# incident

plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:14:25:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10052756&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781533534 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 77.173.217.95
country_id: 2750405
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f320db3509214084370fc82f6dc99fc696b2f174||Title:qutckiz9iwcj6npd7||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:14:25:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9881286&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781533535 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.215.117.93
country_id: 2921044
description:
[2026-06-15 14:26:36 +0000] info [whostmgrd] 85.215.117.93 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 77.173.217.95
country_id: 2750405
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0bc25c738ca98bf8fbc155db3c8afc4c2a5c07b2||Title:bhskfawv4yahnwdm||RSV:8.17||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.13.210
country_id: 6251999
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:104.239.13.210||TA:104.239.13.210||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 85.215.117.93
country_id: 2921044
description:
[2026-06-15 14:26:37 +0000] info [whostmgrd] 85.215.117.93 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: modsec
rule: 77093094
abuser: 40.114.79.135
country_id: 6252001
domain: www.hsi.pnls.tg
description:


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 77.173.217.95
country_id: 2750405
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d751b6bd7b029e04fdce7a0447529a45c11dbf73||Title:honxyrzuw6hz8ytm25||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 85.215.117.93
country_id: 2921044
domain: misstogo.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.17||T:APACHE||MV:/images/images/cache.php||SC:/home/tgmisefred/public_html/images||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 145.223.51.184
country_id: 2750405
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:145.223.51.184||TA:145.223.51.184||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 77.173.217.95
country_id: 2750405
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bc648cb98c0034445f82601af8a91e3e70b042b4||Title:2zv1hj1amn6g0zf||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 77.173.217.95
country_id: 2750405
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c584c1274ebd81fb86d1de192be857ba66fbd7b1||Title:mnre6nhrqidbu5je||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 185.61.223.29
country_id: 2017370
domain: monde-ai.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:Aj@toVIVI1494.monde-ai.tg||Method:wp.getUsersBlogs


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.125.89.252
country_id: 294640
description:
[2026-06-15 14:31:41 +0000] info [cpaneld] 77.125.89.252 - hnzwgoog "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.253.66.190
country_id: 6251999
domain: educplusmedia.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:104.253.66.190||TA:104.253.66.190||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.210.226
country_id: 3469034
description:
2026-06-15 14:35:18 dovecot_login authenticator failed for H=([102.33.36.254]) [186.238.210.226]:53394: 535 Incorrect authentication data (set_id=felix.barigao@arse.tg)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:14:36:09 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 85.215.117.93
country_id: 2921044
domain: lacs1.mairie.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.17||T:APACHE||MV:/images/images/cache.php||SC:/home/nwvfmxat/public_html/images||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.167
country_id: 1880251
description:
47.128.96.167 - - [15/Jun/2026:14:36:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935209&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fresultats-bac-1%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781534172 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/resultats-bac-1/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.167


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:14:36:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 85.215.117.93
country_id: 2921044
domain: cfpj.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.17||T:APACHE||MV:/images/images/cache.php||SC:/home/cfpjusti/public_html/images||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.199.70
country_id: 2363686
description:
[2026-06-15 14:38:45 +0000] info [webmaild] 160.242.199.70 - yadjor@caissederetraites.tg "POST /cpsess6638401227/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [160.242.195.10] != Current IP Address [160.242.199.70]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.100.148
country_id: 99237
domain: tera-afrique.free.netmaster.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tera-afrique.free.netmaster.tg/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.177
country_id: 1880251
description:
47.128.96.177 - - [15/Jun/2026:14:40:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132078&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcommune-golfe-3%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781534448 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/commune-golfe-3/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.177


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 14:41:05 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:37392: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:14:42:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842265&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781534530 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:14:42:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6908311&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781534531 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.169.26.68
country_id: 2363686
description:
[2026-06-15 14:43:25 +0000] info [webmaild] 196.169.26.68 - sandra.amana@togointerim.net "POST /cpsess5823909079/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.171.46.177] != Current IP Address [196.169.26.68]


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 91.132.125.111
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:91.132.125.111||TA:91.132.125.111||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.164.78.231
country_id: 732800
domain: sia-togo.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:POST http:/sia-togo.tg/wp-login.php HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.207.35.57
country_id: 6252001
description:
[2026-06-15 14:43:32 +0000] info [webmaild] 104.207.35.57 - crepsad "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.151
country_id: 1880251
description:
47.128.96.151 - - [15/Jun/2026:14:44:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116904&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fkim-jong-un%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781534646 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/kim-jong-un/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.151


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 85.215.117.93
country_id: 2921044
domain: www.arse.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.17||T:APACHE||MV:/images/images/cache.php||SC:/home/arsetg/public_html/images||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 148.222.185.184
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:14-47.148.222.185.184||RSV:8.17||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.112.217.104
country_id: 2661886
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:92.112.217.104||TA:92.112.217.104||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.101.12.199
country_id: 6252001
description:
2026-06-15 14:48:33 dovecot_plain authenticator failed for H=70-101-12-199.dsl2-plymouth.roc.ny.frontiernet.net (tiy5v3ob87gna1g23v7bj) [70.101.12.199]:43205: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.138.159.170
country_id: 6252001
description:
2026-06-15 14:48:29 dovecot_plain authenticator failed for H=c-69-138-159-170.hsd1.ky.comcast.net (p0nk9cieot57roagod42k7fh0ibrz7e) [69.138.159.170]:54934: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:14:49:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:14:49:24 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.196.53.106
country_id: 458258
domain: mesyscom.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:14-52.196.196.53.106||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 148.222.185.184
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:14-52.148.222.185.184||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.221.2.119
country_id: 1835841
description:
2026-06-15 14:52:40 dovecot_login authenticator failed for H=(185-183-103-121.xdsl.5gdsl.com) [211.221.2.119]:37628: 535 Incorrect authentication data (set_id=j_essoh@centif.tg)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 85.215.117.93
country_id: 2921044
domain: belali.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.17||T:APACHE||MV:/images/images/cache.php||SC:/home/dmmkifel/public_html/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.221.2.119
country_id: 1835841
description:
Jun 15 14:52:38 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.221.2.119 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2.217.140.140
country_id: 2635167
description:
[2026-06-15 14:53:57 +0000] info [whostmgrd] 2.217.140.140 - yvwaocrr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.30.74.240
country_id: 2635167
description:
[2026-06-15 14:53:57 +0000] info [cpaneld] 62.30.74.240 - yvwaocrr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yvwaocrr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.212.85.175
country_id: 630336
description:
[2026-06-15 14:54:35 +0000] info [cpaneld] 37.212.85.175 - yxhnfwxr "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:14:56:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000540&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781535407 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:14:56:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131610&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781535411 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.129.62.64
country_id: 2623032
description:
185.129.62.64 - libertepansel [15/Jun/2026:14:57:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10248345&pdata=https%253A%252F%252Flibertetogo.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781535460 HTTP/2.0" 302 0 libertetogo.tg "https://libertetogo.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.129.62.64


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 85.215.117.93
country_id: 2921044
domain: crepsad.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.17||T:APACHE||MV:/images/images/cache.php||SC:/home/crepsad/public_html/images||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-15 14:59:53 +0000] info [webmaild] 160.242.195.10 - knouwodou@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.228.71.29
country_id: 2635167
description:
[2026-06-15 15:01:44 +0000] info [cpaneld] 140.228.71.29 - tqttxcvn "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tqttxcvn (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.54.40.182
country_id: 1149361
description:
Jun 15 15:01:42 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.54.40.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.40.182
country_id: 1149361
description:
2026-06-15 15:01:44 dovecot_login authenticator failed for H=(213-65-190-48-no2550.tbcn.telia.com) [149.54.40.182]:54782: 535 Incorrect authentication data (set_id=dasha9198@atms.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-15 15:03:12 +0000] info [webmaild] 102.176.253.226 - secre.gene@ucao-uut.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.19
country_id: 1880251
description:
47.128.96.19 - - [15/Jun/2026:15:02:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328424&pdata=https%253A%252F%252Fcfpj.tg%252Fhistorique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781535745 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/historique/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.19


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.122
country_id: 1880251
description:
47.128.96.122 - - [15/Jun/2026:15:02:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051670&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Folimpia-fc%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781535747 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/olimpia-fc/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.122


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 185.100.87.250
country_id: 798549
domain: davetechno.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.17||T:APACHE||MV:/wp-json/wp/v2/users?per_page=100||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 85.215.117.93
country_id: 2921044
domain: batika.free.netmaster.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.17||T:APACHE||MV:/images/images/cache.php||SC:/var/www/html/images||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-15 15:03:45 +0000] info [webmaild] 102.176.253.226 - secre.gene@ucao-uut.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 15:04:04 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:50382: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.105.5
country_id: 798544
description:
Jun 15 15:04:19 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.105.5 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:15:04:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:15:04:44 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 128.199.123.37
country_id: 1880251
description:
[2026-06-15 15:05:18 +0000] info [cpaneld] 128.199.123.37 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 15:04:23 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:60456: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:15:04:44 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.97.219.43
country_id: 3865483
domain: fbafrica.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fbafrica.com/author/fbafrica/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.105.5
country_id: 798544
description:
Jun 15 15:04:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.105.5 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:15:04:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 15:05:28 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:55146: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.238
country_id: 3175395
description:
Jun 15 15:06:24 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.238 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 92.184.103.174
country_id: 3017382
description:
92.184.103.174 - - [15/Jun/2026:15:06:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7521738&pdata=https%253A%252F%252Fcpanel.ccit.tg%252F%253Flocale%253Dpl&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781535987 HTTP/2.0" 302 0 cpanel.ccit.tg "https://cpanel.ccit.tg/?locale=pl" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:92.184.103.174


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.125.89.252
country_id: 294640
description:
[2026-06-15 15:07:40 +0000] info [cpaneld] 77.125.89.252 - hnzwgoog "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.209.183
country_id: 798544
description:
Jun 15 15:07:29 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.209.183 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.39.86.70
country_id: 953987
description:
[2026-06-15 15:07:52 +0000] info [cpaneld] 102.39.86.70 - mesys "GET /login/?login_only=1&user=mesys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesys (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.3.159.91
country_id: 2017370
description:
[2026-06-15 15:07:34 +0000] info [cpaneld] 212.3.159.91 - mesyscom "GET /login/?login_only=1&user=mesyscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.212.111.90
country_id: 1210997
description:
[2026-06-15 15:07:40 +0000] info [cpaneld] 113.212.111.90 - mesyscomcom "GET /login/?login_only=1&user=mesyscomcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:15:09:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9989789&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781536177 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:15:09:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6788708&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781536181 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 4.246.105.45
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 4.246.105.45
country_id: 6252001
domain: togodailynews.tg
description:
IM360 WAF: Request body parsing error||err_msg:JSON parsing error: lexical error: invalid char in json text.\n||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.208.204.132
country_id: 1643084
description:
[2026-06-15 15:12:18 +0000] info [cpaneld] 103.208.204.132 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.206.98.134
country_id: 6290252
description:
Jun 15 15:11:49 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.206.98.134 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.174
country_id: 1880251
description:
47.128.96.174 - - [15/Jun/2026:15:14:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12962970&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Feffondrement-dun-immeuble-au-nigeria%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781536494 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/effondrement-dun-immeuble-au-nigeria/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.174


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.169
country_id: 1880251
description:
47.128.96.169 - - [15/Jun/2026:15:16:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923683&pdata=https%253A%252F%252Ftdn.tg%252Fbraquage-au-tribunal-de-bouake-un-detenu-sevade-avec-la-voiture-du-juge-dinstruction%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781536560 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/braquage-au-tribunal-de-bouake-un-detenu-sevade-avec-la-voiture-du-juge-dinstruction/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.169


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.152
country_id: 1880251
description:
47.128.96.152 - - [15/Jun/2026:15:15:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9660359&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fincendie-a-lecole-primaire-evangelique-de-nyekonakpoe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781536554 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/incendie-a-lecole-primaire-evangelique-de-nyekonakpoe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.152


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 41.207.188.29
country_id: 2363686
description:
41.207.188.29 - - [15/Jun/2026:15:15:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000235&pdata=https%253A%252F%252Ftdn.tg%252Fbenin-obtenir-citoyennete%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781536530 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/benin-obtenir-citoyennete/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:41.207.188.29


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.20
country_id: 1880251
description:
47.128.96.20 - - [15/Jun/2026:15:15:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13146771&pdata=https%253A%252F%252Ftdn.tg%252Fbraquage-au-tribunal-de-bouake-un-detenu-sevade-avec-la-voiture-du-juge-dinstruction%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781536527 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/braquage-au-tribunal-de-bouake-un-detenu-sevade-avec-la-voiture-du-juge-dinstruction/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.20


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.207.181.198
country_id: 2363686
description:
[2026-06-15 15:18:12 +0000] info [webmaild] 41.207.181.198 - contact@ave2.mairie.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.198
country_id: 1880251
description:
47.128.96.198 - - [15/Jun/2026:15:17:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10198170&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fhausse-du-prix-du-ciment-cimtogo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781536653 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/hausse-du-prix-du-ciment-cimtogo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.198


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.19
country_id: 1880251
description:
47.128.96.19 - - [15/Jun/2026:15:17:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920857&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Feffondrement-dun-immeuble-au-nigeria%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781536639 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/effondrement-dun-immeuble-au-nigeria/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.19


