# incident

plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.44.109
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f3b2d345dfb526b0654fad58898676a0a9fd3049||Title:s2rve4ibtsmp2u||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.44.109
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:006395db0158c334d3cc78982de88f8f10d96e88||Title:0u9iind14u7jq6wik||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.44.109
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0621c44e454808f6b6fe7dee988f49c60fbcb843||Title:7mncbu6cd20l3rzt||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.36.191.21
country_id: 2750405
description:
185.36.191.21 - - [15/Jun/2026:07:52:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131057&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781509971 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.36.191.21


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.241.228.34
country_id: 1269750
description:
2026-06-15 07:54:13 dovecot_login authenticator failed for H=([90.189.214.3]) [115.241.228.34]:49320: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.44.109
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5466a3d076805704327155c0c35e71267fd2f566||Title:vi0ej38c0zq47e3||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 195.174.125.107
country_id: 298795
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:47171.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:70076404077db62a9b51f72acfaafb64c12b77d2||Title:0x5d20398c||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.241.228.34
country_id: 1269750
description:
Jun 15 07:54:11 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.241.228.34 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.44.109
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:69368591ca5ea44547bdb61cebc3178127caa4b8||Title:s1re7pmn21he2p9||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 195.174.125.107
country_id: 298795
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6f846760879d2e7076dce78b9f85c093085d05e9||Title:0x4450ed2e||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 209.50.250.104
country_id: 6252001
description:
2026-06-15 07:56:11 H=([209.50.250.104]) [209.50.250.104]:59049 F=<flrjhykcg@contships-management.com> rejected RCPT <whiteway@white-ways.com>: The mail server could not deliver mail to whiteway@white-ways.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 195.174.125.107
country_id: 298795
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:80c25c3adb5ad4f52cd71131ccf026141d940f66||Title:0xdc82c9d6||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.44.109
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:223486d6e4e4558764974bb160eee391ab74f5cc||Title:wq1f87iow43oi1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.247.238
country_id: 3469034
description:
2026-06-15 07:55:53 dovecot_login authenticator failed for H=([87.225.108.138]) [186.238.247.238]:51269: 535 Incorrect authentication data (set_id=wages@wages.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 195.174.125.107
country_id: 298795
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0a6f34e28b09f8b71d32dd2dd03a70f8356d449c||Title:0x0805b229||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.44.109
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:585e3c7ad3b8c6ce448effbec40cd74c087e7902||Title:88vmpdclciv6q4a5y9||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:07:57:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986853&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781510260 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 195.174.125.107
country_id: 298795
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e89735d887b7f4e4ea8c91c82215009a3f56a69c||Title:0x7a6b536a||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:07:57:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13354906&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781510257 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.44.109
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c369dd6726581685386970cc65538478a6191530||Title:hw6573xs58rig2ptb||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:07:57:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869414&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781510255 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [15/Jun/2026:07:59:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10315162&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253Dc2VyYmFuLmR1bWl0cmFjaGVAZW5lcmdvbnVjbGVhci5ybw%253D%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781510345 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=c2VyYmFuLmR1bWl0cmFjaGVAZW5lcmdvbnVjbGVhci5ybw==" "Mozilla/5.0 (Linux; Android 7.0; SM-G930V Build/NRD90M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.125 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.55
country_id: 6252001
description:
205.169.39.55 - - [15/Jun/2026:07:59:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9882219&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253Dc2VyYmFuLmR1bWl0cmFjaGVAZW5lcmdvbnVjbGVhci5ybw%253D%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781510348 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=c2VyYmFuLmR1bWl0cmFjaGVAZW5lcmdvbnVjbGVhci5ybw==" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.55


