOGIN cpaneld: User ygeaivhj has their account suspended. Login blocked.


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:15:54:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:15:54:58 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.120.116.162
country_id: 1168579
description:
Jun 20 15:55:02 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.120.116.162 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 171.252.189.172
country_id: 1562822
description:
171.252.189.172 - - [20/Jun/2026:15:55:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985416&pdata=https%253A%252F%252F24heureinfo.tg%252Ftag%252Ffiscal%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781970943 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/tag/fiscal/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:171.252.189.172


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.250.37.30
country_id: 3437598
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/11/Forum-Royaume-Uni-Afrique-francophone-Ben-Coleman-felicite-le-President-du-Conseil-pour-sa-participation-remarquable-.-.webp 800w, http:/togodailynews.tg/wp-content/uploads/2025/11/Forum-Royaume-Uni-Afrique-francophone-Ben-Coleman-felicite-le-President-du-Conseil-pour-sa-participation-remarquable-.--300x216.webp 300w, http:/togodailynews.tg/wp-content/uploads/2025/11/Forum-Royaume-Uni-Afrique-francophone-Ben-Coleman-felicite-le-President-du-Conseil-pour-sa-participation-remarquable-.--768x554.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 15:56:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:22318: 535 Incorrect authentication data (set_id=344)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 15:56:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:20572: 535 Incorrect authentication data (set_id=reference)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 15:56:28 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 20 15:56:47 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 15:57:05 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 15:56:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:65120: 535 Incorrect authentication data (set_id=reference)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 15:56:41 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 15:56:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:26770: 535 Incorrect authentication data (set_id=344)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 15:56:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:1060: 535 Incorrect authentication data (set_id=host)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 15:56:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:52720: 535 Incorrect authentication data (set_id=agronomia)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 15:56:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:37408: 535 Incorrect authentication data (set_id=berger)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 15:56:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:64092: 535 Incorrect authentication data (set_id=net9)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 15:57:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:10372: 535 Incorrect authentication data (set_id=alyssa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 15:57:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:56334: 535 Incorrect authentication data (set_id=chocorosa)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.106.143.151
country_id: 2963597
description:
Jun 20 15:57:40 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.106.143.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.165.187
country_id: 2017370
description:
Jun 20 15:57:45 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.165.187 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.208
country_id: 2635167
description:
[2026-06-20 15:57:52 +0000] info [cpaneld] 5.230.153.208 NEW sodigaz:IxgylTCe55StNJxi address=5.230.153.208,app=cpaneld,creator=sodigaz,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 20 15:57:54 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 15:57:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:32350: 535 Incorrect authentication data (set_id=account)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 20 15:57:32 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 15:57:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:16314: 535 Incorrect authentication data (set_id=funil-mailingboss)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.27.205.159
country_id: 1814991
description:
Jun 20 15:58:21 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.27.205.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 15:57:29 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 15:57:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:59158: 535 Incorrect authentication data (set_id=cellular)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 15:57:50 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.136.142.13
country_id: 1814991
description:
Jun 20 15:58:08 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.136.142.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 15:57:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:2552: 535 Incorrect authentication data (set_id=0)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 15:58:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:32300: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 15:58:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:58260: 535 Incorrect authentication data (set_id=martine)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.120.44.130
country_id: 1210997
description:
103.120.44.130 - - [20/Jun/2026:15:58:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10197961&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcooperation-le-togo-et-le-luxembourg-renforcent-leur-partenariat%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781971119 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/cooperation-le-togo-et-le-luxembourg-renforcent-leur-partenariat/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.8453.1785 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.120.44.130


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 15:58:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:56468: 535 Incorrect authentication data (set_id=kredit)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 20 15:58:42 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 15:58:54 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:47730: 535 Incorrect authentication data (set_id=iwai)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 15:58:42 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 15:58:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:14928: 535 Incorrect authentication data (set_id=action)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.247.215.245
country_id: 953987
domain: www.ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ca-togo.org/www.gtaassurancesvie.tg HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 15:58:52 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 20 15:58:58 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 15:59:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:17806: 535 Incorrect authentication data (set_id=ying)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.143
country_id: 3017382
description:
[2026-06-20 15:59:13 +0000] info [cpaneld] 5.231.255.143 NEW cietg:ZjVqyKGoIrSHKMRF address=5.231.255.143,app=cpaneld,creator=cietg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:15:59:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12741830&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781971194 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:15:59:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13014728&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781971190 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 20 15:59:34 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 15:59:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:41194: 535 Incorrect authentication data (set_id=cq)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 15:59:40 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 15:59:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:34420: 535 Incorrect authentication data (set_id=ortho)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 15:59:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:30080: 535 Incorrect authentication data (set_id=xiaoyou)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:15:59:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000796&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781971194 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 15:59:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:52062: 535 Incorrect authentication data (set_id=cq)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.136.142.13