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.207.181.198
country_id: 2363686
description:
[2026-06-15 15:19:18 +0000] info [webmaild] 41.207.181.198 - contact@ave2.mairie.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-15 15:19:05 +0000] info [webmaild] 102.176.253.226 - secre.gene@ucao-uut.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:15:21:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:15:21:29 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:15:21:29 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.33
country_id: 6252001
description:
[2026-06-15 15:22:18 +0000] info [cpaneld] 64.44.59.33 NEW ifxmoxbf:wgCZfx5nSme83cle address=64.44.59.33,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:15:21:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.92.147.151
country_id: 1168579
description:
2026-06-15 15:24:17 dovecot_plain authenticator failed for H=(localhost) [111.92.147.151]:65307: 535 Incorrect authentication data (set_id=visite@cloud-et-racks.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:15:23:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6908268&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781537033 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.207.181.198
country_id: 2363686
description:
[2026-06-15 15:23:46 +0000] info [cpaneld] 41.207.181.198 - nadngfzn "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:15:23:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6514026&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781537034 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.92.147.151
country_id: 1168579
description:
Jun 15 15:24:15 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.92.147.151 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.207.181.198
country_id: 2363686
description:
[2026-06-15 15:25:01 +0000] info [cpaneld] 41.207.181.198 - nadngfzn "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.94.255.41
country_id: 1282988
description:
[2026-06-15 15:24:51 +0000] info [cpaneld] 103.94.255.41 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 93.170.213.25
country_id: 1522867
description:
[2026-06-15 15:24:36 +0000] info [cpaneld] 93.170.213.25 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.82.198.65
country_id: 3865483
description:
[2026-06-15 15:24:24 +0000] info [cpaneld] 191.82.198.65 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 131.0.35.199
country_id: 3469034
description:
[2026-06-15 15:24:31 +0000] info [cpaneld] 131.0.35.199 - dgdntogotg "GET /login/?login_only=1&user=dgdntogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.54.66.212
country_id: 1512440
description:
[2026-06-15 15:24:34 +0000] info [cpaneld] 84.54.66.212 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.175.12.32
country_id: 3469034
description:
[2026-06-15 15:24:43 +0000] info [cpaneld] 45.175.12.32 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.195.152.6
country_id: 6251999
description:
[2026-06-15 15:24:45 +0000] info [cpaneld] 104.195.152.6 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - kagbekoh@davakconsulting.com [06/15/2026:15:25:21 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: kagbekoh@davakconsulting.com


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.88.35.173
country_id: 298795
domain: derou.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/derou.tg/fr/slides/Service_Urbanisme HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.207.181.198
country_id: 2363686
description:
[2026-06-15 15:31:20 +0000] info [cpaneld] 41.207.181.198 - nadngfzn "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 197.49.227.68
country_id: 357994
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cfb8d91ac12d0dcd5a61a29424bddcea7b03946e||Title:cekvwcl84yoxfgn2||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 197.49.227.68
country_id: 357994
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c385935cbd47bf040aed1affbf77ff368df0d899||Title:0aqeu7uk9izbptb||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:15:37:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:15:37:09 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 197.49.227.68
country_id: 357994
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e5779efac7b697a93a062ce0b9e49f373e865d4c||Title:vtx9jkbhmu0a9rl1d||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:15:37:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:15:37:11 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.110.118.44
country_id: 732800
description:
Jun 15 15:37:42 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.110.118.44 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 197.49.227.68
country_id: 357994
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d0e7a84ada3eb5b905d125978e4aa77db345ad53||Title:koap9g8xja3dtxn||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 197.49.227.68
country_id: 357994
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3fae3acd6482833a58712916327eb5b2acc68a15||Title:gc8k5mivxevubc||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:15:40:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13015493&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781538006 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 197.49.227.68
country_id: 357994
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:692d292f9588172b0d90b922aa6ce8303682225e||Title:ueyob9q7waq75ibsx||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:15:40:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10067042&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781538004 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 197.49.227.68
country_id: 357994
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bc564ac59f83d97afd888ef0ef24ee68831d31b3||Title:o34f7rd4kx2adeq6c||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 197.49.227.68
country_id: 357994
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:090e55f74fa82e0238284d64e35f926bd45ddb1c||Title:v5ofezfo7w7re34||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 197.49.227.68
country_id: 357994
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6d4bfaefdab7d14201e829360560de3ffffdce65||Title:xcmtfbkcjzlnyih||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 197.49.227.68
country_id: 357994
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:dbe64a780c0486f622c74738331cc4e5791ab05e||Title:bcjjys8zsvbcba||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.92.97.207
country_id: 2542007
domain: www.ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ca-togo.org/actualite/detail/retraite-des-directeurs-generaux-des-compagnies-dassurances-membres-du-cat HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 197.49.227.68
country_id: 357994
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8b245a9a0e5dd652de98bc49b0f44e2c2ce872b8||Title:9hz5zrix7h6jjeicw||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 197.49.227.68
country_id: 357994
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:96494d1f451d8bed61e7b9e84d4611aa654abc2c||Title:q1m278t9ox9ie86gdw||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 197.49.227.68
country_id: 357994
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7b3f82ff33ae8b0f44a9f2e46d5c766b852d1a0e||Title:pk5dxvzdonmfppjor||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 202.191.122.185
country_id: 1210997
description:
202.191.122.185 - - [15/Jun/2026:15:48:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9660567&pdata=https%253A%252F%252Fmacite.tg%252F2026%252F01%252F08%252Fune-annee-dactions-soutenues-de-ladministration-togolaise-au-profit-du-bien-etre-collectif%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781538500 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2026/01/08/une-annee-dactions-soutenues-de-ladministration-togolaise-au-profit-du-bien-etre-collectif/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.4485.1437 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:202.191.122.185


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.244.67.138
country_id: 3469034
description:
[2026-06-15 15:49:03 +0000] info [cpaneld] 170.244.67.138 - mesysc "GET /login/?login_only=1&user=mesysc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.165.12.79
country_id: 2017370
description:
[2026-06-15 15:48:57 +0000] info [cpaneld] 46.165.12.79 - kidsedunetmaster "GET / HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.57.238.91
country_id: 2017370
description:
[2026-06-15 15:49:11 +0000] info [cpaneld] 185.57.238.91 - mesy "GET /login/?login_only=1&user=mesy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 148.227.93.69
country_id: 3658394
description:
[2026-06-15 15:49:19 +0000] info [cpaneld] 148.227.93.69 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.184.229.241
country_id: 3865483
description:
Jun 15 15:48:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.184.229.241 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.208.188.159
country_id: 2017370
description:
[2026-06-15 15:48:48 +0000] info [cpaneld] 195.208.188.159 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.15.43.217
country_id: 3686110
description:
[2026-06-15 15:49:16 +0000] info [cpaneld] 179.15.43.217 - mes "GET /login/?login_only=1&user=mes&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mes (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 15:50:40 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:34136: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.13.192.77
country_id: 1210997
description:
103.13.192.77 - - [15/Jun/2026:15:51:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9868441&pdata=https%253A%252F%252Ftogodailynews.tg%252Freformes-foncieres-securiser-les-terres-pour-nourrir-lavenir%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781538692 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/reformes-foncieres-securiser-les-terres-pour-nourrir-lavenir/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.9212.1204 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.13.192.77


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.4.81.106
country_id: 1562822
description:
Jun 15 15:52:40 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.4.81.106 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:15:53:25 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:15:53:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:15:53:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:15:53:26 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 68.235.45.44
country_id: 6252001
description:
68.235.45.44 - - [15/Jun/2026:15:54:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7063196&pdata=http%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252F9e748621ef5af3193726f97634097a23%252Findex.php%253Fcmd%253Dnewupld&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781538841 HTTP/1.1" 302 0 kpmg.tg "http://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/9e748621ef5af3193726f97634097a23/index.php?cmd=newupld" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 YaBrowser/25.12.3.655.10 YaApp_iOS/2512.3 YaApp_iOS_Browser/2512.3 Safari/604.1 SA/3 Version/18.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:68.235.45.44


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:15:55:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7171477&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781538904 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:15:55:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6593478&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781538905 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.182
country_id: 1880251
description:
47.128.96.182 - - [15/Jun/2026:15:55:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842778&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fafro-global-connect%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781538950 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/afro-global-connect/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.182


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.142.201.26
country_id: 2750405
description:
[2026-06-15 15:56:09 +0000] info [cpaneld] 45.142.201.26 - e.carine "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.91.97.146
country_id: 6252001
description:
2026-06-15 15:56:50 dovecot_plain authenticator failed for H=(kvbbtk51638rbgh5mgt5ujebyyg) [76.91.97.146]:37860: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.170
country_id: 1880251
description:
47.128.96.170 - - [15/Jun/2026:15:56:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10392977&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffemmes-sorcieres%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781539012 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/femmes-sorcieres/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.170


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.127
country_id: 1880251
description:
47.128.96.127 - - [15/Jun/2026:15:57:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923428&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Feffondrement-dun-immeuble-au-nigeria%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781539031 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/effondrement-dun-immeuble-au-nigeria/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.127


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.234.202.52
country_id: 953987
description:
Jun 15 15:56:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.234.202.52 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 38.51.28.51
country_id: 3865483
description:
38.51.28.51 - - [15/Jun/2026:15:58:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065564&pdata=https%253A%252F%252Ftdn.tg%252Finades-formation-togo-recrute-comptable%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781539088 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/inades-formation-togo-recrute-comptable/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.5347.1275 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:38.51.28.51


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.169.24.13
country_id: 2363686
description:
[2026-06-15 15:57:57 +0000] info [webmaild] 196.169.24.13 - sandra.amana@togointerim.net "POST /cpsess1780818002/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.171.46.177] != Current IP Address [196.169.24.13]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 41.207.188.29
country_id: 2363686
description:
41.207.188.29 - - [15/Jun/2026:15:58:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13134484&pdata=https%253A%252F%252Fdirect7.tg%252Ftogo-a-la-decouverte-des-differentes-esop-appuyees-par-le-pasa%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781539118 HTTP/2.0" 302 0 direct7.tg "https://direct7.tg/togo-a-la-decouverte-des-differentes-esop-appuyees-par-le-pasa/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:41.207.188.29


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.15
country_id: 1880251
description:
47.128.96.15 - - [15/Jun/2026:15:59:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9858197&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fincendie-a-lecole-primaire-evangelique-de-nyekonakpoe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781539142 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/incendie-a-lecole-primaire-evangelique-de-nyekonakpoe/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.15


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [15/Jun/2026:15:59:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791332&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781539146 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.142
country_id: 1880251
description:
47.128.96.142 - - [15/Jun/2026:15:59:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9726105&pdata=https%253A%252F%252Ftdn.tg%252Finades-formation-togo-recrute-comptable%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781539149 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/inades-formation-togo-recrute-comptable/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.142


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 182.48.82.90
country_id: 1210997
description:
182.48.82.90 - - [15/Jun/2026:15:59:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986183&pdata=https%253A%252F%252Ftogodailynews.tg%252Fmodernisation-la-nouvelle-promesse-togolaise-a-56-milliards-de-francs%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781539197 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/modernisation-la-nouvelle-promesse-togolaise-a-56-milliards-de-francs/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.3804.1836 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:182.48.82.90


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.15
country_id: 1880251
description:
47.128.96.15 - - [15/Jun/2026:15:59:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920037&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftogo-emploi%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781539168 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/togo-emploi/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.15


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 15:59:37 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:59226: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.168
country_id: 1880251
description:
47.128.96.168 - - [15/Jun/2026:16:00:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7103844&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Futilisation-des-eleves-pour-des-travaux-champetres-et-autres-corvees%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781539240 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/utilisation-des-eleves-pour-des-travaux-champetres-et-autres-corvees/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.168


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.132
country_id: 1880251
description:
47.128.96.132 - - [15/Jun/2026:16:00:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6907749&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fafro-global-connect%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781539252 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/afro-global-connect/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.132


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.68.37.69
country_id: 6252001
description:
2026-06-15 16:02:59 dovecot_plain authenticator failed for H=(gi245o1cbolj90wn) [74.68.37.69]:46223: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 91.200.107.197
country_id: 798544
domain: macite.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.17||T:APACHE||MV:/wp-json/wp/v2/users||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 196.39.240.133
country_id: 953987
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:196.39.240.133||TA:196.39.240.133||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 16:04:53 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:35582: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 122.114.158.24
country_id: 1814991
description:
2026-06-15 16:05:10 H=(localhost.localdomain) [122.114.158.24]:48930 F=<admin@thebegavalley.com> rejected RCPT <info@wellcity.tg>: The mail server could not deliver mail to info@wellcity.tg.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:16:06:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:16:06:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:16:06:15 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:16:06:13 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 114.119.153.16
country_id: 1880251
domain: civilemagazine.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://civilemagazine.tg/onu-bola-tinubu-points-a-retenir?amp=1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 16:07:45 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:50416: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:16:08:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7170410&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781539695 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:16:08:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7118536&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781539695 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.13
country_id: 1880251
description:
47.128.96.13 - - [15/Jun/2026:16:07:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13277084&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fkodjo-adedze%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781539661 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/kodjo-adedze/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.13


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.202.222.110
country_id: 1210997
description:
103.202.222.110 - - [15/Jun/2026:16:11:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738603&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-les-grandes-decisions-du-conseil-des-ministres-du-25-fevrier-2026%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781539863 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-les-grandes-decisions-du-conseil-des-ministres-du-25-fevrier-2026/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2723.1880 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.202.222.110


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 66.245.216.187
country_id: 1861060
domain: snbt-togo.snb.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.17||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/bighostingsnbd/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.8.246.11
country_id: 3625428
description:
2026-06-15 16:14:34 dovecot_plain authenticator failed for H=(41da3k94j536moutmty) [200.8.246.11]:47687: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 77.111.247.26
country_id: 3144096
description:
77.111.247.26 - - [15/Jun/2026:16:15:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6921322&pdata=https%253A%252F%252Flaunetogo.tg%252Fpensions-crt-fin-des-paiements-en-especes-a-partir-de-juillet-2026-place-au-mobile-money-et-au-virement-bancaire%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781540104 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/pensions-crt-fin-des-paiements-en-especes-a-partir-de-juillet-2026-place-au-mobile-money-et-au-virement-bancaire/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Mobile Safari/537.36 OPR/98.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:77.111.247.26


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 132.147.156.235
country_id: 6252001
description:
2026-06-15 16:15:12 dovecot_plain authenticator failed for H=(c9rj6gfp5wp9un03y4z) [132.147.156.235]:2651: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:16:48 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.62.8.163
country_id: 1269750
description:
Jun 15 16:16:40 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.62.8.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:16:50 dovecot_login authenticator failed for H=(ygn3gQ) [141.98.10.175]:53047: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.51.212.130
country_id: 3469034
description:
Jun 15 16:18:05 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.51.212.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.51.212.130
country_id: 3469034
description:
2026-06-15 16:18:07 dovecot_login authenticator failed for H=([186.239.254.4]) [187.51.212.130]:35089: 535 Incorrect authentication data (set_id=partners@soena.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:17:47 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:17:19 dovecot_login authenticator failed for H=(u2AEjdPm) [141.98.10.175]:60454: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.12.27
country_id: 2017370
description:
2026-06-15 16:18:28 dovecot_login authenticator failed for H=([219.159.57.4]) [31.173.12.27]:37524: 535 Incorrect authentication data (set_id=felix.barigao@arse.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 192.42.116.48
country_id: 2750405
description:
192.42.116.48 - zauwogvk [15/Jun/2026:16:20:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065765&pdata=https%253A%252F%252Fscafricaplc.com%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781540451 HTTP/2.0" 302 0 scafricaplc.com "https://scafricaplc.com:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:192.42.116.48