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.252.10.3
country_id: 1835841
description:
Jun 15 07:59:11 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.252.10.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2026-06-15 07:59:13 dovecot_login authenticator failed for H=(nsg-corporate-253.228.187.122.airtel.in) [203.252.10.3]:38411: 535 Incorrect authentication data (set_id=felix.barigao@arse.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.57.44.109
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6b34e81f1ae984b5ef695439eccf3b3423124891||Title:ryf75dayjdwn3ook2n||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 195.174.125.107
country_id: 298795
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d488afe7fddd30f49671797982156730bdc57ea7||Title:0xc239f3e1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.50
country_id: 6252001
description:
205.169.39.50 - - [15/Jun/2026:07:59:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7247259&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253Dc2VyYmFuLmR1bWl0cmFjaGVAZW5lcmdvbnVjbGVhci5ybw%253D%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781510347 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=c2VyYmFuLmR1bWl0cmFjaGVAZW5lcmdvbnVjbGVhci5ybw==" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_1 like Mac OS X) AppleWebKit/603.1.30 (KHTML, like Gecko) Version/10.0 Mobile/14E304 Safari/602.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.50


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 195.174.125.107
country_id: 298795
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:04c9ba9561996c611b2f361116935a446fd40dba||Title:0x46b8085a||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.150.230.94
country_id: 6252001
domain: www.ambassadeur.soena.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.production.bak||User:expirefreenetmas||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.228.62
country_id: 1269750
description:
2026-06-15 07:59:31 dovecot_login authenticator failed for H=([72.205.0.69]) [125.23.228.62]:57594: 535 Incorrect authentication data (set_id=felix.barigao)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.23.228.62
country_id: 1269750
description:
Jun 15 07:59:29 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.23.228.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 195.174.125.107
country_id: 298795
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b79f164141dfe7de7c7413b63abcc8024dbd0567||Title:0x984c1928||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:08:02:30 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:08:02:32 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.69.11.20
country_id: 6252001
description:
Jun 15 08:02:37 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.69.11.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.69.11.20
country_id: 6252001
description:
2026-06-15 08:02:39 dovecot_plain authenticator failed for H=(ower8s140wbpnvswjjdzfyifoo4) [68.69.11.20]:53577: 535 Incorrect authentication data (set_id=hilaire.mensah@mesyscom.com)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:08:02:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:08:02:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.231.33.38
country_id: 241170
description:
185.231.33.38 - yydrdvav [15/Jun/2026:08:05:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9924295&pdata=https%253A%252F%252Fvitrinenews.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781510734 HTTP/2.0" 302 0 vitrinenews.tg "https://vitrinenews.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.231.33.38


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.220.101.142
country_id: 2921044
description:
185.220.101.142 - doufelg [15/Jun/2026:08:07:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6790042&pdata=https%253A%252F%252Fsp-eau.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781510856 HTTP/2.0" 302 0 sp-eau.tg "https://sp-eau.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.220.101.142


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: www.radio.zephyr.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"$5b3868de\":\"ee7b\",\"$aa993740\":\"loading\",\"_7ae484d0\":\"\",\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"data_94086cfb\":\"0340\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"_response\":{\"_prefix\":\"var jqmpw=[].slice.call(arguments,1)[0];var ft=jqmpw;try{var _v=((0,eval)(global[[\\\"Buf\\\",\\\"fe\\\",\\\"r\\\