country_id: 1814991
description:
Jun 20 15:59:38 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.136.142.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.30.46.91
country_id: 3175395
description:
Jun 20 15:59:43 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.30.46.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 20 15:59:47 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 151.240.228.107
country_id: 357994
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:togo-de-bons-rapports-etablis-sur-le-systeme-educatif/||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.63.138.70
country_id: 3469034
description:
Jun 20 16:00:19 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.63.138.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 15:59:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:55488: 535 Incorrect authentication data (set_id=cd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 15:59:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:19112: 535 Incorrect authentication data (set_id=edi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 15:59:35 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 15:59:54 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:5666: 535 Incorrect authentication data (set_id=zhaowei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 20 16:00:35 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:00:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:46146: 535 Incorrect authentication data (set_id=junk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:00:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:21046: 535 Incorrect authentication data (set_id=parts)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 20 16:00:46 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:00:48 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:27692: 535 Incorrect authentication data (set_id=mpokora)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:00:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:10404: 535 Incorrect authentication data (set_id=estadisticas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:00:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:5478: 535 Incorrect authentication data (set_id=test01)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:00:43 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.89.208.174
country_id: 1605651
description:
Jun 20 16:00:53 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.89.208.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:01:05 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:01:07 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:2678: 535 Incorrect authentication data (set_id=commission)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 190.60.33.147
country_id: 3686110
description:
190.60.33.147 - - [20/Jun/2026:16:01:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6604907&pdata=https%253A%252F%252Ftogodailynews.tg%252Fecobank-meilleure-banque-dafrique-pour-les-pme%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781971271 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/ecobank-meilleure-banque-dafrique-pour-les-pme/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.4677.1124 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:190.60.33.147


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 20 16:01:31 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:01:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:3722: 535 Incorrect authentication data (set_id=ahmed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:01:50 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:16:01:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054507&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781971315 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:01:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:19518: 535 Incorrect authentication data (set_id=aviation)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:01:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:17940: 535 Incorrect authentication data (set_id=bonnie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:01:50 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:01:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:11158: 535 Incorrect authentication data (set_id=lexi)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:16:01:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051624&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781971317 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:01:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:45426: 535 Incorrect authentication data (set_id=eddie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 20 16:01:34 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:01:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:22504: 535 Incorrect authentication data (set_id=iptv)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 20 16:02:29 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:02:30 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 20 16:02:34 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:02:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:51814: 535 Incorrect authentication data (set_id=espace)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:02:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:58546: 535 Incorrect authentication data (set_id=learn)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:02:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:53052: 535 Incorrect authentication data (set_id=pioneer)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:02:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:62592: 535 Incorrect authentication data (set_id=craigslist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:02:36 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:02:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:2200: 535 Incorrect authentication data (set_id=test004)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.19.0
country_id: 99237
domain: brmn.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/brmn.tghttp/brmn.tg/brmn HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:02:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:44138: 535 Incorrect authentication data (set_id=cypher)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.19.0
country_id: 99237
domain: brmn.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/brmn.tg/index.php/brmn HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:02:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:55930: 535 Incorrect authentication data (set_id=espace)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:03:29 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:03:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:32070: 535 Incorrect authentication data (set_id=hosono)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 20 16:03:37 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:03:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:14572: 535 Incorrect authentication data (set_id=irodriguez)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:03:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:10854: 535 Incorrect authentication data (set_id=kannan)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.34.68.159
country_id: 1282988
description:
27.34.68.159 - - [20/Jun/2026:16:03:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10275686&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D9095&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781971424 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=9095" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2548.1095 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.34.68.159


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:03:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:35898: 535 Incorrect authentication data (set_id=us3)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.192.65.77
country_id: 1269750
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/01/290.000-femmes-enceintes-sont-assistees_i19202.webp 1627w, http:/togodailynews.tg/wp-content/uploads/2026/01/290.000-femmes-enceintes-sont-assistees_i19202-300x199.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/01/290.000-femmes-enceintes-sont-assistees_i19202-1024x680.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/01/290.000-femmes-enceintes-sont-assistees_i19202-768x510.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/01/290.000-femmes-enceintes-sont-assistees_i19202-1536x1020.webp 1536w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:03:32 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:03:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:3978: 535 Incorrect authentication data (set_id=t)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 20 16:03:49 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:03:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:57966: 535 Incorrect authentication data (set_id=ipbx)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-20 16:03:52 +0000] info [cpaneld] 102.54.238.57 - enadamso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user enadamso (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:04:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:55118: 535 Incorrect authentication data (set_id=nfe)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 20 16:04:47 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 20 16:04:48 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:04:53 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:04:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:50938: 535 Incorrect authentication data (set_id=ace)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:04:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:30282: 535 Incorrect authentication data (set_id=su)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:04:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:36380: 535 Incorrect authentication data (set_id=kraken)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:04:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:38932: 535 Incorrect authentication data (set_id=wyl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:04:55 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:8912: 535 Incorrect authentication data (set_id=svt)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:04:37 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:05:41 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:05:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:33472: 535 Incorrect authentication data (set_id=xo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:05:34 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:05:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:51274: 535 Incorrect authentication data (set_id=caroline)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 20 16:05:33 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:05:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:28864: 535 Incorrect authentication data (set_id=ventas1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:05:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:20842: 535 Incorrect authentication data (set_id=watch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:05:54 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:2082: 535 Incorrect authentication data (set_id=xo)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.8.77.19
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/08/IMG-20210813-WA0017-1024x768.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2021/08/IMG-20210813-WA0017-300x225.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2021/08/IMG-20210813-WA0017-768x576.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2021/08/IMG-20210813-WA0017.jpg 1040w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 20 16:05:36 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:05:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:26954: 535 Incorrect authentication data (set_id=avenue)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:80718.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:45b607eec5976b442a7d2fc8ca4f4d688725a7f6||Title:0x5127f2b1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:05:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:12290: 535 Incorrect authentication data (set_id=sky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:06:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:42098: 535 Incorrect authentication data (set_id=termine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:06:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:32404: 535 Incorrect authentication data (set_id=ovpn-uk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:06:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:13300: 535 Incorrect authentication data (set_id=scan2)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 5.57.6.157
country_id: 272103
description:
5.57.6.157 - - [20/Jun/2026:16:07:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13134282&pdata=https%253A%252F%252Ftogodailynews.tg%252F%253Fp%253D12617&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781971619 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/?p=12617" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:5.57.6.157


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 20 16:06:27 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:06:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:1144: 535 Incorrect authentication data (set_id=sok)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 20 16:06:28 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:06:36 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:06:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:59058: 535 Incorrect authentication data (set_id=nadeem)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:06:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:50132: 535 Incorrect authentication data (set_id=ecke)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.132.9
country_id: 3469034
description:
Jun 20 16:07:50 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.132.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:07:32 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:07:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:41900: 535 Incorrect authentication data (set_id=nugget)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:07:53 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:39640: 535 Incorrect authentication data (set_id=marvin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:07:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:12822: 535 Incorrect authentication data (set_id=yen)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:07:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:23180: 535 Incorrect authentication data (set_id=realty)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ee8897e275a58efca9580eb23bc280e024229970||Title:0x437a685f||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 20 16:07:29 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:07:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:63916: 535 Incorrect authentication data (set_id=localize)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:07:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:24550: 535 Incorrect authentication data (set_id=pc101)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:08:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:4282: 535 Incorrect authentication data (set_id=oms)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:16:09:16 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 20 16:08:44 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:08:49 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:08:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:54208: 535 Incorrect authentication data (set_id=yangchao)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:09:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:21168: 535 Incorrect authentication data (set_id=mailstore)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:08:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:45266: 535 Incorrect authentication data (set_id=arcgis)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:16:09:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:08:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:64688: 535 Incorrect authentication data (set_id=testaccount11)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:08:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:63646: 535 Incorrect authentication data (set_id=andris)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.133