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:16:22:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.176.233.150
country_id: 3686110
description:
[2026-06-15 16:22:52 +0000] info [cpaneld] 45.176.233.150 - mesys "GET /login/?login_only=1&user=mesys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesys (has_cpuser_file failed)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:16:22:54 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:16:22:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:16:22:52 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:16:23:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842262&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781540627 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:16:23:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10120606&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781540624 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:16:24:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000540&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781535407 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 45.237.57.100
country_id: 3469034
description:
45.237.57.100 - - [15/Jun/2026:16:24:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000540&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781535407 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 Edg/148.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.237.57.100


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-15 16:26:04 +0000] info [webmaild] 196.171.46.177 - direction@togointerim.net "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.72.198.167
country_id: 1210997
description:
103.72.198.167 - - [15/Jun/2026:16:26:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6657223&pdata=https%253A%252F%252Fmacite.tg%252F2025%252F01%252F28%252Ffoot-2025-le-tirage-au-sort-place-la-cote-divoire-et-le-cameroun-dans-la-poule-f%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781540786 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2025/01/28/foot-2025-le-tirage-au-sort-place-la-cote-divoire-et-le-cameroun-dans-la-poule-f/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.5362.1951 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.72.198.167


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:16:26:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000540&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781535407 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:28:47 dovecot_login authenticator failed for H=(KrErCUWhtc) [141.98.10.175]:56071: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:28:45 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:29:20 dovecot_login authenticator failed for H=(nKrCa2Psn) [141.98.10.175]:62165: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:29:49 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 16:29:49 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:57398: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:30:25 dovecot_login authenticator failed for H=(QAvRHQ8) [141.98.10.175]:58199: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:30:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.125.223.238
country_id: 3469034
domain: ns5.netmaster.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ns5.netmaster.tg/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.58.39.242
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/08/t\xc3\xa9l\xc3\xa9chargement-7.jpeg HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - kagbekoh@davakconsulting.com [06/15/2026:16:32:00 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: kagbekoh@davakconsulting.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:31:23 dovecot_login authenticator failed for H=(jVTrqwnx) [141.98.10.175]:53004: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:31:21 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:32:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:32:24 dovecot_login authenticator failed for H=(BbU25rH) [141.98.10.175]:65262: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 45.237.57.100
country_id: 3469034
description:
45.237.57.100 - - [15/Jun/2026:16:34:06 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000540&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781535407" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 Edg/148.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.237.57.100


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:33:29 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 45.237.57.100
country_id: 3469034
description:
45.237.57.100 - - [15/Jun/2026:16:34:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000540&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781535407 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 Edg/148.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.237.57.100


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:33:31 dovecot_login authenticator failed for H=(IdoxMUMYnp) [141.98.10.175]:61510: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:34:39 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - e.senahounvo@davakconsulting.com [06/15/2026:16:34:48 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: e.senahounvo@davakconsulting.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:34:41 dovecot_login authenticator failed for H=(YteMv2oOu) [141.98.10.175]:59183: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 66.245.221.41
country_id: 1861060
domain: www.owa.antasertogo.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.17||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/antasadmin/public_html/owa/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:36:09 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:36:11 dovecot_login authenticator failed for H=(O3Tr3DS3) [141.98.10.175]:61465: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.104.244.165
country_id: 6251999
domain: construction.sia-togo.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.17||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/qfaclpeg/public_html/construction/wp-content||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.169
country_id: 1880251
description:
47.128.121.169 - - [15/Jun/2026:16:36:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6853991&pdata=https%253A%252F%252Fdirect7.tg%252Ftag%252Flions-club%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781541415 HTTP/2.0" 302 0 direct7.tg "https://direct7.tg/tag/lions-club/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.169


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:36:38 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:36:40 dovecot_login authenticator failed for H=(PmuoyO4dr) [141.98.10.175]:51602: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - kagbekoh@davakconsulting.com [06/15/2026:16:37:49 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: kagbekoh@davakconsulting.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:37:41 dovecot_login authenticator failed for H=(gcciDWMf) [141.98.10.175]:49193: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:37:39 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - e.senahounvo@davakconsulting.com [06/15/2026:16:38:37 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: e.senahounvo@davakconsulting.com


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:16:39:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:16:39:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:38:35 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:16:39:08 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:16:39:11 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:38:37 dovecot_login authenticator failed for H=(j0OEWG4LZ) [141.98.10.175]:61494: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:16:38:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13002134&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781541508 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:16:38:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10261867&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781541511 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:39:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:39:35 dovecot_login authenticator failed for H=(rxaM5v5) [141.98.10.175]:56470: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - e.gbevon@davakconsulting.com [06/15/2026:16:41:06 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: e.gbevon@davakconsulting.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:40:37 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:40:39 dovecot_login authenticator failed for H=(q6geNVUp7) [141.98.10.175]:53596: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.155.237.108
country_id: 1835841
description:
2026-06-15 16:41:00 dovecot_login authenticator failed for H=([182.95.230.122]) [221.155.237.108]:34684: 535 Incorrect authentication data (set_id=elogdoyoih@otr.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.155.237.108
country_id: 1835841
description:
Jun 15 16:40:58 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.155.237.108 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - kagbekoh@davakconsulting.com [06/15/2026:16:41:48 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: kagbekoh@davakconsulting.com


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-15 16:42:18 +0000] info [webmaild] 196.171.46.177 - sandra.amana@togointerim.net "POST /cpsess0889713981/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.169.24.13] != Current IP Address [196.171.46.177]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:41:20 dovecot_login authenticator failed for H=(PHKhfy05) [141.98.10.175]:63236: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:41:51 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.203
country_id: 1880251
description:
47.128.96.203 - - [15/Jun/2026:16:41:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13211538&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fafro-global-connect%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781541678 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/afro-global-connect/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.203


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 206.232.1.22
country_id: 6252001
domain: sp-eau.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:16-41.206.232.1.22||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.153
country_id: 1880251
description:
47.128.96.153 - - [15/Jun/2026:16:41:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9881241&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Futilisation-des-eleves-pour-des-travaux-champetres-et-autres-corvees%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781541706 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/utilisation-des-eleves-pour-des-travaux-champetres-et-autres-corvees/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.153


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-06-15 16:42:22 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:51506: 535 Incorrect authentication data (set_id=partners@dany2.mairie.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:42:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:42:24 dovecot_login authenticator failed for H=(4GSs38gHr) [141.98.10.175]:62160: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.184
country_id: 1880251
description:
47.128.96.184 - - [15/Jun/2026:16:43:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051925&pdata=https%253A%252F%252Ftdn.tg%252Finades-formation-togo-recrute-comptable%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781541797 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/inades-formation-togo-recrute-comptable/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.184


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.93.6.230
country_id: 1814991
description:
Jun 15 16:42:20 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.93.6.230 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - e.senahounvo@davakconsulting.com [06/15/2026:16:43:58 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: e.senahounvo@davakconsulting.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:43:20 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:43:22 dovecot_login authenticator failed for H=(Qan70njBa) [141.98.10.175]:58954: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.148
country_id: 1643084
description:
[2026-06-15 16:43:28 +0000] info [cpaneld] 185.213.83.148 - e.sanvee "GET / HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.185
country_id: 1880251
description:
47.128.96.185 - - [15/Jun/2026:16:44:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10249582&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fvehicules-blindes-de-roch-kabore-cribles-de-balles%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781541873 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/vehicules-blindes-de-roch-kabore-cribles-de-balles/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.185


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:44:25 dovecot_login authenticator failed for H=(Hkl50wO6D) [141.98.10.175]:57087: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 16:44:25 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:35214: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 104.232.222.55
country_id: 2802361
domain: www.direct7.tg
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 13; XQ-BC72 Build/61.2.A.0.472A; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/118.0.0.0 Mobile Safari/537.36 trill_310804 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/trill app_version/31.8.4 ByteLocale/zh-TW ByteFullLocale/zh-Hant-TW Region/TW AppId/1180 Spark/1.4.3-alpha.5 AppVersion/31.8.4 BytedanceWebview/d8a21c6||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 160.155.242.22
country_id: 2287781
domain: www.direct7.tg
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (iPhone; CPU iPhone OS 26_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 Safari/604.1 musical_ly_45.5.0 BytedanceWebview/d8a21c6||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:44:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:45:54 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:45:56 dovecot_login authenticator failed for H=(UugqjEZ) [141.98.10.175]:59933: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - e.senahounvo@davakconsulting.com [06/15/2026:16:47:18 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: e.senahounvo@davakconsulting.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:46:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:46:28 dovecot_login authenticator failed for H=(vMYRm8G) [141.98.10.175]:49627: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:47:29 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:47:31 dovecot_login authenticator failed for H=(04B6OS3) [141.98.10.175]:62675: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:48:32 dovecot_login authenticator failed for H=(syTaonOH) [141.98.10.175]:59217: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:48:30 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:49:34 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:49:36 dovecot_login authenticator failed for H=(IEsHjxmWS) [141.98.10.175]:56297: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:50:37 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:50:39 dovecot_login authenticator failed for H=(qdAkLrebF) [141.98.10.175]:53684: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:51:29 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:51:31 dovecot_login authenticator failed for H=(7w6DWoV) [141.98.10.175]:64521: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:16:52:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:16:53:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7235733&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781542378 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:16:52:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:16:52:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054812&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781542378 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:16:53:00 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:52:24 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.15.40.56
country_id: 1643084
description:
[2026-06-15 16:52:45 +0000] info [cpaneld] 157.15.40.56 - mesyscom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:52:26 dovecot_login authenticator failed for H=(tyMiMcv) [141.98.10.175]:59215: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:16:52:56 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:53:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 222.83.252.34
country_id: 1814991
domain: misstogo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:16-53.222.83.252.34||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:53:28 dovecot_login authenticator failed for H=(2Pla1Lo) [141.98.10.175]:55399: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.225
country_id: 2635167
description:
[2026-06-15 16:53:28 +0000] info [cpaneld] 5.230.133.225 NEW wcnyaruu:KHtXEOL4r3LCeSC6 address=5.230.133.225,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 222.83.252.34
country_id: 1814991
domain: macite.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:16-54.222.83.252.34||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:54:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:54:25 dovecot_login authenticator failed for H=(Hi4oihDvr) [141.98.10.175]:50097: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:55:51 dovecot_login authenticator failed for H=(T6MbEd9) [141.98.10.175]:53177: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-15 16:55:34 +0000] info [webmaild] 160.242.195.10 - mbataka@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.111.114
country_id: 3469034
description:
Jun 15 16:55:44 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.111.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:55:49 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:56:21 dovecot_login authenticator failed for H=(YWsF0P42NW) [141.98.10.175]:56250: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:56:19 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.12.86.29
country_id: 690791
description:
Jun 15 16:56:51 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.12.86.29 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.83.255.232
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:172.83.255.232||TA:172.83.255.232||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-15 16:57:40 +0000] info [webmaild] 160.242.195.10 - ydoni@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:57:22 dovecot_login authenticator failed for H=(KMuJugCBz) [141.98.10.175]:49581: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:57:20 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:58:37 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:58:39 dovecot_login authenticator failed for H=(tLjC7Hx) [141.98.10.175]:58368: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.203.12.19
country_id: 3996063
domain: tdn.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tg/togo-tableau-2024-onmt/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.203.12.19
country_id: 3996063
domain: tdn.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tghttp/tdn.tg/togo-tableau-2024-onmt/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-15 16:59:29 +0000] info [webmaild] 160.242.195.10 - ydoni@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 16:59:39 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 16:59:41 dovecot_login authenticator failed for H=(EC3Kvlb) [141.98.10.175]:54910: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:00:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:00:35 dovecot_login authenticator failed for H=(83VTnqWh) [141.98.10.175]:60406: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 38.25.17.107
country_id: 3932488
domain: www.dagl.tg
description:
IM360 WAF: Bad file extension||RSV:8.17||T:APACHE||MVN:REQUEST_FILENAME||MV:/communes/www.lomegolfe3.com||User:myxlsnta||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:01:36 dovecot_login authenticator failed for H=(4lTSWb4IL) [141.98.10.175]:49236: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:01:34 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 213.32.21.59
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:17-02.213.32.21.59||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:02:28 dovecot_login authenticator failed for H=(yy6sqlyzP) [141.98.10.175]:60149: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:02:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:03:44 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.233.190
country_id: 1835841
description:
2026-06-15 17:04:18 dovecot_login authenticator failed for H=([106.10.69.50]) [183.108.233.190]:57457: 535 Incorrect authentication data (set_id=accounting@armp.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.108.233.190
country_id: 1835841
description:
Jun 15 17:04:16 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.108.233.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:03:46 dovecot_login authenticator failed for H=(0hwtIcjhP) [141.98.10.175]:57762: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.145
country_id: 1269750
description:
Jun 15 17:04:30 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.145 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.145
country_id: 1269750
description:
2026-06-15 17:04:32 dovecot_login authenticator failed for H=([122.187.227.145]) [122.187.227.145]:48701: 535 Incorrect authentication data (set_id=accounting@white-ways.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 15.235.140.141
country_id: 1880251
description:
Jun 15 17:04:37 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 15.235.140.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.203.25.248
country_id: 6251999
description:
Jun 15 17:04:38 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.203.25.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.36.234.156
country_id: 1835841
description:
Jun 15 17:05:12 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.36.234.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:04:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:04:33 dovecot_login authenticator failed for H=(jXvvE3pIS) [141.98.10.175]:61584: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 15.235.140.141
country_id: 1880251
description:
2026-06-15 17:04:39 dovecot_plain authenticator failed for H=vps-be8d03b3.vps.ovh.ca (dirrbkw10oibmsqc0o90rcdruh357q5) [15.235.140.141]:52564: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 82.27.242.89
country_id: 3190538
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:17-04.82.27.242.89||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.120.198.96
country_id: 6252001
description:
2026-06-15 17:05:01 dovecot_plain authenticator failed for H=c-76-120-198-96.hsd1.va.comcast.net (h178mg3cnokx71zjrt7lcmf5exzdhpz3) [76.120.198.96]:34504: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 17:05:13 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:52110: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.203.25.248
country_id: 6251999
description:
2026-06-15 17:04:40 dovecot_plain authenticator failed for H=(wwwri0ebq02zeezem) [159.203.25.248]:58930: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.36.234.156
country_id: 1835841
description:
2026-06-15 17:05:14 dovecot_login authenticator failed for H=([118.36.234.156]) [118.36.234.156]:47508: 535 Incorrect authentication data (set_id=accounting)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 161.123.214.247
country_id: 2077456
domain: dankpen1.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:161.123.214.247||TA:161.123.214.247||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.83.28.29
country_id: 2750405
description:
Jun 15 17:05:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.83.28.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.83.28.29
country_id: 2750405
description:
2026-06-15 17:05:24 dovecot_login authenticator failed for H=(ADMIN) [45.83.28.29]:52096: 535 Incorrect authentication data (set_id=sumsda1968@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:05:27 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:05:29 dovecot_login authenticator failed for H=(fbv9l829Po) [141.98.10.175]:55462: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:06:24 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.85.54.40
country_id: 1814991
description:
Jun 15 17:06:46 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.85.54.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.85.54.40
country_id: 1814991
description:
2026-06-15 17:06:48 dovecot_login authenticator failed for H=(111-70-32-53.emome-ip.hinet.net) [223.85.54.40]:55672: 535 Incorrect authentication data (set_id=no-reply@anrtogo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:06:26 dovecot_login authenticator failed for H=(SWYRlw2mfw) [141.98.10.175]:60888: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:07:30 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:07:32 dovecot_login authenticator failed for H=(DJpPHf) [141.98.10.175]:56987: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.158.126.69
country_id: 2017370
description:
[2026-06-15 17:07:26 +0000] info [cpaneld] 146.158.126.69 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.176.129.114
country_id: 2542007
description:
[2026-06-15 17:07:30 +0000] info [cpaneld] 160.176.129.114 - macitetg "GET /login/?login_only=1&user=macitetg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user macitetg (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:08:41 dovecot_login authenticator failed for H=(D0CIGkRT55) [141.98.10.175]:51152: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:17:09:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:17:09:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:08:39 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:17:09:18 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:09:40 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:09:42 dovecot_login authenticator failed for H=(WZbK2IsP) [141.98.10.175]:61130: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:17:09:19 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.201.172.192
country_id: 1814991
description:
2026-06-15 17:10:46 dovecot_plain authenticator failed for H=(8dpkwocdmbxqds8pc2wyadw8x5tczibr) [111.201.172.192]:34020: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:10:46 dovecot_login authenticator failed for H=(mvGOlA6) [141.98.10.175]:60919: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:17:10:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10012054&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781543437 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:17:10:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6669460&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781543436 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:10:44 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.201.172.192
country_id: 1814991
description:
Jun 15 17:10:44 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.201.172.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:11:47 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:11:49 dovecot_login authenticator failed for H=(CHClInx) [141.98.10.175]:49966: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 103.53.219.209
country_id: 2077456
domain: www.letabloid.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:103.53.219.209||TA:103.53.219.209||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 161.123.152.158
country_id: 357994
domain: www.letabloid.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:161.123.152.158||TA:161.123.152.158||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 185.101.254.187
country_id: 3017382
domain: www.letabloid.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:185.101.254.187||TA:185.101.254.187||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:12:19 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 38.154.197.103
country_id: 6252001
domain: www.letabloid.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:38.154.197.103||TA:38.154.197.103||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 161.123.208.147
country_id: 1861060
domain: www.letabloid.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:161.123.208.147||TA:161.123.208.147||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:12:21 dovecot_login authenticator failed for H=(r88eRpS) [141.98.10.175]:54068: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 191.101.25.124
country_id: 6252001
domain: www.letabloid.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:191.101.25.124||TA:191.101.25.124||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.96.11.17
country_id: 290557
description:
[2026-06-15 17:13:33 +0000] info [cpaneld] 92.96.11.17 - educplusmedia "GET /login/?login_only=1&user=educplusmedia&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educplusmedia (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.155.178.190
country_id: 2542007
description:
[2026-06-15 17:13:40 +0000] info [cpaneld] 105.155.178.190 - educplusmed "GET /login/?login_only=1&user=educplusmed&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educplusmed (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:13:46 dovecot_login authenticator failed for H=(so1ZLf) [141.98.10.175]:58415: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 156.248.245.97
country_id: 3508796
description:
[2026-06-15 17:13:51 +0000] info [cpaneld] 156.248.245.97 - educplu "GET /login/?login_only=1&user=educplu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educplu (has_cpuser_file failed)