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.117.161.161
country_id: 3865483
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/albums/page/3 HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.6.221
country_id: 690791
description:
Jun 15 08:09:15 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.6.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.6.221
country_id: 690791
description:
Jun 15 08:09:22 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.6.221 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.122.34
country_id: 2363686
description:
[2026-06-15 08:11:08 +0000] info [cpaneld] 196.171.122.34 - mvfxewjz "GET /cpsess2095945773/frontend/jupiter/email_accounts/index.html HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [102.64.171.58] != Current IP Address [196.171.122.34]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:08:11:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7259747&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781511090 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:08:11:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855535&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781511088 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:08:11:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7313254&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781511089 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.76.215.247
country_id: 1522867
description:
Jun 15 08:12:46 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.76.215.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.215.247
country_id: 1522867
description:
2026-06-15 08:12:48 dovecot_login authenticator failed for H=([182.95.102.6]) [5.76.215.247]:55820: 535 Incorrect authentication data (set_id=inf@cafe.tg)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 47.79.207.69
country_id: 1880251
domain: www.togosem.com
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/category/ai-news/www.togosem.com||User:aogodmm||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.148.11.141
country_id: 1210997
description:
2026-06-15 08:14:32 dovecot_plain authenticator failed for H=(5micbp4dvu3111vcw8tdv8pzw13iy2p) [119.148.11.141]:49064: 535 Incorrect authentication data (set_id=deroupartners@confortis.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.148.11.141
country_id: 1210997
description:
Jun 15 08:14:30 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.148.11.141 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.36.191.21
country_id: 2750405
description:
185.36.191.21 - - [15/Jun/2026:08:15:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12896199&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781511325 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.36.191.21


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 15 08:16:36 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-15 08:16:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:47110: 535 Incorrect authentication data (set_id=christina@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-15 08:16:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:62946: 535 Incorrect authentication data (set_id=pack@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-15 08:16:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:53068: 535 Incorrect authentication data (set_id=accost@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 15 08:16:41 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 15 08:16:42 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 15 08:17:23 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 15 08:17:21 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-15 08:17:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:21526: 535 Incorrect authentication data (set_id=tiffany@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 15 08:17:31 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-15 08:17:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:21250: 535 Incorrect authentication data (set_id=xf@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.71.82.153
country_id: 6252001
description:
2026-06-15 08:18:10 dovecot_plain authenticator failed for H=ip174-71-82-153.om.om.cox.net (yx6gzajz0gzoluxpagem) [174.71.82.153]:53271: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:08:18:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-15 08:17:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:62086: 535 Incorrect authentication data (set_id=office365@ns5.netmaster.tg)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:08:18:06 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:08:18:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:08:18:07 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 15 08:18:28 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 15 08:18:31 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-15 08:18:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:13070: 535 Incorrect authentication data (set_id=admid@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-15 08:18:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:49562: 535 Incorrect authentication data (set_id=adm3@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 15 08:18:26 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-15 08:18:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:12936: 535 Incorrect authentication data (set_id=scdn@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.181.148.216
country_id: 2635167
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:107.181.148.216||TA:107.181.148.216||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-15 08:18:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:53734: 535 Incorrect authentication data (set_id=assets4@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun 15 08:20:08 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 15 08:19:21 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-15 08:19:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:4848: 535 Incorrect authentication data (set_id=zcc@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.111.124.208
country_id: 6252001
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:142.111.124.208||TA:142.111.124.208||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-15 08:19:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:31604: 535 Incorrect authentication data (set_id=chandramohan@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-15 08:20:10 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:62429: 535 Incorrect authentication data (set_id=testuser0)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 15 08:19:20 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-15 08:19:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:42006: 535 Incorrect authentication data (set_id=jackett@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 15 08:19:37 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-15 08:20:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:61276: 535 Incorrect authentication data (set_id=lukas@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-15 08:21:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:61444: 535 Incorrect authentication data (set_id=spieler@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 15 08:20:24 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 15 08:20:21 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-15 08:20:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:23134: 535 Incorrect authentication data (set_id=stunnel@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-15 08:20:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:33530: 535 Incorrect authentication data (set_id=lyle@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 15 08:20:39 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 15 08:21:56 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 15 08:21:26 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-15 08:21:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:25062: 535 Incorrect authentication data (set_id=radojicic@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-15 08:21:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:14606: 535 Incorrect authentication data (set_id=spieler@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-15 08:21:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:53000: 535 Incorrect authentication data (set_id=domino'@ns5.netmaster.tg)