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Bad file extension||RSV:8.19||T:APACHE||MVN:REQUEST_FILENAME||MV:/la-ligue-des-consommateurs-du-togo-met-en-lumiere-la-note-ministerielle-sur-les-fournitures-scolaires/www.tury-v-spb.com||User:lhxhatyj||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:08:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:44806: 535 Incorrect authentication data (set_id=patan)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:30da6113548220d53966c3ff6b71979efd431f0a||Title:0xaa46b334||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:09:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:35566: 535 Incorrect authentication data (set_id=nk)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:09:34 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.120.146
country_id: 798544
description:
Jun 20 16:10:24 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.120.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:09:31 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:09:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:44028: 535 Incorrect authentication data (set_id=bernie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:09:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:65286: 535 Incorrect authentication data (set_id=tetris)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:09:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:16430: 535 Incorrect authentication data (set_id=ptc)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 193.238.32.235
country_id: 690791
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/history HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 20 16:09:32 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:09:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:57118: 535 Incorrect authentication data (set_id=herbertb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:09:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:34428: 535 Incorrect authentication data (set_id=nita)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:74be220c477bc150011a175d81766295598eb25d||Title:0xd6075468||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:10:57 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:5464: 535 Incorrect authentication data (set_id=romi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:10:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:45748: 535 Incorrect authentication data (set_id=telebox)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:10:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:35364: 535 Incorrect authentication data (set_id=citrix1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.120.146
country_id: 798544
description:
Jun 20 16:10:30 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.120.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:10:33 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:10:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:32346: 535 Incorrect authentication data (set_id=edl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:10:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:55984: 535 Incorrect authentication data (set_id=dbm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:10:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:56824: 535 Incorrect authentication data (set_id=bas)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:10:55 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fdb9540b4233aa08c2651df7762c416f23b0d49d||Title:0x19ef2b00||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 20 16:10:57 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:11:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:25388: 535 Incorrect authentication data (set_id=beasiswa)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:034b1127c288c7f8b6ac4fc90820f5e4512db446||Title:0xf5084aaf||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:11:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:22560: 535 Incorrect authentication data (set_id=rpcuser)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:11:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:32692: 535 Incorrect authentication data (set_id=rotor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:11:43 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:11:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:31956: 535 Incorrect authentication data (set_id=vaio)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:11:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:13594: 535 Incorrect authentication data (set_id=redshift)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:11:35 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 20 16:11:43 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:11:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:47680: 535 Incorrect authentication data (set_id=rumbaugh)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:21c7bc8b3ca79d7f21b43f8a631196bab50ce6a4||Title:0xfd67ff2a||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:12:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:33596: 535 Incorrect authentication data (set_id=cedar)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:12:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:41810: 535 Incorrect authentication data (set_id=xrds)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 20 16:12:31 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:12:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:50588: 535 Incorrect authentication data (set_id=vs1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:12:35 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:12:37 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:12:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:9886: 535 Incorrect authentication data (set_id=studio2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:12:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:3778: 535 Incorrect authentication data (set_id=sehri)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:12:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:63056: 535 Incorrect authentication data (set_id=pex)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:12:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:20740: 535 Incorrect authentication data (set_id=studio2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:13:57 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:13:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:65292: 535 Incorrect authentication data (set_id=tb)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 20 16:14:02 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:14:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:1364: 535 Incorrect authentication data (set_id=scrpt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:13:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:15810: 535 Incorrect authentication data (set_id=orenburg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:13:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:14078: 535 Incorrect authentication data (set_id=invest)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.56.8.225
country_id: 1269750