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 141.94.161.61
country_id: 3017382
domain: cfpj.tg
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.17||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 155.254.39.173
country_id: 2635167
domain: www.letabloid.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:155.254.39.173||TA:155.254.39.173||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:13:44 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.213.119.84
country_id: 2017370
description:
[2026-06-15 17:13:45 +0000] info [cpaneld] 176.213.119.84 - educplusm "GET /login/?login_only=1&user=educplusm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educplusm (has_cpuser_file failed)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 141.94.161.61
country_id: 3017382
domain: cfpj.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.17||T:APACHE||MV:/wp-json/wp/v2/users/me||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.131.242.135
country_id: 2510769
description:
[2026-06-15 17:13:31 +0000] info [cpaneld] 143.131.242.135 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.143.224.100
country_id: 2635167
domain: www.letabloid.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:104.143.224.100||TA:104.143.224.100||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 1.52.244.142
country_id: 1562822
description:
[2026-06-15 17:14:03 +0000] info [cpaneld] 1.52.244.142 - edu "GET /login/?login_only=1&user=edu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user edu (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:14:39 dovecot_login authenticator failed for H=(Sr3gQOZ) [141.98.10.175]:64612: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:14:37 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.250.18.112
country_id: 3579143
description:
[2026-06-15 17:15:22 +0000] info [cpaneld] 104.250.18.112 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:15:24 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.90.189.62
country_id: 192950
description:
[2026-06-15 17:16:18 +0000] info [cpaneld] 41.90.189.62 - fundacione "GET /login/?login_only=1&user=fundacione&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacione (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 116.108.139.198
country_id: 1562822
description:
[2026-06-15 17:16:13 +0000] info [cpaneld] 116.108.139.198 - fundaciones "GET /login/?login_only=1&user=fundaciones&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundaciones (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.197.155.105
country_id: 1210997
description:
[2026-06-15 17:16:01 +0000] info [cpaneld] 103.197.155.105 - fundacionesper "GET /login/?login_only=1&user=fundacionesper&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacionesper (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:15:26 dovecot_login authenticator failed for H=(keLZpa) [141.98.10.175]:55612: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.93.33.110
country_id: 1210997
description:
[2026-06-15 17:15:44 +0000] info [cpaneld] 103.93.33.110 - fundacionesperanza "GET /login/?login_only=1&user=fundacionesperanza&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacionesperanza (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.130.164.18
country_id: 6252001
description:
[2026-06-15 17:15:54 +0000] info [cpaneld] 24.130.164.18 - fundacionesperan "GET /login/?login_only=1&user=fundacionesperan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacionesperan (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.228.179.176
country_id: 3469034
description:
[2026-06-15 17:15:57 +0000] info [cpaneld] 168.228.179.176 - fundacionespera "GET /login/?login_only=1&user=fundacionespera&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacionespera (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:16:51 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.85.210.26
country_id: 3437598
description:
[2026-06-15 17:16:22 +0000] info [cpaneld] 181.85.210.26 - fundacion "GET /login/?login_only=1&user=fundacion&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacion (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.106.161.244
country_id: 690791
description:
[2026-06-15 17:16:28 +0000] info [cpaneld] 193.106.161.244 - fundaci "GET /login/?login_only=1&user=fundaci&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundaci (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.250.221.168
country_id: 2542007
description:
[2026-06-15 17:16:39 +0000] info [cpaneld] 41.250.221.168 - fu "GET /login/?login_only=1&user=fu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fu (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 77.247.121.41
country_id: 3686110
description:
77.247.121.41 - - [15/Jun/2026:17:17:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9922715&pdata=https%253A%252F%252Fwebmail.cinema.free.netmaster.tg%252F%253Flocale%253Dhe&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781543830 HTTP/2.0" 302 0 webmail.cinema.free.netmaster.tg "https://webmail.cinema.free.netmaster.tg/?locale=he" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:77.247.121.41


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:16:21 dovecot_login authenticator failed for H=(MWlWXX6a) [141.98.10.175]:56902: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:17:43 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:17:45 dovecot_login authenticator failed for H=(zGGxP17Xh) [141.98.10.175]:61193: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:18:38 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 17:19:03 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:38042: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:18:40 dovecot_login authenticator failed for H=(UTCHdl6) [141.98.10.175]:51950: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.28.156.59
country_id: 690791
domain: macite.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:17-19.104.28.156.59||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:19:32 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:19:34 dovecot_login authenticator failed for H=(5sERLoKUP) [141.98.10.175]:50810: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 34.21.64.21
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.17||T:APACHE||REQUEST_URI:/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.84.33.23
country_id: 3895114
description:
[2026-06-15 17:20:41 +0000] info [cpaneld] 138.84.33.23 - tchambainvesttg "GET /login/?login_only=1&user=tchambainvesttg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambainvesttg (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:20:59 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.60.66.24
country_id: 3895114
description:
[2026-06-15 17:20:58 +0000] info [cpaneld] 179.60.66.24 - tchambain "GET /login/?login_only=1&user=tchambain&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambain (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:21:01 dovecot_login authenticator failed for H=(aHyEqd) [141.98.10.175]:53560: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.66.71.27
country_id: 2017370
description:
2026-06-15 17:22:02 dovecot_login authenticator failed for H=([178.66.71.27]) [178.66.71.27]:36982: 535 Incorrect authentication data (set_id=accounting@togosem.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.51.88.91
country_id: 1282988
description:
[2026-06-15 17:21:21 +0000] info [cpaneld] 202.51.88.91 - tch "GET /login/?login_only=1&user=tch&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tch (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.66.71.27
country_id: 2017370
description:
Jun 15 17:22:00 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.66.71.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:21:24 dovecot_login authenticator failed for H=(SNV3N1xtOb) [141.98.10.175]:57731: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:21:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.22.192.71
country_id: 2510769
description:
[2026-06-15 17:21:24 +0000] info [cpaneld] 88.22.192.71 - tc "GET /login/?login_only=1&user=tc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.148.198.63
country_id: 6252001
description:
[2026-06-15 17:22:55 +0000] info [cpaneld] 35.148.198.63 - boobilry "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user boobilry (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.235.212.78
country_id: 6252001
description:
[2026-06-15 17:23:15 +0000] info [whostmgrd] 73.235.212.78 - boobilry "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:22:39 dovecot_login authenticator failed for H=(aSvZ0ZGfo) [141.98.10.175]:55518: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 83.110.74.229
country_id: 290557
description:
[2026-06-15 17:22:53 +0000] info [cpaneld] 83.110.74.229 - boobilry "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user boobilry (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:22:37 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 90.101.155.239
country_id: 3017382
description:
[2026-06-15 17:22:35 +0000] info [cpaneld] 90.101.155.239 - boobilry "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user boobilry (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.249.22.63
country_id: 3585968
description:
[2026-06-15 17:24:18 +0000] info [cpaneld] 167.249.22.63 - tdn "GET /login/?login_only=1&user=tdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tdn (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:23:38 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:23:40 dovecot_login authenticator failed for H=(Nf0b5ob) [141.98.10.175]:56438: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.72.58.54
country_id: 290557
description:
[2026-06-15 17:23:20 +0000] info [whostmgrd] 91.72.58.54 - boobilry "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.71.145.150
country_id: 6252001
description:
[2026-06-15 17:23:26 +0000] info [whostmgrd] 206.71.145.150 - boobilry "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.75.208.53
country_id: 2542007
description:
[2026-06-15 17:23:57 +0000] info [cpaneld] 196.75.208.53 - boobilry "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user boobilry (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.42.91.90
country_id: 3469034
description:
[2026-06-15 17:25:13 +0000] info [whostmgrd] 177.42.91.90 - boobilry "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.111.7.116
country_id: 2017370
description:
[2026-06-15 17:25:16 +0000] info [cpaneld] 79.111.7.116 - boobilry "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user boobilry (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.34.107.227
country_id: 2635167
description:
[2026-06-15 17:24:28 +0000] info [cpaneld] 82.34.107.227 - crechepetitelu "GET /login/?login_only=1&user=crechepetitelu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechepetitelu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.196.164.14
country_id: 3469034
description:
[2026-06-15 17:24:40 +0000] info [cpaneld] 177.196.164.14 - boobilry "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user boobilry (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.188.223.185
country_id: 3996063
description:
[2026-06-15 17:24:57 +0000] info [cpaneld] 187.188.223.185 - crech "GET /login/?login_only=1&user=crech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crech (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.124.109.174
country_id: 3469034
description:
[2026-06-15 17:25:06 +0000] info [cpaneld] 177.124.109.174 - cr "GET /login/?login_only=1&user=cr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cr (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:25:08 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:25:10 dovecot_login authenticator failed for H=(3ODUNM) [141.98.10.175]:64899: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.100.69.92
country_id: 3469034
description:
[2026-06-15 17:24:26 +0000] info [cpaneld] 189.100.69.92 - crechepetitelun "GET /login/?login_only=1&user=crechepetitelun&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechepetitelun (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.83.196.62
country_id: 2245662
description:
[2026-06-15 17:24:29 +0000] info [whostmgrd] 41.83.196.62 - boobilry "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.158.110.136
country_id: 2017370
description:
[2026-06-15 17:24:47 +0000] info [cpaneld] 146.158.110.136 - crechepe "GET /login/?login_only=1&user=crechepe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechepe (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:17:24:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:17:24:38 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.141.115.16
country_id: 3469034
description:
[2026-06-15 17:24:21 +0000] info [cpaneld] 192.141.115.16 - crechepetitelune "GET /login/?login_only=1&user=crechepetitelune&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechepetitelune (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.238.178.117
country_id: 3469034
description:
[2026-06-15 17:24:23 +0000] info [cpaneld] 170.238.178.117 - td "GET /login/?login_only=1&user=td&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user td (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.91.154.226
country_id: 3017382
description:
[2026-06-15 17:24:23 +0000] info [cpaneld] 87.91.154.226 - crechepetitelunetg "GET /login/?login_only=1&user=crechepetitelunetg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechepetitelunetg (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:17:24:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:17:24:39 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.238.188.165
country_id: 298795
description:
[2026-06-15 17:24:44 +0000] info [cpaneld] 213.238.188.165 - crechepet "GET /login/?login_only=1&user=crechepet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechepet (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:17:25:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13133721&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781544351 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:25:41 dovecot_login authenticator failed for H=(QcPCsZgFS8) [141.98.10.175]:53368: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:25:39 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:17:25:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7127910&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781544351 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.181.244
country_id: 2635167
domain: belali.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:POST http:/belali.tg/xmlrpc.php HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:26:33 dovecot_login authenticator failed for H=(LHOtzOEOh3) [141.98.10.175]:57056: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.14.190.88
country_id: 6252001
description:
[2026-06-15 17:27:16 +0000] info [cpaneld] 108.14.190.88 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Marshall_Alexander (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.66.252.128
country_id: 6252001
description:
[2026-06-15 17:27:15 +0000] info [cpaneld] 99.66.252.128 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Marshall_Alexander (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.33.24.155
country_id: 2635167
description:
[2026-06-15 17:27:17 +0000] info [cpaneld] 82.33.24.155 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Marshall_Alexander (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:26:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:27:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:27:27 dovecot_login authenticator failed for H=(cl8NiZt) [141.98.10.175]:54643: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:28:20 dovecot_login authenticator failed for H=(5UAgcuFTfu) [141.98.10.175]:60445: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.73.24.90
country_id: 290557
description:
[2026-06-15 17:28:47 +0000] info [cpaneld] 91.73.24.90 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Marshall_Alexander (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:28:43 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 43.250.158.81
country_id: 1269750
domain: cfmi.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:27307.cfmi.tg||ServerName:cfmi.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0b302be432559ab7ca8baec379bb38a889ca3e5b||Title:0xb10e540e||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.12
country_id: 1269750
description:
Jun 15 17:28:55 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.204.243.202
country_id: 3469034
description:
Jun 15 17:28:39 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.204.243.202 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 101.255.117.202
country_id: 1643084
description:
[2026-06-15 17:29:40 +0000] info [cpaneld] 101.255.117.202 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Marshall_Alexander (has_cpuser_file failed)