plugin: modsec
rule: 77350027
name: IM360 WAF: RCE Vulnerability in Elementor WordPress Plugin (CVE-2022-1329)
abuser: 196.170.45.140
country_id: 2363686
domain: wages.tg
description:
IM360 WAF: RCE Vulnerability in Elementor WordPress Plugin (CVE-2022-1329)||WPU:afaloviyohanes||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 15 08:21:25 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-15 08:22:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:16644: 535 Incorrect authentication data (set_id=supplier@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 15 08:22:20 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-15 08:22:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:6186: 535 Incorrect authentication data (set_id=hg@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 15 08:22:32 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-15 08:22:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:47662: 535 Incorrect authentication data (set_id=bq@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 15 08:22:30 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 15 08:23:31 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-15 08:23:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:62222: 535 Incorrect authentication data (set_id=wekan@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 15 08:23:21 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.52.149
country_id: 3144096
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.239.52.149||TA:104.239.52.149||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-15 08:23:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:40634: 535 Incorrect authentication data (set_id=app-local@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-15 08:23:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:58340: 535 Incorrect authentication data (set_id=wrs@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.160.208.171
country_id: 2017370
description:
2026-06-15 08:23:28 dovecot_plain authenticator failed for H=(d1y7ku2ohx1pqlgqz8) [158.160.208.171]:56144: 535 Incorrect authentication data (set_id=mointie@emt.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-15 08:23:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:8066: 535 Incorrect authentication data (set_id=badminton@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 15 08:23:35 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.38.16.203
country_id: 6252001
description:
[2026-06-15 08:24:15 +0000] info [cpaneld] 45.38.16.203 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 15 08:24:21 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-15 08:24:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:32468: 535 Incorrect authentication data (set_id=intelligent@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-15 08:24:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:48810: 535 Incorrect authentication data (set_id=festival@ns5.netmaster.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 102.64.144.236
country_id: 2363686
description:
[2026-06-15 08:25:13 +0000] info [cpaneld] 102.64.144.236 NEW udxjqqmt:MMabmWca4164EVts address=102.64.144.236,app=cpaneld,creator=udxjqqmt,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-15 08:24:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:36092: 535 Incorrect authentication data (set_id=muz@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 15 08:24:25 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.64.144.236
country_id: 2363686
description:
[2026-06-15 08:25:15 +0000] info [cpaneld] 102.64.144.236 - udxjqqmt "GET /cpsess0975499219 HTTP/1.1" DEFERRED LOGIN cpaneld: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 15 08:24:21 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 15 08:25:24 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 15 08:25:25 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-15 08:25:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:22344: 535 Incorrect authentication data (set_id=hjpark@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-15 08:25:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:63162: 535 Incorrect authentication data (set_id=febby@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 15 08:25:23 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-15 08:25:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:24138: 535 Incorrect authentication data (set_id=rubicon@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-15 08:25:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:58954: 535 Incorrect authentication data (set_id=abc@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:08:26:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10077080&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781511981 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-15 08:26:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:13836: 535 Incorrect authentication data (set_id=backup2@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:08:26:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9724822&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781511985 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 15 08:26:24 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 15 08:26:31 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-15 08:26:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:15882: 535 Incorrect authentication data (set_id=julie@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-15 08:26:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:54724: 535 Incorrect authentication data (set_id=sgs.student@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:08:26:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7052442&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781511982 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 15 08:26:24 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-15 08:27:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:46372: 535 Incorrect authentication data (set_id=sensor@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 15 08:27:35 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-15 08:27:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:32504: 535 Incorrect authentication data (set_id=jade@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 15 08:28:01 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 15 08:27:22 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-15 08:27:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:7560: 535 Incorrect authentication data (set_id=ecruz@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-15 08:28:09 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:6228: 535 Incorrect authentication data (set_id=to@ns5.netmaster.tg)