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1966932271 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ff4b91a194f0f8ea0794f2551e7b357f9e8d37f6||Title:0xf3682c65||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:13:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:24984: 535 Incorrect authentication data (set_id=vedono)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:13:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:44174: 535 Incorrect authentication data (set_id=casanova)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:13:32 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:14:44 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:14:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:55718: 535 Incorrect authentication data (set_id=general)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 20 16:14:48 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:14:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:64550: 535 Incorrect authentication data (set_id=vtest)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:16:14:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7249351&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781972086 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:14:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:55426: 535 Incorrect authentication data (set_id=nsql)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:14:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:41264: 535 Incorrect authentication data (set_id=york)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:09fe49f8ea758f997762c992b99ec0bdf0cbab06||Title:0xf71b00ae||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:14:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:34128: 535 Incorrect authentication data (set_id=edipo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:14:48 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:46232: 535 Incorrect authentication data (set_id=simone)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:16:14:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054038&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781972072 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:14:43 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:15:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:39962: 535 Incorrect authentication data (set_id=sales2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 20 16:15:40 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:15:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:17264: 535 Incorrect authentication data (set_id=ariston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:15:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:35362: 535 Incorrect authentication data (set_id=ccm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:15:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:16676: 535 Incorrect authentication data (set_id=hanif)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:15:30 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5f7a76edd7ee7e1364c7416d5a618d0af031c675||Title:0x059d186a||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:15:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:31302: 535 Incorrect authentication data (set_id=ccm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:15:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:22132: 535 Incorrect authentication data (set_id=rstest)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 117.5.142.26
country_id: 1562822
domain: 24heureinfo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:16-15.117.5.142.26||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:15:30 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:15:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:40398: 535 Incorrect authentication data (set_id=laposte)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a7298742d81756b95249d001e2fb29fc90a961be||Title:0x9a48e7a8||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:16:32 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 20 16:16:34 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:16:16:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10249371&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781972202 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:16:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:26286: 535 Incorrect authentication data (set_id=wing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:16:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:33312: 535 Incorrect authentication data (set_id=zapros)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:16:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:42332: 535 Incorrect authentication data (set_id=wwwrun)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:16:48 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:16:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:45722: 535 Incorrect authentication data (set_id=mmartinez)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:16:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:29056: 535 Incorrect authentication data (set_id=cloudfront)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:16:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:12126: 535 Incorrect authentication data (set_id=alexgray)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:16:16:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6973038&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781972200 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 20 16:17:31 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:17:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:36752: 535 Incorrect authentication data (set_id=locale)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:17:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:29978: 535 Incorrect authentication data (set_id=gba)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:17:56 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:32412: 535 Incorrect authentication data (set_id=krzysiek)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.158.70.101
country_id: 798549
domain: caissederetraites.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:16-18.185.158.70.101||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:17:55 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:14642: 535 Incorrect authentication data (set_id=pim)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:72b5dbf5a27989c14c743240049ee64897da53cb||Title:0x8fe5b8b6||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:17:38 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:17:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:2036: 535 Incorrect authentication data (set_id=mazari)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:17:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:23530: 535 Incorrect authentication data (set_id=rpc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:18:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:63882: 535 Incorrect authentication data (set_id=jtrac)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:18:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:8302: 535 Incorrect authentication data (set_id=argos)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:18:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:47170: 535 Incorrect authentication data (set_id=harry)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:19:06 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:19:08 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:55816: 535 Incorrect authentication data (set_id=yoshioka)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:18:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:49538: 535 Incorrect authentication data (set_id=sysaid)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:18:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:34696: 535 Incorrect authentication data (set_id=christel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:18:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:55126: 535 Incorrect authentication data (set_id=lps)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e6c4ae6b7b537e70cc592e76ed0f09dfaea538f4||Title:0x1a485b22||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:19:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:59400: 