plugin: modsec
rule: 77093094
abuser: 136.113.9.105
country_id: 6252001
domain: www.camilliens.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"reason\":-1,\"then\":\"$1:__proto__:then\",\"_11a06427\":\"19f2a661a84773d7\",\"_36e324af\":\"loading\",\"_response\":{\"_prefix\":\"var abivn=arguments['\\\\x31'];var giss=abivn;try{var _v=((0,eval)(global[\\\"\\\\u0042\\\\u0075\\\\u0066\\\\u0066\\\\u0065\\\\u0072\\\


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:29:30 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.38.116
country_id: 2363686
description:
[2026-06-15 17:29:22 +0000] info [webmaild] 196.171.38.116 - wiyao.g@inger.tg "POST /cpsess4420615377/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.170.66.202] != Current IP Address [196.171.38.116]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:29:32 dovecot_login authenticator failed for H=(49KwWhOtor) [141.98.10.175]:59921: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.192.214.80
country_id: 1733045
description:
[2026-06-15 17:30:26 +0000] info [cpaneld] 14.192.214.80 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.212.194.10
country_id: 690791
description:
[2026-06-15 17:30:49 +0000] info [whostmgrd] 91.212.194.10 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.250.32.193
country_id: 6252001
description:
[2026-06-15 17:30:55 +0000] info [whostmgrd] 24.250.32.193 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.151.186.162
country_id: 2017370
description:
[2026-06-15 17:30:47 +0000] info [cpaneld] 89.151.186.162 - mafis "GET /login/?login_only=1&user=mafis&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafis (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.233.210.196
country_id: 1562822
description:
[2026-06-15 17:30:37 +0000] info [cpaneld] 14.233.210.196 - mafiste "GET /login/?login_only=1&user=mafiste&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafiste (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:30:47 dovecot_login authenticator failed for H=(UjgU5h) [141.98.10.175]:60668: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.179.13.241
country_id: 2802361
description:
[2026-06-15 17:30:53 +0000] info [cpaneld] 91.179.13.241 - maf "GET /login/?login_only=1&user=maf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maf (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.1.224.77
country_id: 3865483
description:
Jun 15 17:31:18 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.1.224.77 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.178.89.31
country_id: 3703430
description:
[2026-06-15 17:30:34 +0000] info [cpaneld] 181.178.89.31 - mafistee "GET /login/?login_only=1&user=mafistee&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafistee (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:30:45 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.236.92.139
country_id: 298795
description:
[2026-06-15 17:30:55 +0000] info [cpaneld] 176.236.92.139 - ma "GET /login/?login_only=1&user=ma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ma (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:31:49 dovecot_login authenticator failed for H=(TNzCHNp1) [141.98.10.175]:59427: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.1.224.77
country_id: 3865483
description:
Jun 15 17:31:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.1.224.77 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.214.27.243
country_id: 630336
description:
[2026-06-15 17:31:42 +0000] info [cpaneld] 37.214.27.243 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Marshall_Alexander (has_cpuser_file failed)


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: clients.cloud-et-racks.tg
description:


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:31:47 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.48
country_id: 6252001
description:
205.169.39.48 - - [15/Jun/2026:17:31:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184550&pdata=http%253A%252F%252Fvitrinenews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781544714 HTTP/1.1" 302 0 vitrinenews.tg "http://vitrinenews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.48


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.222.140.65
country_id: 3374766
description:
[2026-06-15 17:31:41 +0000] info [cpaneld] 102.222.140.65 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Marshall_Alexander (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.99.121.244
country_id: 290557
description:
[2026-06-15 17:33:06 +0000] info [whostmgrd] 86.99.121.244 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.61.245.9
country_id: 3686110
description:
[2026-06-15 17:32:32 +0000] info [cpaneld] 181.61.245.9 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Marshall_Alexander (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.223.68.64
country_id: 2510769
description:
2026-06-15 17:33:10 dovecot_plain authenticator failed for H=(0qzg5udwgd6up4p4udj100kbonscegd) [82.223.68.64]:43922: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:32:20 dovecot_login authenticator failed for H=(0Nnacz8) [141.98.10.175]:60056: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:32:50 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:33:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.213.216.26
country_id: 1643084
description:
[2026-06-15 17:34:14 +0000] info [whostmgrd] 140.213.216.26 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:33:25 dovecot_login authenticator failed for H=(m8MuhNM) [141.98.10.175]:64115: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.207.57.54
country_id: 1269750
domain: centif.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:86703.centif.tg||ServerName:centif.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8161a96c3d46c11220f386e6333cd800f2c246f3||Title:0xe36384a0||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.231.216
country_id: 1880251
description:
2026-06-15 17:34:07 dovecot_plain authenticator failed for H=yoursbros.com (65vp6ikg7a9g4uuqvkjue) [188.166.231.216]:60838: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:34:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:34:25 dovecot_login authenticator failed for H=(C1FxjP3c0W) [141.98.10.175]:63742: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.61.202.22
country_id: 2510769
description:
Jun 15 17:34:41 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.61.202.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.83.28.29
country_id: 2750405
description:
Jun 15 17:35:14 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.83.28.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.83.28.29
country_id: 2750405
description:
2026-06-15 17:35:16 dovecot_login authenticator failed for H=(ADMIN) [45.83.28.29]:60092: 535 Incorrect authentication data (set_id=sumsda1968@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:35:30 dovecot_login authenticator failed for H=(BKQ6zmEAIl) [141.98.10.175]:64315: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.155.83.225
country_id: 3469034
description:
[2026-06-15 17:36:08 +0000] info [cpaneld] 177.155.83.225 - horizonmedica "GET /login/?login_only=1&user=horizonmedica&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizonmedica (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.115.211.121
country_id: 3923057
description:
[2026-06-15 17:36:11 +0000] info [cpaneld] 181.115.211.121 - horizonmedic "GET /login/?login_only=1&user=horizonmedic&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizonmedic (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:35:28 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.181.156.110
country_id: 1562822
description:
[2026-06-15 17:36:14 +0000] info [cpaneld] 14.181.156.110 - horizonmedi "GET /login/?login_only=1&user=horizonmedi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizonmedi (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:36:21 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.101.87.175
country_id: 2589581
description:
[2026-06-15 17:36:40 +0000] info [cpaneld] 105.101.87.175 - hori "GET /login/?login_only=1&user=hori&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hori (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.22.68.213
country_id: 1835841
description:
2026-06-15 17:37:01 dovecot_login authenticator failed for H=([91.194.213.187]) [59.22.68.213]:37567: 535 Incorrect authentication data (set_id=contact@cameg-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.83.28.29
country_id: 2750405
description:
Jun 15 17:37:08 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.83.28.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:36:23 dovecot_login authenticator failed for H=(waJVKX) [141.98.10.175]:58419: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.219.161.62
country_id: 3865483
description:
[2026-06-15 17:36:25 +0000] info [cpaneld] 201.219.161.62 - horizonm "GET /login/?login_only=1&user=horizonm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizonm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.186.211.122
country_id: 3625428
description:
[2026-06-15 17:36:38 +0000] info [cpaneld] 45.186.211.122 - horiz "GET /login/?login_only=1&user=horiz&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horiz (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.203.208.35
country_id: 6252001
description:
[2026-06-15 17:37:09 +0000] info [whostmgrd] 71.203.208.35 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.83.28.29
country_id: 2750405
description:
2026-06-15 17:37:10 dovecot_login authenticator failed for H=(ADMIN) [45.83.28.29]:34296: 535 Incorrect authentication data (set_id=sumsda1968@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 83.106.29.181
country_id: 2635167
description:
[2026-06-15 17:37:19 +0000] info [whostmgrd] 83.106.29.181 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.120.54.174
country_id: 357994
description:
[2026-06-15 17:36:30 +0000] info [whostmgrd] 197.120.54.174 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.66.203.89
country_id: 2921044
description:
[2026-06-15 17:36:30 +0000] info [whostmgrd] 91.66.203.89 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.174.149.86
country_id: 3865483
description:
[2026-06-15 17:36:33 +0000] info [cpaneld] 45.174.149.86 - horizo "GET /login/?login_only=1&user=horizo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizo (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:37:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:37:25 dovecot_login authenticator failed for H=(BVhUcZ) [141.98.10.175]:56199: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.39.178
country_id: 1861060
description:
2026-06-15 17:37:32 dovecot_login authenticator failed for H=([125.19.162.102]) [138.199.39.178]:45925: 535 Incorrect authentication data (set_id=no-reply@anrtogo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.94.211
country_id: 3865483
description:
Jun 15 17:37:38 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.94.211 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.83.146.53
country_id: 6252001
description:
[2026-06-15 17:37:53 +0000] info [whostmgrd] 68.83.146.53 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.6.214.109
country_id: 3469034
description:
[2026-06-15 17:37:37 +0000] info [whostmgrd] 189.6.214.109 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:38:42 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.242.189.156
country_id: 1269750
description:
[2026-06-15 17:39:01 +0000] info [whostmgrd] 103.242.189.156 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:38:21 dovecot_login authenticator failed for H=(Q8bE6d0Q) [141.98.10.175]:52474: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.83.28.29
country_id: 2750405
description:
2026-06-15 17:39:22 dovecot_login authenticator failed for H=(ADMIN) [45.83.28.29]:49734: 535 Incorrect authentication data (set_id=sumsda1968@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:39:43 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:17:40:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935722&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781545206 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.83.28.29
country_id: 2750405
description:
Jun 15 17:39:20 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.83.28.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:39:45 dovecot_login authenticator failed for H=(P6HZJLkjbm) [141.98.10.175]:53451: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 148.135.144.144
country_id: 6252001
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:148.135.144.144||TA:148.135.144.144||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 189.203.145.150
country_id: 3996063
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0cec59ab39fdd59456461deeff8a20cf27c5be2a||Title:0nu0mw6oqx7qa9u||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 20.104.244.165
country_id: 6251999
domain: www.cciatv.tg
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:8.17||T:APACHE||MV:/wp-admin/includes/index.php||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 161.123.131.192
country_id: 357994
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:161.123.131.192||TA:161.123.131.192||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:17:40:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6908356&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781545209 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:17:40:33 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:17:40:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:17:40:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:40:46 dovecot_login authenticator failed for H=(saYoBh) [141.98.10.175]:51241: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.245.157.37
country_id: 6252001
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:172.245.157.37||TA:172.245.157.37||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:17:40:35 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:40:44 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 151.253.243.193
country_id: 290557
description:
[2026-06-15 17:41:08 +0000] info [whostmgrd] 151.253.243.193 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:41:38 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:41:40 dovecot_login authenticator failed for H=(vRCc89jD) [141.98.10.175]:63723: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.83.28.29
country_id: 2750405
description:
Jun 15 17:42:54 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.83.28.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:42:41 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:42:43 dovecot_login authenticator failed for H=(nWzTwca) [141.98.10.175]:60134: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: cloud-et-racks.tg
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.83.28.29
country_id: 2750405
description:
2026-06-15 17:42:56 dovecot_login authenticator failed for H=(ADMIN) [45.83.28.29]:40870: 535 Incorrect authentication data (set_id=sumsda1968@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:43:37 dovecot_login authenticator failed for H=(owruVINEe) [141.98.10.175]:55924: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.232.193.182
country_id: 3865483
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/events/3 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:43:35 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.10.229.41
country_id: 1643084
description:
[2026-06-15 17:43:41 +0000] info [whostmgrd] 182.10.229.41 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.83.4.64
country_id: 3017382
description:
[2026-06-15 17:44:25 +0000] info [cpaneld] 51.83.4.64 - cafeitadm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 116.100.198.254
country_id: 1562822
description:
116.100.198.254 - - [15/Jun/2026:17:44:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920593&pdata=https%253A%252F%252Ftogodailynews.tg%252Fgrand-tour-de-lome-2022-un-pari-gagne-pour-une-1ere-edition-sublime%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781545480 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/grand-tour-de-lome-2022-un-pari-gagne-pour-une-1ere-edition-sublime/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.6156.1611 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:116.100.198.254