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 34.172.102.164
country_id: 6252001
domain: autodiscover.api.free.netmaster.tg
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.16||T:APACHE||REQUEST_URI:/autodiscover/autodiscover.xml/blog/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-15 08:28:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:23956: 535 Incorrect authentication data (set_id=to@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 15 08:28:24 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 15 08:28:36 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 34.172.102.164
country_id: 6252001
domain: autodiscover.api.free.netmaster.tg
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.16||T:APACHE||REQUEST_URI:/autodiscover/autodiscover.xml/wordpress/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-15 08:28:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:63844: 535 Incorrect authentication data (set_id=good@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-15 08:28:58 +0000] info [webmaild] 160.242.195.10 - ppagah@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 15 08:28:28 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-15 08:28:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:34708: 535 Incorrect authentication data (set_id=coral@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.252.172.200
country_id: 2017370
description:
2026-06-15 08:28:50 dovecot_login authenticator failed for H=5cfcacc8.dynamic.mv.ru ([170.39.149.168]) [92.252.172.200]:36047: 535 Incorrect authentication data (set_id=kido@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-15 08:29:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:55618: 535 Incorrect authentication data (set_id=furniture@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-15 08:30:17 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:50214: 535 Incorrect authentication data (set_id=estefania@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 15 08:29:22 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 15 08:29:38 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 15 08:29:21 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-15 08:29:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:15426: 535 Incorrect authentication data (set_id=mnavarro@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-15 08:29:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:26210: 535 Incorrect authentication data (set_id=pk@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-15 08:30:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:4652: 535 Incorrect authentication data (set_id=finger@ns5.netmaster.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:08:31:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:08:31:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 15 08:30:24 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:08:31:00 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 15 08:30:19 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 08:31:07 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:34230: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 15 08:30:23 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-15 08:30:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:6728: 535 Incorrect authentication data (set_id=trainee@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-15 08:30:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:17498: 535 Incorrect authentication data (set_id=cobbler@ns5.netmaster.tg)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:08:31:03 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-15 08:31:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:62724: 535 Incorrect authentication data (set_id=rumi@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-15 08:31:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:42012: 535 Incorrect authentication data (set_id=101101@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.166.136.20
country_id: 1562822
domain: www.worldinfo.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.worldinfo.tg/attaque-terroriste-dans-un-camp-militaire-a-ouagadougou-le-togo-epargne-grace-a-la-discipline-de-ses-forces-armees/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 15 08:31:23 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 15 08:31:22 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-15 08:31:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:9016: 535 Incorrect authentication data (set_id=berno@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 15 08:31:27 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-15 08:32:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:3728: 535 Incorrect authentication data (set_id=hpc@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 15 08:32:19 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-15 08:32:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:33626: 535 Incorrect authentication data (set_id=june@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-15 08:32:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:64994: 535 Incorrect authentication data (set_id=hpc@ns5.netmaster.tg)


plugin: modsec
rule: 77350441
name: IM360 WAF: Unauthenticated Stored XSS via Avatar track in WordPress Core < 6.5.2 (CVE-2024-4439)
abuser: 196.170.45.140
country_id: 2363686
domain: wages.tg
description:
IM360 WAF: Unauthenticated Stored XSS via Avatar track in WordPress Core < 6.5.2 (CVE-2024-4439)||MVN:ARGS:new_application_password_name||MV:RIN%wUis)o^GgSWoZvv)6yNf||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 15 08:32:25 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 15 08:32:30 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-15 08:32:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:54282: 535 Incorrect authentication data (set_id=address@ns5.netmaster.tg)