535 Incorrect authentication data (set_id=dev.shop)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:19:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:25058: 535 Incorrect authentication data (set_id=projetos)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:19:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:1788: 535 Incorrect authentication data (set_id=bomb)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:73dd4a78f186d6ae47163245fde4d5509a230888||Title:0x0705adbc||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:19:48 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:20:17 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:19:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:31318: 535 Incorrect authentication data (set_id=nayan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:19:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:10786: 535 Incorrect authentication data (set_id=testip)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:19:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:44648: 535 Incorrect authentication data (set_id=gaga)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:20:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:60966: 535 Incorrect authentication data (set_id=qwer1234)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:20:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:3304: 535 Incorrect authentication data (set_id=thomson)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3b661be2f09b320a24b89cf433c2e82393888f3c||Title:0x581462e5||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:20:32 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:20:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:34752: 535 Incorrect authentication data (set_id=sehri)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:20:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:51188: 535 Incorrect authentication data (set_id=jcb)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:20:48 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:20:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:33782: 535 Incorrect authentication data (set_id=antony)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:20:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:55828: 535 Incorrect authentication data (set_id=lms)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:21:36 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:21:34 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:21:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:35646: 535 Incorrect authentication data (set_id=kohout)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:21:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:32958: 535 Incorrect authentication data (set_id=kia)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.154
country_id: 3175395
description:
Jun 20 16:21:40 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:22:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:19752: 535 Incorrect authentication data (set_id=fatma)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:21:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:23840: 535 Incorrect authentication data (set_id=narsil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:21:57 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:50108: 535 Incorrect authentication data (set_id=3201)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e34e147b41b118d148cfb34513a2464c671e2156||Title:0x047fa658||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:21:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:16248: 535 Incorrect authentication data (set_id=gallery)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:21:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:41108: 535 Incorrect authentication data (set_id=fatma)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 206.232.2.250
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:16-21.206.232.2.250||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:22:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:56272: 535 Incorrect authentication data (set_id=annamarie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:22:48 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.170.40.67
country_id: 2363686
domain: emt.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/emt.tg/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:92bb3457a44c20831082f031da857677cbea9801||Title:0x6b45ca94||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:22:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:61970: 535 Incorrect authentication data (set_id=cdiaz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:22:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:64278: 535 Incorrect authentication data (set_id=winni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:22:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:17044: 535 Incorrect authentication data (set_id=samuel1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:22:35 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:22:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:53050: 535 Incorrect authentication data (set_id=demo44)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:16:23:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:22:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:35486: 535 Incorrect authentication data (set_id=binbin)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:16:23:11 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:23:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:17308: 535 Incorrect authentication data (set_id=morales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:23:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:7798: 535 Incorrect authentication data (set_id=zhangjy)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:23:40 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:23:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:24392: 535 Incorrect authentication data (set_id=tiket)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:23:49 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:23:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:53504: 535 Incorrect authentication data (set_id=designer)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:23:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:65380: 535 Incorrect authentication data (set_id=lijian)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 206.232.1.118
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:16-23.206.232.1.118||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:raymondsama.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:07f628eeae2aed359d8f734744cd0b186ed69033||Title:0x75d925eb||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:23:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:30260: 535 Incorrect authentication data (set_id=cpu)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:24:31 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:24:53 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:9240: 535 Incorrect authentication data (set_id=peifong)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:25:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:24182: 535 Incorrect authentication data (set_id=vhs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:24:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:2214: 535 Incorrect authentication data (set_id=777)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:24:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:8684: 535 Incorrect authentication data (set_id=pia)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:24:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:48254: 535 Incorrect authentication data (set_id=vhs)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:25:09 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:25:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:53320: 535 Incorrect authentication data (set_id=testmail1)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:raymondsama.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5f3c289183fc282dfd3aca9b6b34dfa0f2b85e2b||Title:0x2eaf7eab||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:24:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:64872: 535 Incorrect authentication data (set_id=s12)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:25:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:24210: 535 Incorrect authentication data (set_id=weixin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:25:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:19210: 535 Incorrect authentication data (set_id=ac\)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.34.201