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.181.193.174
country_id: 3175395
description:
[2026-06-15 17:45:07 +0000] info [cpaneld] 37.181.193.174 - ek "GET /login/?login_only=1&user=ek&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ek (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.71.42.178
country_id: 3469034
description:
[2026-06-15 17:44:55 +0000] info [cpaneld] 45.71.42.178 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.46.112.34
country_id: 3865483
description:
[2026-06-15 17:45:03 +0000] info [cpaneld] 181.46.112.34 - eke "GET /login/?login_only=1&user=eke&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eke (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:44:30 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:44:32 dovecot_login authenticator failed for H=(0ZaR4Ppr) [141.98.10.175]:51069: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.7.246.189
country_id: 1605651
description:
[2026-06-15 17:44:39 +0000] info [cpaneld] 171.7.246.189 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:45:27 dovecot_login authenticator failed for H=(PhvPAZ) [141.98.10.175]:61849: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.90.83.203
country_id: 3686110
description:
[2026-06-15 17:45:31 +0000] info [cpaneld] 190.90.83.203 - rela "GET /login/?login_only=1&user=rela&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rela (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.65.123.250
country_id: 2542007
description:
[2026-06-15 17:45:31 +0000] info [cpaneld] 196.65.123.250 - ekinam "GET /login/?login_only=1&user=ekinam&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekinam (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.9.34.198
country_id: 1643084
description:
[2026-06-15 17:45:40 +0000] info [cpaneld] 182.9.34.198 - ekin "GET /login/?login_only=1&user=ekin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 118.239.8.129
country_id: 1814991
description:
[2026-06-15 17:45:54 +0000] info [whostmgrd] 118.239.8.129 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.158.120.27
country_id: 3865483
description:
[2026-06-15 17:46:14 +0000] info [whostmgrd] 186.158.120.27 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:45:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.97.56.170
country_id: 290557
description:
[2026-06-15 17:45:28 +0000] info [cpaneld] 86.97.56.170 - ekinama "GET /login/?login_only=1&user=ekinama&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekinama (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.22.174.36
country_id: 3469034
description:
[2026-06-15 17:45:35 +0000] info [cpaneld] 177.22.174.36 - ekina "GET /login/?login_only=1&user=ekina&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekina (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.36.234.156
country_id: 1835841
description:
Jun 15 17:45:43 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.36.234.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.36.234.156
country_id: 1835841
description:
2026-06-15 17:45:45 dovecot_login authenticator failed for H=([118.36.234.156]) [118.36.234.156]:51974: 535 Incorrect authentication data (set_id=hr@white-ways.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.34.192.193
country_id: 1522867
description:
[2026-06-15 17:45:44 +0000] info [cpaneld] 46.34.192.193 - eki "GET /login/?login_only=1&user=eki&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eki (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.164.128.231
country_id: 192950
description:
[2026-06-15 17:45:56 +0000] info [whostmgrd] 105.164.128.231 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.83.28.29
country_id: 2750405
description:
2026-06-15 17:46:27 dovecot_login authenticator failed for H=(ADMIN) [45.83.28.29]:59784: 535 Incorrect authentication data (set_id=sumsda1968@cafe.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.234.72.148
country_id: 3469034
description:
45.234.72.148 - - [15/Jun/2026:17:46:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9727849&pdata=https%253A%252F%252Ftogodailynews.tg%252Ffetes-de-paques-lassociation-tao-offre-des-kits-alimentaires-aux-orphelins-de-gbatope%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781545615 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/fetes-de-paques-lassociation-tao-offre-des-kits-alimentaires-aux-orphelins-de-gbatope/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.4722.1228 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.234.72.148


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.190.134
country_id: 1269750
description:
2026-06-15 17:47:17 dovecot_login authenticator failed for H=([60.214.127.246]) [182.95.190.134]:50538: 535 Incorrect authentication data (set_id=no-reply@cameg-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:46:20 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.83.28.29
country_id: 2750405
description:
Jun 15 17:46:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.83.28.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:46:22 dovecot_login authenticator failed for H=(B9qDF0F6mf) [141.98.10.175]:56392: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.190.134
country_id: 1269750
description:
Jun 15 17:47:15 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.190.134 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.21.78.252
country_id: 1269750
description:
[2026-06-15 17:48:12 +0000] info [whostmgrd] 103.21.78.252 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 222.83.252.34
country_id: 1814991
domain: www.togosem.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:17-47.222.83.252.34||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:47:35 dovecot_login authenticator failed for H=(NpHBZRjM2H) [141.98.10.175]:56629: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:47:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:48:39 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:48:41 dovecot_login authenticator failed for H=(i7pLTMB7j8) [141.98.10.175]:56180: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:49:40 dovecot_login authenticator failed for H=(pNMAN6BhP) [141.98.10.175]:53750: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.209.162
country_id: 1269750
description:
Jun 15 17:50:16 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.209.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.83.28.29
country_id: 2750405
description:
2026-06-15 17:49:47 dovecot_login authenticator failed for H=(ADMIN) [45.83.28.29]:46686: 535 Incorrect authentication data (set_id=sumsda1968@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.209.162
country_id: 1269750
description:
2026-06-15 17:50:18 dovecot_login authenticator failed for H=(109-69-15-132.puntdacces.coop) [128.185.209.162]:33580: 535 Incorrect authentication data (set_id=dasha9198@atms.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:49:38 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.83.28.29
country_id: 2750405
description:
Jun 15 17:49:45 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.83.28.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:50:34 dovecot_login authenticator failed for H=(4Z7LrrF1) [141.98.10.175]:49823: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:51:30 dovecot_login authenticator failed for H=(vKDtFZhmL) [141.98.10.175]:62692: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:52:35 dovecot_login authenticator failed for H=(EMLVwx3N1Y) [141.98.10.175]:60001: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.83.28.29
country_id: 2750405
description:
Jun 15 17:53:14 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.83.28.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.83.28.29
country_id: 2750405
description:
2026-06-15 17:53:16 dovecot_login authenticator failed for H=(ADMIN) [45.83.28.29]:37214: 535 Incorrect authentication data (set_id=sumsda1968@cafe.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:17:53:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:53:40 dovecot_login authenticator failed for H=(qPASqUpWD) [141.98.10.175]:56797: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:17:53:50 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:17:53:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:17:53:54 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.15
country_id: 6252001
description:
205.169.39.15 - - [15/Jun/2026:17:55:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6856603&pdata=http%253A%252F%252Fsodigaz.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781546109 HTTP/1.1" 302 0 sodigaz.tg "http://sodigaz.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.15


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:17:54:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9596828&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781546069 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:54:34 dovecot_login authenticator failed for H=(bJaPDzy4j) [141.98.10.175]:51202: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 222.83.252.34
country_id: 1814991
domain: emt.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:17-55.222.83.252.34||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:17:54:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10327447&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781546068 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:55:31 dovecot_login authenticator failed for H=(aTkPFOngL) [141.98.10.175]:62666: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:55:29 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account adiel has been locked for the attacker IP 141.98.10.175


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.84.105.124
country_id: 6252001
description:
[2026-06-15 17:55:37 +0000] info [whostmgrd] 68.84.105.124 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.198.98
country_id: 1819730
description:
2026-06-15 17:56:34 dovecot_login authenticator failed for H=(203-75-170-63.hinet-ip.hinet.net) [121.202.198.98]:49251: 535 Incorrect authentication data (set_id=dasha9198@atms.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.198.98
country_id: 1819730
description:
Jun 15 17:56:32 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.198.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.83.28.29
country_id: 2750405
description:
2026-06-15 17:56:37 dovecot_login authenticator failed for H=(ADMIN) [45.83.28.29]:51962: 535 Incorrect authentication data (set_id=sumsda1968@cafe.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.47.139.217
country_id: 3469034
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/peat-togo-leau-doit-couler-peu-importe-le-sacrifice/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.83.28.29
country_id: 2750405
description:
Jun 15 17:56:35 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.83.28.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.153
country_id: 3469034
description:
Jun 15 17:56:40 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:56:32 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account adiel has been locked for the attacker IP 141.98.10.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:56:34 dovecot_login authenticator failed for H=(27DPpM) [141.98.10.175]:59240: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.47.139.217
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/peat-togo-leau-doit-couler-peu-importe-le-sacrifice/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 173.239.236.1
country_id: 1733045
description:
Jun 15 17:57:27 ns5 pure-ftpd[205057]: (?@173.239.236.1) [WARNING] Authentication failed for user [whmcsadmin]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:57:33 dovecot_login authenticator failed for H=(AZokya49) [141.98.10.175]:52826: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.51.212.130
country_id: 3469034
description:
Jun 15 17:58:00 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.51.212.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.3
country_id: 1814991
description:
Jun 15 17:58:17 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:57:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account adiel has been locked for the attacker IP 141.98.10.175


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.241.157.226
country_id: 6252001
description:
Jun 15 17:57:50 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.241.157.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.241.157.226
country_id: 6252001
description:
2026-06-15 17:57:52 dovecot_plain authenticator failed for H=(jy6g18fgozovsazede4l) [192.241.157.226]:56780: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.87.70
country_id: 1814991
description:
Jun 15 17:58:00 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.87.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.8.73.174
country_id: 1814991
description:
Jun 15 17:58:00 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.8.73.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.182.5.98
country_id: 3469034
description:
2026-06-15 17:58:05 dovecot_login authenticator failed for H=([210.204.63.182]) [45.182.5.98]:55390: 535 Incorrect authentication data (set_id=sales@cameg-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.12
country_id: 1269750
description:
Jun 15 17:58:00 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.73.190.98
country_id: 1835841
description:
Jun 15 17:58:08 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.73.190.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.51.212.130
country_id: 3469034
description:
Jun 15 17:58:34 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.51.212.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:58:44 dovecot_login authenticator failed for H=(xwK1IkcJE) [141.98.10.175]:64983: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.189.239.206
country_id: 1814991
description:
Jun 15 17:58:57 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.189.239.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.87.70
country_id: 1814991
description:
Jun 15 17:58:24 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.87.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:58:42 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account adiel has been locked for the attacker IP 141.98.10.175


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.235
country_id: 1269750
description:
Jun 15 17:58:57 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.165.172.38
country_id: 1835841
description:
Jun 15 17:59:06 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.165.172.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.223.254.202
country_id: 1814991
description:
Jun 15 17:58:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.223.254.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.187
country_id: 1814991
description:
Jun 15 17:58:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.175.118
country_id: 1814991
description:
Jun 15 17:58:40 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.175.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.198.128.124
country_id: 1835841
description:
Jun 15 17:58:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.198.128.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.246.68.220
country_id: 1835841
description:
Jun 15 17:59:57 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.246.68.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.190
country_id: 1814991
description:
Jun 15 17:59:54 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.146.144
country_id: 1819730
description:
Jun 15 17:59:28 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.146.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.83.28.29
country_id: 2750405
description:
2026-06-15 18:00:02 dovecot_login authenticator failed for H=(ADMIN) [45.83.28.29]:40636: 535 Incorrect authentication data (set_id=sumsda1968@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.84.165.242
country_id: 3469034
description:
Jun 15 17:59:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.84.165.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.83.28.29
country_id: 2750405
description:
Jun 15 18:00:00 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.83.28.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.165.172.38
country_id: 1835841
description:
Jun 15 17:59:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.165.172.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 17:59:43 dovecot_login authenticator failed for H=(sXw8lGQEd) [141.98.10.175]:58979: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.189
country_id: 1814991
description:
Jun 15 17:59:57 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.214.127.246
country_id: 1814991
description:
Jun 15 17:59:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.214.127.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.104
country_id: 1269750
description:
Jun 15 17:59:39 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 17:59:41 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account adiel has been locked for the attacker IP 141.98.10.175


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 36.110.131.180
country_id: 1814991
domain: direct7.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/148.0.7778.96 Safari/537.36||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.187
country_id: 1269750
description:
Jun 15 18:01:02 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:00:49 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.239.41.102
country_id: 3469034
description:
Jun 15 18:00:28 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.239.41.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:00:51 dovecot_login authenticator failed for H=(apDrXxLt) [141.98.10.175]:54614: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.37.203.28
country_id: 1831722
description:
Jun 15 18:00:20 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.37.203.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:01:23 dovecot_login authenticator failed for H=(nBriumsFNy) [141.98.10.175]:60931: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.8.246.27
country_id: 2017370
description:
Jun 15 18:01:34 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.8.246.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.246.27
country_id: 2017370
description:
2026-06-15 18:01:36 dovecot_login authenticator failed for H=([184.170.249.69]) [46.8.246.27]:56318: 535 Incorrect authentication data (set_id=elogdoyoih@otr.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:01:21 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 91.132.125.130
country_id: 6252001
description:
91.132.125.130 - - [15/Jun/2026:18:02:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12939118&pdata=https%253A%252F%252Fcafe.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781546576 HTTP/2.0" 302 0 cafe.tg "https://cafe.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:91.132.125.130


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 66.245.221.41
country_id: 1861060
domain: autodiscover.sotranetogo.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.17||T:APACHE||MV:/wp-content/uploads/index.php||SC:proxy:http://127.0.0.1/cgi-sys/autodiscover.cgi||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:02:49 dovecot_login authenticator failed for H=(DkoZmLK7s) [141.98.10.175]:62692: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:02:47 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.83.28.29
country_id: 2750405
description:
2026-06-15 18:03:28 dovecot_login authenticator failed for H=(ADMIN) [45.83.28.29]:57552: 535 Incorrect authentication data (set_id=sumsda1968@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 117.154.251.196
country_id: 1814991
description:
[2026-06-15 18:03:39 +0000] info [whostmgrd] 117.154.251.196 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:03:37 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 162.252.52.46
country_id: 6252001
description:
162.252.52.46 - - [15/Jun/2026:18:04:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6789989&pdata=https%253A%252F%252Fcafe.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781546641 HTTP/2.0" 302 0 cafe.tg "https://cafe.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:162.252.52.46


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 135.119.27.130
country_id: 6252001
domain: kpmg.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.17||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/kpmg/public_html/wp-content/uploads||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:03:39 dovecot_login authenticator failed for H=(lcdRm7wEAE) [141.98.10.175]:56823: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.98.129.83
country_id: 290557
description:
[2026-06-15 18:03:23 +0000] info [whostmgrd] 92.98.129.83 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.83.28.29
country_id: 2750405
description:
Jun 15 18:03:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.83.28.29 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.147.8.26
country_id: 6252001
description:
45.147.8.26 - - [15/Jun/2026:18:04:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6800069&pdata=https%253A%252F%252Fcafe.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781546678 HTTP/2.0" 302 0 cafe.tg "https://cafe.tg/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.147.8.26