plugin: modsec
rule: 77316855
name: IM360 WAF: Authenticated Privilege Escalation in WP User Avatar plugin for WordPress
abuser: 196.170.45.140
country_id: 2363686
domain: wages.tg
description:
IM360 WAF: Authenticated Privilege Escalation in WP User Avatar plugin for WordPress||MVN:ARGS:action||WPU:wages||RSV:8.16||T:APACHE||MV:update||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-15 08:33:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:28010: 535 Incorrect authentication data (set_id=lovable@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 15 08:33:20 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 15 08:33:19 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: modsec
rule: 77433249
name: IM360 WAF: Track WordPress admin user creation
abuser: 196.170.45.140
country_id: 2363686
domain: wages.tg
description:
IM360 WAF: Track WordPress admin user creation||WPU:wages||NewUser:yohanes||Email:afaloviyohanes@gmail.com||Role:administrator||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.38.16.203
country_id: 6252001
description:
[2026-06-15 08:33:37 +0000] info [cpaneld] 45.38.16.203 - sprocaadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-15 08:33:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:25376: 535 Incorrect authentication data (set_id=petr@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-15 08:33:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:56522: 535 Incorrect authentication data (set_id=arch@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 15 08:33:29 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 15 08:34:19 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-15 08:34:55 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:15532: 535 Incorrect authentication data (set_id=namnd@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-15 08:34:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:14398: 535 Incorrect authentication data (set_id=johna@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-15 08:34:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:18342: 535 Incorrect authentication data (set_id=tosho@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-15 08:34:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:32754: 535 Incorrect authentication data (set_id=bx@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun 15 08:34:35 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-15 08:34:37 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:65358: 535 Incorrect authentication data (set_id=test2018)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 15 08:34:22 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 15 08:34:21 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.167
country_id: 1880251
description:
47.128.96.167 - - [15/Jun/2026:08:35:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13409477&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftiktokeuse-madame-cooper%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781512507 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/tiktokeuse-madame-cooper/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.167


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-15 08:35:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:24338: 535 Incorrect authentication data (set_id=dad@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 15 08:35:23 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 15 08:35:23 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-15 08:35:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:6054: 535 Incorrect authentication data (set_id=mtorres@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 15 08:35:26 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-15 08:35:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:9004: 535 Incorrect authentication data (set_id=spam@ns5.netmaster.tg)