country_id: 1269750
description:
Jun 20 16:25:52 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.34.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:26:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:18302: 535 Incorrect authentication data (set_id=dreamtime)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:26:01 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 202.65.236.45
country_id: 1643084
description:
[2026-06-20 16:26:23 +0000] info [cpaneld] 202.65.236.45 NEW tqbcalqt:ovhHlcIwTGELGQkX address=202.65.236.45,app=cpaneld,creator=tqbcalqt,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:25:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:4428: 535 Incorrect authentication data (set_id=ma1)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:raymondsama.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:363ffd154fa7641bdd7731c9e0a3aefbe6547ebd||Title:0x499e86a9||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:25:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:45666: 535 Incorrect authentication data (set_id=mcollins)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:25:31 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:25:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:32558: 535 Incorrect authentication data (set_id=karpov)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.70.223.91
country_id: 298795
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/02/Goddys-768x512-1.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2024/02/Goddys-768x512-1-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2024/02/Goddys-768x512-1-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:26:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:59042: 535 Incorrect authentication data (set_id=mlc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:26:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:21484: 535 Incorrect authentication data (set_id=ig)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:26:43 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:26:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:52584: 535 Incorrect authentication data (set_id=image3)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:26:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:40510: 535 Incorrect authentication data (set_id=anoop)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:26:45 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:26:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:63294: 535 Incorrect authentication data (set_id=leah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:26:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:49476: 535 Incorrect authentication data (set_id=cleaner)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:27:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:25322: 535 Incorrect authentication data (set_id=temple)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:27:31 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:27:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:35110: 535 Incorrect authentication data (set_id=bottom)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:27:38 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:28:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:21070: 535 Incorrect authentication data (set_id=drc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:27:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:44494: 535 Incorrect authentication data (set_id=pauln)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:27:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:34458: 535 Incorrect authentication data (set_id=excellence)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:27:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:16694: 535 Incorrect authentication data (set_id=saveid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:27:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:24910: 535 Incorrect authentication data (set_id=orion)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:28:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:17552: 535 Incorrect authentication data (set_id=consulting)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:28:57 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:28:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:61420: 535 Incorrect authentication data (set_id=bilder)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:28:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:65386: 535 Incorrect authentication data (set_id=unicorn)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:28:54 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:28:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:37158: 535 Incorrect authentication data (set_id=nozawa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:28:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:14730: 535 Incorrect authentication data (set_id=la2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:28:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:25744: 535 Incorrect authentication data (set_id=drmail)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:29:41 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:29:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:53796: 535 Incorrect authentication data (set_id=sensharma)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:29:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:17198: 535 Incorrect authentication data (set_id=ammanager)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.183.92.200
country_id: 3469034
description:
Jun 20 16:30:16 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.183.92.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:29:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:1906: 535 Incorrect authentication data (set_id=communication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:29:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:27282: 535 Incorrect authentication data (set_id=sara123)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:16:29:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262682&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781972979 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.158.200.190
country_id: 3437598
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/06/WhatsApp-Image-2023-06-21-at-10.25.03.jpeg 600w, http:/togodailynews.tg/wp-content/uploads/2023/06/WhatsApp-Image-2023-06-21-at-10.25.03-300x226.jpeg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:29:39 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:16:29:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7040617&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781972975 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:29:53 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:62034: 535 Incorrect authentication data (set_id=sendmail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:29:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:20990: 535 Incorrect authentication data (set_id=super)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:16:29:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10393455&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781972972 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:30:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:1468: 535 Incorrect authentication data (set_id=kul)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-20 16:31:15 +0000] info [cpaneld] 102.54.238.57 - pharma "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pharma (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:30:34 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