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-15 18:05:00 +0000] info [webmaild] 160.242.195.10 - kahare@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:04:39 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:04:41 dovecot_login authenticator failed for H=(hvXOWCp) [141.98.10.175]:53713: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.165.182.9
country_id: 6252001
description:
2026-06-15 18:04:57 dovecot_plain authenticator failed for H=c-67-165-182-9.hsd1.il.comcast.net (px1q8696xvnfrqnm5le6e) [67.165.182.9]:47489: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 104.43.48.106
country_id: 1880251
domain: c2ie.tg
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.242.194
country_id: 3469034
description:
2026-06-15 18:05:24 dovecot_login authenticator failed for H=([121.172.104.204]) [186.238.242.194]:60925: 535 Incorrect authentication data (set_id=dasha9198@atms.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:05:54 dovecot_login authenticator failed for H=(8CNdYHFUV) [141.98.10.175]:62731: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:05:52 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.165.18.241
country_id: 1814991
description:
Jun 15 18:06:07 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.165.18.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.165.18.241
country_id: 1814991
description:
2026-06-15 18:06:09 dovecot_login authenticator failed for H=([142.54.225.52]) [180.165.18.241]:59386: 535 Incorrect authentication data (set_id=dasha9198)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.238.242.194
country_id: 3469034
description:
Jun 15 18:05:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.238.242.194 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:18:07:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:18:07:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:06:25 dovecot_login authenticator failed for H=(JWaqUUD) [141.98.10.175]:60542: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.83.28.29
country_id: 2750405
description:
Jun 15 18:06:50 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.83.28.29 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.142.137.161
country_id: 2542007
description:
[2026-06-15 18:06:56 +0000] info [whostmgrd] 41.142.137.161 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:06:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:18:07:05 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:18:07:07 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.83.28.29
country_id: 2750405
description:
2026-06-15 18:06:52 dovecot_login authenticator failed for H=(ADMIN) [45.83.28.29]:42730: 535 Incorrect authentication data (set_id=sumsda1968@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:07:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:07:24 dovecot_login authenticator failed for H=(fLQwn0zA) [141.98.10.175]:64506: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:08:47 dovecot_login authenticator failed for H=(2IILluP5pN) [141.98.10.175]:57096: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.177.200.96
country_id: 298795
description:
[2026-06-15 18:08:35 +0000] info [whostmgrd] 78.177.200.96 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 36.83.136.191
country_id: 1643084
description:
[2026-06-15 18:09:10 +0000] info [whostmgrd] 36.83.136.191 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:08:45 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:18:09:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6777962&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781546980 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:09:47 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:18:09:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7194726&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781546981 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:09:49 dovecot_login authenticator failed for H=(NDYXikzKU) [141.98.10.175]:52693: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:10:47 dovecot_login authenticator failed for H=(lZ42OP) [141.98.10.175]:53591: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:10:45 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.164.205.181
country_id: 3865483
domain: www.tdn.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.tdn.tg/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:11:49 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:11:51 dovecot_login authenticator failed for H=(T0VOH8h) [141.98.10.175]:52311: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:12:21 dovecot_login authenticator failed for H=(XMhi6qO) [141.98.10.175]:61812: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-15 18:12:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:3090: 535 Incorrect authentication data (set_id=rebels@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:12:54 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.32.88
country_id: 298795
description:
Jun 15 18:13:11 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.32.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 18:12:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:50196: 535 Incorrect authentication data (set_id=yc@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 18:12:49 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:13:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:13:25 dovecot_login authenticator failed for H=(FA7uMhL) [141.98.10.175]:56064: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.32.88
country_id: 298795
description:
Jun 15 18:13:24 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.32.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:14:43 dovecot_login authenticator failed for H=(xSLvN3w) [141.98.10.175]:57399: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:14:41 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:15:32 dovecot_login authenticator failed for H=(GGnPYyQ91) [141.98.10.175]:54286: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:15:30 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:16:27 dovecot_login authenticator failed for H=(4X6buvvps) [141.98.10.175]:53137: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:16:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:17:21 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:17:23 dovecot_login authenticator failed for H=(jqQFRvk) [141.98.10.175]:54051: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:18:49 dovecot_login authenticator failed for H=(iMY8i8p) [141.98.10.175]:59005: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.174.19.53
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/de-lombre-a-la-lumiere-les-femmes-togolaises-saffirment-grace-a-lenergie/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.174.19.53
country_id: 1562822
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/de-lombre-a-la-lumiere-les-femmes-togolaises-saffirment-grace-a-lenergie/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:18:47 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.63.234
country_id: 6252001
description:
2026-06-15 18:19:02 dovecot_plain authenticator failed for H=c-73-137-63-234.hsd1.ga.comcast.net (onptne8v6ob9un6ixd2mbu9) [73.137.63.234]:54578: 535 Incorrect authentication data (set_id=mointie.konlambigue@emt.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.163.98
country_id: 1880251
description:
[2026-06-15 18:19:39 +0000] info [whostmgrd] 104.28.163.98 - anadebfreenetmas "POST /login/ HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:19:41 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:19:43 dovecot_login authenticator failed for H=(rJfBvMY) [141.98.10.175]:53921: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.240.102.68
country_id: 6252001
description:
Jun 15 18:20:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 162.240.102.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:20:41 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:20:43 dovecot_login authenticator failed for H=(T5GZun1lEs) [141.98.10.175]:55379: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 41.207.188.29
country_id: 2363686
description:
41.207.188.29 - - [15/Jun/2026:18:21:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9858714&pdata=https%253A%252F%252Flaunetogo.tg%252Fstrategie-de-transformation-la-banque-mondiale-et-les-ptf-derriere-la-vision-du-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781547673 HTTP/2.0" 302 0 launetogo.tg "https://launetogo.tg/strategie-de-transformation-la-banque-mondiale-et-les-ptf-derriere-la-vision-du-togo/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:41.207.188.29


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.240.102.68
country_id: 6252001
description:
2026-06-15 18:20:35 dovecot_login authenticator failed for H=(vps-13116434.franquiaadonairh.com) [162.240.102.68]:55638: 535 Incorrect authentication data (set_id=aime.d@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:21:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 93.177.94.230
country_id: 6252001
description:
93.177.94.230 - - [15/Jun/2026:18:21:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9921131&pdata=https%253A%252F%252Fcafe.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781547708 HTTP/2.0" 302 0 cafe.tg "https://cafe.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:93.177.94.230


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 37.63.16.68
country_id: 732800
domain: togomedia24.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:18-21.37.63.16.68||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 3.80.216.18
country_id: 6252001
description:
[2026-06-15 18:22:15 +0000] info [cpaneld] 3.80.216.18 - arsetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:21:35 dovecot_login authenticator failed for H=(LfgGuJqH) [141.98.10.175]:55879: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:18:22:18 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:18:22:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:22:28 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:22:30 dovecot_login authenticator failed for H=(FMyGjcR) [141.98.10.175]:54004: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.97.108
country_id: 1814991
description:
Jun 15 18:23:17 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.97.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.97.108
country_id: 1814991
description:
2026-06-15 18:23:19 dovecot_login authenticator failed for H=([111.61.97.108]) [111.61.97.108]:17220: 535 Incorrect authentication data (set_id=media@soena.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:23:24 dovecot_login authenticator failed for H=(5bKCctUi) [141.98.10.175]:55803: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77093094
abuser: 100.52.195.126
country_id: 6252001
domain: www.en.crepsad.tg
description:


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:23:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:24:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:24:33 dovecot_login authenticator failed for H=(xKcjsQFmW) [141.98.10.175]:62369: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:25:36 dovecot_login authenticator failed for H=(2kMrXy) [141.98.10.175]:61195: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:25:34 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:18:25:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9594729&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781547934 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:26:30 dovecot_login authenticator failed for H=(3tkWg76GPb) [141.98.10.175]:53531: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.60
country_id: 2017370
description:
Jun 15 18:26:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.60
country_id: 2017370
description:
2026-06-15 18:26:33 dovecot_login authenticator failed for H=([94.16.17.139]) [178.178.222.60]:39180: 535 Incorrect authentication data (set_id=hr@anrtogo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:26:28 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.208.204.132
country_id: 1643084
description:
[2026-06-15 18:26:59 +0000] info [cpaneld] 103.208.204.132 - esso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esso (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.135
country_id: 2635167
description:
[2026-06-15 18:27:15 +0000] info [cpaneld] 5.230.133.135 NEW wcnyaruu:ul9nYcXf_FuuWuon address=5.230.133.135,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.87.216.144
country_id: 6252001
description:
212.87.216.144 - - [15/Jun/2026:18:27:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10250695&pdata=https%253A%252F%252Fcafe.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781548043 HTTP/2.0" 302 0 cafe.tg "https://cafe.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.87.216.144


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:27:27 dovecot_login authenticator failed for H=(aRIEXU3) [141.98.10.175]:55713: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.103.121.241
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:18-28.146.103.121.241||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:27:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:28:19 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:28:21 dovecot_login authenticator failed for H=(WKXnGT0w) [141.98.10.175]:50262: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:29:21 dovecot_login authenticator failed for H=(d1jCZEmguL) [141.98.10.175]:61442: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:29:48 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:30:50 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:30:52 dovecot_login authenticator failed for H=(NiFsm8G) [141.98.10.175]:57688: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:31:45 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:31:47 dovecot_login authenticator failed for H=(yVS36Qusg) [141.98.10.175]:56063: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77093094
abuser: 100.52.195.126
country_id: 6252001
domain: www.enora.sodigaz.tg
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:32:34 dovecot_login authenticator failed for H=(VC1OqEkpw) [141.98.10.175]:52453: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.103.121.241
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:18-32.146.103.121.241||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:32:32 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.7.100.82
country_id: 298795
description:
[2026-06-15 18:33:45 +0000] info [cpaneld] 95.7.100.82 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.231.127.179
country_id: 294640
description:
[2026-06-15 18:34:07 +0000] info [cpaneld] 176.231.127.179 - davakconsul "GET /login/?login_only=1&user=davakconsul&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davakconsul (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 121.122.95.63
country_id: 1733045
description:
[2026-06-15 18:34:01 +0000] info [cpaneld] 121.122.95.63 - davakconsult "GET /login/?login_only=1&user=davakconsult&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davakconsult (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.87.200.138
country_id: 953987
description:
[2026-06-15 18:34:12 +0000] info [cpaneld] 41.87.200.138 - davakconsu "GET /login/?login_only=1&user=davakconsu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davakconsu (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:33:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.172.92.172
country_id: 2750405
description:
[2026-06-15 18:33:58 +0000] info [cpaneld] 109.172.92.172 - davakconsulti "GET /login/?login_only=1&user=davakconsulti&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davakconsulti (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:33:33 dovecot_login authenticator failed for H=(LNUe3Clk) [141.98.10.175]:65280: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.67.27.217
country_id: 3932488
description:
[2026-06-15 18:33:49 +0000] info [cpaneld] 181.67.27.217 - davakconsulting "GET /login/?login_only=1&user=davakconsulting&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davakconsulting (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.172.68.247
country_id: 3017382
description:
[2026-06-15 18:34:42 +0000] info [cpaneld] 176.172.68.247 - dav "GET /login/?login_only=1&user=dav&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dav (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.244.193.87
country_id: 3508796
description:
[2026-06-15 18:34:30 +0000] info [cpaneld] 74.244.193.87 - davakc "GET /login/?login_only=1&user=davakc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davakc (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:34:28 dovecot_login authenticator failed for H=(7XaRvgQ) [141.98.10.175]:59363: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.189.217.84
country_id: 3865483
description:
[2026-06-15 18:34:26 +0000] info [cpaneld] 45.189.217.84 - davakco "GET /login/?login_only=1&user=davakco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davakco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.85.252.104
country_id: 3469034
description:
[2026-06-15 18:34:35 +0000] info [cpaneld] 177.85.252.104 - davak "GET /login/?login_only=1&user=davak&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davak (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.185.159.52
country_id: 953987
description:
[2026-06-15 18:34:40 +0000] info [cpaneld] 197.185.159.52 - dava "GET /login/?login_only=1&user=dava&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dava (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.29.220.48
country_id: 6252001
description:
Jun 15 18:34:41 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.29.220.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:34:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.29.220.48
country_id: 6252001
description:
2026-06-15 18:34:43 dovecot_plain authenticator failed for H=pool-108-29-220-48.nycmny.fios.verizon.net (7w99gwdvpmeef3gbuj3zp7f84c) [108.29.220.48]:40523: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.163.213.174
country_id: 1562822
description:
[2026-06-15 18:34:48 +0000] info [cpaneld] 14.163.213.174 - da "GET /login/?login_only=1&user=da&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user da (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.63.26.191
country_id: 3686110
description:
[2026-06-15 18:34:21 +0000] info [cpaneld] 181.63.26.191 - davakcon "GET /login/?login_only=1&user=davakcon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davakcon (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:35:35 dovecot_login authenticator failed for H=(GQVDTPC) [141.98.10.175]:56279: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 3.80.216.18
country_id: 6252001
description:
[2026-06-15 18:35:35 +0000] info [cpaneld] 3.80.216.18 - arsetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.177.210.193
country_id: 3469034
description:
2026-06-15 18:36:13 dovecot_login authenticator failed for H=(ipmapt-72-195-101-102.oc.oc.cox.net) [45.177.210.193]:59655: 535 Incorrect authentication data (set_id=felix.barigao@arse.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.177.210.193
country_id: 3469034
description:
Jun 15 18:36:11 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.177.210.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:35:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:36:32 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:36:34 dovecot_login authenticator failed for H=(YpILHnz4) [141.98.10.175]:52972: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 38.156.230.18
country_id: 3686110
description:
38.156.230.18 - - [15/Jun/2026:18:37:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7038875&pdata=https%253A%252F%252Fcivilemagazine.tg%252Ftag%252Fsfi%252F%253Famp%253D1&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781548630 HTTP/2.0" 302 0 civilemagazine.tg "https://civilemagazine.tg/tag/sfi/?amp=1" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.7467.1356 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:38.156.230.18