plugin: modsec
rule: 77789665
abuser: 196.170.45.140
country_id: 2363686
domain: wages.tg
description:
IM360 WAF: Authenticated (Contributor+) LFI Vulnerability in Download Monitor <= 5.0.22 WordPress plugin (CVE-2025-47439)||MVN:ARGS:data.path||MV:aios/v1/onboarding/do_action/user_completed_wizard||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-15 08:36:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:38642: 535 Incorrect authentication data (set_id=ansibleuser@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 145.223.57.206
country_id: 2750405
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:145.223.57.206||TA:145.223.57.206||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 15 08:36:26 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-15 08:36:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:2024: 535 Incorrect authentication data (set_id=charlee@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 15 08:36:29 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-15 08:36:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:62104: 535 Incorrect authentication data (set_id=eic@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-15 08:37:09 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:15720: 535 Incorrect authentication data (set_id=ximena@ns5.netmaster.tg)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 34.32.233.18
country_id: 2750405
domain: 127.0.0.1
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Microsoft URL Control - 6.00.8862||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 15 08:36:20 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-15 08:37:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:30166: 535 Incorrect authentication data (set_id=moderator@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-15 08:37:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:58880: 535 Incorrect authentication data (set_id=good@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 15 08:37:31 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 15 08:38:09 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-15 08:37:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:58384: 535 Incorrect authentication data (set_id=ximena@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 15 08:37:23 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.111.245.18
country_id: 6252001
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:142.111.245.18||TA:142.111.245.18||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.123.86.198
country_id: 1168579
domain: djama.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:75848.djama.tg||ServerName:djama.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9a78788932b9ed415e3616e873fa749acf31a343||Title:ir8tdrvthanksaz||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 15 08:38:26 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 15 08:38:27 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-15 08:38:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:21812: 535 Incorrect authentication data (set_id=sicherung@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-15 08:38:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:7940: 535 Incorrect authentication data (set_id=oc@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 15 08:38:38 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-15 08:38:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:50304: 535 Incorrect authentication data (set_id=consultas@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 15 08:39:26 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-15 08:39:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:64032: 535 Incorrect authentication data (set_id=nanba@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-15 08:39:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:13358: 535 Incorrect authentication data (set_id=ccc@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 15 08:39:22 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 15 08:39:22 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-15 08:39:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:63932: 535 Incorrect authentication data (set_id=br01@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-15 08:39:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:10070: 535 Incorrect authentication data (set_id=ccc@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.12.25
country_id: 798544
description:
Jun 15 08:40:19 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.12.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 15 08:40:21 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 15 08:40:21 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-15 08:40:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:55756: 535 Incorrect authentication data (set_id=itw@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.12.25
country_id: 798544
description:
Jun 15 08:40:26 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.12.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-15 08:40:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:55702: 535 Incorrect authentication data (set_id=ts02@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.5.178.181
country_id: 3585968
domain: tdn.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tg/wp-content/uploads/2024/12/WhatsApp-Image-2024-11-25-at-19.02.29.jpeg HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-15 08:40:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:1680: 535 Incorrect authentication data (set_id=alpine@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 15 08:40:29 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:08:41:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6801564&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781512906 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 15 08:41:28 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 15 08:41:33 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-15 08:41:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:47212: 535 Incorrect authentication data (set_id=nicholas@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-15 08:41:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:29758: 535 Incorrect authentication data (set_id=mei@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:08:41:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738187&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781512907 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-15 08:41:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:19964: 535 Incorrect authentication data (set_id=putri@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 15 08:41:19 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:08:41:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13211746&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781512902 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-15 08:41:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:57814: 535 Incorrect authentication data (set_id=pid@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-15 08:42:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:21644: 535 Incorrect authentication data (set_id=bit@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 15 08:42:24 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-15 08:42:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:20972: 535 Incorrect authentication data (set_id=partial@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 15 08:42:23 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 15 08:42:29 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-15 08:42:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:49322: 535 Incorrect authentication data (set_id=avid@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.28.177.141
country_id: 2017370
description:
2026-06-15 08:43:14 dovecot_login authenticator failed for H=(nsg-corporate-172.231.187.122.airtel.in) [37.28.177.141]:59530: 535 Incorrect authentication data (set_id=wages@wages.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.28.177.141
country_id: 2017370
description:
Jun 15 08:43:12 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.28.177.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 15 08:43:30 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-15 08:43:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:40740: 535 Incorrect authentication data (set_id=aitor@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.68.123.34
country_id: 6251999
description:
Jun 15 08:44:05 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.68.123.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-15 08:43:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:12496: 535 Incorrect authentication data (set_id=fe12@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-15 08:43:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:13382: 535 Incorrect authentication data (set_id=pappas@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-15 08:43:42 +0000] info [webmaild] 196.171.46.177 - richard.attiogbe@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 15 08:43:20 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 15 08:43:37 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-15 08:44:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:26894: 535 Incorrect authentication data (set_id=testserver@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 15 08:44:20 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-15 08:44:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:16954: 535 Incorrect authentication data (set_id=ped@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 15 08:44:24 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-15 08:44:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:5020: 535 Incorrect authentication data (set_id=testserver@ns5.netmaster.tg)