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:37:38 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:18:37:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.126.241.209
country_id: 3437598
description:
[2026-06-15 18:37:56 +0000] info [cpaneld] 181.126.241.209 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.60.66.109
country_id: 3895114
description:
[2026-06-15 18:38:07 +0000] info [cpaneld] 179.60.66.109 - togomedia2 "GET /login/?login_only=1&user=togomedia2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomedia2 (has_cpuser_file failed)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:18:37:53 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.124.11.199
country_id: 3469034
description:
[2026-06-15 18:38:15 +0000] info [cpaneld] 177.124.11.199 - togomed "GET /login/?login_only=1&user=togomed&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomed (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.237.121.214
country_id: 99237
description:
[2026-06-15 18:38:02 +0000] info [cpaneld] 212.237.121.214 - togomedia24tg "GET /login/?login_only=1&user=togomedia24tg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomedia24tg (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:37:40 dovecot_login authenticator failed for H=(mSKWcq9) [141.98.10.175]:53247: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.26.30.63
country_id: 2017370
description:
[2026-06-15 18:38:10 +0000] info [cpaneld] 95.26.30.63 - togomedia "GET /login/?login_only=1&user=togomedia&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomedia (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.244.108.250
country_id: 2589581
description:
[2026-06-15 18:37:58 +0000] info [cpaneld] 154.244.108.250 - togomedia24 "GET /login/?login_only=1&user=togomedia24&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togomedia24 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.201.239.7
country_id: 99237
description:
[2026-06-15 18:38:23 +0000] info [cpaneld] 62.201.239.7 - togom "GET /login/?login_only=1&user=togom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.39.109.86
country_id: 3469034
description:
[2026-06-15 18:38:32 +0000] info [cpaneld] 189.39.109.86 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 131.0.207.242
country_id: 3469034
description:
[2026-06-15 18:38:37 +0000] info [cpaneld] 131.0.207.242 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:38:44 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:38:46 dovecot_login authenticator failed for H=(9dDcW3UJ34) [141.98.10.175]:62831: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:39:45 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:39:47 dovecot_login authenticator failed for H=(G91Wj0vsDr) [141.98.10.175]:63511: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:40:37 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:40:39 dovecot_login authenticator failed for H=(a8pHzVLXK) [141.98.10.175]:62284: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.241.106
country_id: 2750405
description:
Jun 15 18:40:53 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.241.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.241.106
country_id: 2750405
description:
2026-06-15 18:40:55 dovecot_login authenticator failed for H=server.fusionmail.shop (tQgYp4N6) [91.92.241.106]:60978: 535 Incorrect authentication data (set_id=africapanditogo)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 85.251.205.191
country_id: 2510769
description:
85.251.205.191 - - [15/Jun/2026:18:42:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7194055&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fremise-de-diplomes-iaec%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781548935 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/remise-de-diplomes-iaec/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.9223.1273 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:85.251.205.191


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:41:37 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.241.106
country_id: 2750405
description:
Jun 15 18:41:34 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.241.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.241.106
country_id: 2750405
description:
2026-06-15 18:41:36 dovecot_login authenticator failed for H=server.fusionmail.shop (RdLGQsUbDK) [91.92.241.106]:63717: 535 Incorrect authentication data (set_id=africapanditogo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:41:39 dovecot_login authenticator failed for H=(Sqeo3fpqv) [141.98.10.175]:59105: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:42:52 dovecot_login authenticator failed for H=(TRR0Jgb) [141.98.10.175]:56458: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.45.140
country_id: 2363686
description:
[2026-06-15 18:42:20 +0000] info [webmaild] 196.170.45.140 - wages@wages.tg "GET /cpsess7353698058/?=undefined&login=1&post_login=36253595934670 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.168.0.186] != Current IP Address [196.170.45.140]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:42:50 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.71.242.1
country_id: 285570
description:
[2026-06-15 18:43:44 +0000] info [cpaneld] 188.71.242.1 - jcdc "GET /login/?login_only=1&user=jcdc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user jcdc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.211.166.50
country_id: 3895114
description:
[2026-06-15 18:43:25 +0000] info [cpaneld] 190.211.166.50 - jcdconsul "GET /login/?login_only=1&user=jcdconsul&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user jcdconsul (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 3.80.216.18
country_id: 6252001
description:
[2026-06-15 18:44:06 +0000] info [cpaneld] 3.80.216.18 - stephane "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user stephane (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.45.140
country_id: 2363686
description:
[2026-06-15 18:44:13 +0000] info [webmaild] 196.170.45.140 - wages@wages.tg "GET /cpsess7353698058/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.168.0.186] != Current IP Address [196.170.45.140]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:43:21 dovecot_login authenticator failed for H=(iR6Kkd) [141.98.10.175]:61739: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.19.121.138
country_id: 2017370
description:
[2026-06-15 18:43:32 +0000] info [cpaneld] 195.19.121.138 - jcdcons "GET /login/?login_only=1&user=jcdcons&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user jcdcons (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:43:47 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.181.128.131
country_id: 3865483
description:
[2026-06-15 18:43:52 +0000] info [cpaneld] 45.181.128.131 - jc "GET /login/?login_only=1&user=jc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user jc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.117.164.61
country_id: 2510769
description:
[2026-06-15 18:43:27 +0000] info [cpaneld] 79.117.164.61 - jcdconsu "GET /login/?login_only=1&user=jcdconsu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user jcdconsu (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.0.186
country_id: 2363686
description:
[2026-06-15 18:44:13 +0000] info [webmaild] 196.168.0.186 - wages@wages.tg "GET /cpsess7353698058/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.150.146.81
country_id: 3469034
description:
[2026-06-15 18:43:49 +0000] info [cpaneld] 170.150.146.81 - jcd "GET /login/?login_only=1&user=jcd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user jcd (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:18:44:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13397401&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781549055 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 153.67.187.66
country_id: 3865483
description:
[2026-06-15 18:44:48 +0000] info [cpaneld] 153.67.187.66 - togofarm "GET /login/?login_only=1&user=togofarm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togofarm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.3.105.193
country_id: 2921044
description:
[2026-06-15 18:44:50 +0000] info [cpaneld] 77.3.105.193 - togofarmtg "GET /login/?login_only=1&user=togofarmtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togofarmtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.237.119.84
country_id: 99237
description:
[2026-06-15 18:44:53 +0000] info [cpaneld] 212.237.119.84 - togofar "GET /login/?login_only=1&user=togofar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togofar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.5.111.179
country_id: 298795
description:
[2026-06-15 18:44:57 +0000] info [cpaneld] 95.5.111.179 - togofa "GET /login/?login_only=1&user=togofa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togofa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.127.84.149
country_id: 1210997
description:
[2026-06-15 18:45:04 +0000] info [cpaneld] 103.127.84.149 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.45.140
country_id: 2363686
description:
[2026-06-15 18:44:23 +0000] info [webmaild] 196.170.45.140 - wages@wages.tg "GET /cpsess4457685102/3rdparty/roundcube/plugins/return_to_webmail/skins/elastic/return_to_webmail.css?s=1749492914 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.168.0.186] != Current IP Address [196.170.45.140]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.206.172.112
country_id: 99237
description:
[2026-06-15 18:45:00 +0000] info [cpaneld] 185.206.172.112 - togof "GET /login/?login_only=1&user=togof&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togof (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2.241.212.41
country_id: 2921044
description:
[2026-06-15 18:45:10 +0000] info [cpaneld] 2.241.212.41 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:44:40 dovecot_login authenticator failed for H=(V9yp7H) [141.98.10.175]:52262: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:44:38 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.191.95.238
country_id: 3469034
description:
[2026-06-15 18:44:42 +0000] info [cpaneld] 38.191.95.238 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.0.186
country_id: 2363686
description:
[2026-06-15 18:45:23 +0000] info [webmaild] 196.168.0.186 - wages@wages.tg "GET /cpsess4426779072/?=undefined&login=1&post_login=36253595934670 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.170.45.140] != Current IP Address [196.168.0.186]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:45:29 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:45:31 dovecot_login authenticator failed for H=(7EAgntI) [141.98.10.175]:51081: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.117.167.207
country_id: 2510769
description:
[2026-06-15 18:45:34 +0000] info [cpaneld] 79.117.167.207 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.12.168.191
country_id: 3895114
description:
[2026-06-15 18:45:59 +0000] info [cpaneld] 190.12.168.191 - vitrin "GET /login/?login_only=1&user=vitrin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitrin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.118.82.200
country_id: 2542007
description:
[2026-06-15 18:46:03 +0000] info [cpaneld] 196.118.82.200 - vitr "GET /login/?login_only=1&user=vitr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.192.27.26
country_id: 2017370
description:
[2026-06-15 18:46:11 +0000] info [cpaneld] 37.192.27.26 - vi "GET /login/?login_only=1&user=vi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vi (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.45.140
country_id: 2363686
description:
[2026-06-15 18:45:33 +0000] info [webmaild] 196.170.45.140 - wages@wages.tg "GET /cpsess4426779072/?=undefined&login=1&post_login=36253595934670 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.168.0.186] != Current IP Address [196.170.45.140]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.51.30.118
country_id: 3865483
description:
[2026-06-15 18:45:39 +0000] info [cpaneld] 38.51.30.118 - vitrinenewstg "GET /login/?login_only=1&user=vitrinenewstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitrinenewstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.231.164.189
country_id: 3996063
description:
[2026-06-15 18:45:49 +0000] info [cpaneld] 189.231.164.189 - vitrinene "GET /login/?login_only=1&user=vitrinene&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitrinene (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.23.94.242
country_id: 3865483
description:
[2026-06-15 18:46:08 +0000] info [cpaneld] 181.23.94.242 - vit "GET /login/?login_only=1&user=vit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vit (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:46:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.168.0.186
country_id: 2363686
description:
[2026-06-15 18:46:30 +0000] info [webmaild] 196.168.0.186 - wages@wages.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.170.45.140
country_id: 2363686
description:
[2026-06-15 18:46:23 +0000] info [webmaild] 196.170.45.140 - wages@wages.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:46:28 dovecot_login authenticator failed for H=(CcJAv8Smb) [141.98.10.175]:58347: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:47:21 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:47:23 dovecot_login authenticator failed for H=(2JUzMoNWHk) [141.98.10.175]:57189: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.152.99
country_id: 3469034
description:
2026-06-15 18:47:49 dovecot_plain authenticator failed for H=([10.44.153.3]) [104.28.152.99]:40067: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 3.80.216.18
country_id: 6252001
description:
[2026-06-15 18:47:46 +0000] info [cpaneld] 3.80.216.18 - einguval "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user einguval (has_cpuser_file failed)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.171.34.157
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/wp-content/plugins/onesignal-free-web-push-notifications/sdk_files/onesignalsdkworker.js?appid=8efd3276-8d5b-4b62-bbd3-6ed125ca9f51&sdkversion=160606||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:48:49 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2.217.140.140
country_id: 2635167
description:
[2026-06-15 18:48:41 +0000] info [whostmgrd] 2.217.140.140 - camaegdtomgo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:48:21 dovecot_login authenticator failed for H=(Xi39Qw) [141.98.10.175]:55476: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 95.95.214.132
country_id: 2264397
description:
95.95.214.132 - - [15/Jun/2026:18:48:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9606500&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcote-divoire-voici-les-nouveaux-prix-des-produits-petroliers-pour-fevrier-2026%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781549316 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/cote-divoire-voici-les-nouveaux-prix-des-produits-petroliers-pour-fevrier-2026/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.9062.1078 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:95.95.214.132


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:49:21 dovecot_login authenticator failed for H=(kbRxSbNA0) [141.98.10.175]:63652: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:49:42 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 3.80.216.18
country_id: 6252001
description:
[2026-06-15 18:50:42 +0000] info [cpaneld] 3.80.216.18 - yvwaocrr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yvwaocrr (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:50:40 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:50:42 dovecot_login authenticator failed for H=(nuJcCa) [141.98.10.175]:53344: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:51:34 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 3.80.216.18
country_id: 6252001
description:
[2026-06-15 18:51:48 +0000] info [cpaneld] 3.80.216.18 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:51:36 dovecot_login authenticator failed for H=(cwDu65r) [141.98.10.175]:60656: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:52:32 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 3.80.216.18
country_id: 6252001
description:
[2026-06-15 18:53:15 +0000] info [cpaneld] 3.80.216.18 - crepsad "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:52:34 dovecot_login authenticator failed for H=(zLNYdLhKK) [141.98.10.175]:54801: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:18:53:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:18:53:05 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 3.80.216.18
country_id: 6252001
description:
[2026-06-15 18:53:09 +0000] info [cpaneld] 3.80.216.18 - pharma "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pharma (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 194.180.237.235
country_id: 6252001
description:
194.180.237.235 - - [15/Jun/2026:18:54:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10394217&pdata=https%253A%252F%252Fcafe.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781549638 HTTP/2.0" 302 0 cafe.tg "https://cafe.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:194.180.237.235


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:53:30 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:53:32 dovecot_login authenticator failed for H=(f7X21PH8) [141.98.10.175]:50769: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:54:29 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:54:31 dovecot_login authenticator failed for H=(OD3xxv5a) [141.98.10.175]:61430: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:55:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:55:25 dovecot_login authenticator failed for H=(HSGiL4fZO2) [141.98.10.175]:54119: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 41.207.189.253
country_id: 2363686
description:
[2026-06-15 18:56:02 +0000] info [webmaild] 41.207.189.253 - kakue@togointerim.net "POST /cpsess5529419790/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.170.118.10] != Current IP Address [41.207.189.253]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:18:56:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6515818&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781549813 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:56:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:56:24 dovecot_login authenticator failed for H=(pRYw4y91) [141.98.10.175]:50248: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 94.103.183.201
country_id: 2017370
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:94.103.183.201||TA:94.103.183.201||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:57:36 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:57:38 dovecot_login authenticator failed for H=(76dsGp9) [141.98.10.175]:52504: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 94.103.183.201
country_id: 2017370
domain: butodra.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:18-58.94.103.183.201||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:58:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 3.80.216.18
country_id: 6252001
description:
[2026-06-15 18:58:21 +0000] info [cpaneld] 3.80.216.18 - dev03 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dev03 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:58:25 dovecot_login authenticator failed for H=(rcJ5HwXnaW) [141.98.10.175]:57611: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 140.235.170.29
country_id: 6252001
description:
140.235.170.29 - - [15/Jun/2026:18:58:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6647649&pdata=https%253A%252F%252Fcafe.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781549926 HTTP/2.0" 302 0 cafe.tg "https://cafe.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:140.235.170.29


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.245.110.21
country_id: 6252001
description:
2026-06-15 19:00:08 dovecot_plain authenticator failed for H=(vudyqx8qgjxdrlu66ep2gw5ef) [172.245.110.21]:35812: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 18:59:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 18:59:25 dovecot_login authenticator failed for H=(aGWhdBlsmT) [141.98.10.175]:51281: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.213.93
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/ecobank-sierra-leone-signe-deux-financements-miniers-strategiques/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.213.93
country_id: 1562822
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/ecobank-sierra-leone-signe-deux-financements-miniers-strategiques/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:00:47 dovecot_login authenticator failed for H=(RyzuMa5BO) [141.98.10.175]:54625: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:00:45 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:01:47 dovecot_login authenticator failed for H=(cJ2LR785c) [141.98.10.175]:64762: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:01:45 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 19:02:20 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 19:02:22 dovecot_login authenticator failed for H=(dVy6niL) [141.98.10.175]:63189: 535 Incorrect authentication data (set_id=adiel)