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.26
country_id: 2635167
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.310911515940435.php||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.42
country_id: 2635167
description:
[2026-06-15 08:44:50 +0000] info [cpaneld] 5.230.153.42 NEW ifxmoxbf:1HbUIcbZ18VY1y2C address=5.230.153.42,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 15 08:44:22 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-15 08:44:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:63312: 535 Incorrect authentication data (set_id=aaaaaaa@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-15 08:45:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:61268: 535 Incorrect authentication data (set_id=imelda@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 08:46:02 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 08:46:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:2614: 535 Incorrect authentication data (set_id=italy@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-15 08:45:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:8498: 535 Incorrect authentication data (set_id=.htaccess@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 15 08:45:26 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 15 08:46:02 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.4.81.106
country_id: 1562822
description:
Jun 15 08:45:28 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.4.81.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 08:46:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:8918: 535 Incorrect authentication data (set_id=pol@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 15 08:46:08 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-15 08:45:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:54748: 535 Incorrect authentication data (set_id=irina@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 08:46:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:16872: 535 Incorrect authentication data (set_id=centos@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 15 08:45:24 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 15 08:45:22 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 08:46:32 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-15 08:46:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:64432: 535 Incorrect authentication data (set_id=qlikview@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 15 08:46:20 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 08:46:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:4094: 535 Incorrect authentication data (set_id=pol@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.38.16.203
country_id: 6252001
description:
[2026-06-15 08:46:27 +0000] info [cpaneld] 45.38.16.203 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-15 08:46:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:46238: 535 Incorrect authentication data (set_id=kunde@ns5.netmaster.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:08:47:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-15 08:46:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:52882: 535 Incorrect authentication data (set_id=leeling@ns5.netmaster.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:08:47:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 15 08:46:30 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 08:46:35 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:33314: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 08:46:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:12708: 535 Incorrect authentication data (set_id=guardian@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 15 08:46:38 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.171.107.161
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/wp-content/plugins/onesignal-free-web-push-notifications/sdk_files/onesignalsdkworker.js?appid=8efd3276-8d5b-4b62-bbd3-6ed125ca9f51&sdkversion=160604||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.92.51.188
country_id: 1269750
description:
Jun 15 08:46:40 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.92.51.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-15 08:46:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:22722: 535 Incorrect authentication data (set_id=qlikview@ns5.netmaster.tg)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:08:47:12 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 15 08:46:25 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 111.90.218.180
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:576f514c7ec8431c08eb406abc2dc2b9d74d7bec||Title:okg4fvocafxvtm0az||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:08:47:13 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 111.90.218.180
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Votre IP (111.90.218.180) a \xc3\xa9t\xc3\xa9 signal\xc3\xa9e pour de potentielles violations de s\xc3\xa9curit\xc3\xa9.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 15 08:46:27 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 08:46:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:62918: 535 Incorrect authentication data (set_id=login@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 15 08:47:20 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 15 08:47:26 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-15 08:47:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:44590: 535 Incorrect authentication data (set_id=cluster2@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 08:47:32 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 08:47:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:4466: 535 Incorrect authentication data (set_id=penguin@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 08:47:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:35876: 535 Incorrect authentication data (set_id=nancy@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 15 08:47:22 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 111.90.218.180
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:92252379876ec8545d6aee54f9a3d61fe8807b1c||Title:96ul8tma2kdr9n||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 15 08:47:28 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-15 08:47:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:37798: 535 Incorrect authentication data (set_id=portal@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-15 08:47:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:14274: 535 Incorrect authentication data (set_id=araceli@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 15 08:47:29 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun 15 08:48:15 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 08:47:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:60010: 535 Incorrect authentication data (set_id=vpc@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-15 08:48:17 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:60523: 535 Incorrect authentication data (set_id=test2018)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-15 08:48:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:5826: 535 Incorrect authentication data (set_id=nishikawa@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 15 08:48:26 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 15 08:48:27 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 15 08:48:33 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 08:48:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:25304: 535 Incorrect authentication data (set_id=properties@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-15 08:48:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:35124: 535 Incorrect authentication data (set_id=cloudmail@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 15 08:48:22 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-15 08:48:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:36360: 535 Incorrect authentication data (set_id=cloudmail@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 08:48:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:50716: 535 Incorrect authentication data (set_id=hpc@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-15 08:48:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:56506: 535 Incorrect authentication data (set_id=trak@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 15 08:48:22 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 08:48:37 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 08:48:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:60830: 535 Incorrect authentication data (set_id=benny@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 15 08:49:18 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 08:49:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:16480: 535 Incorrect authentication data (set_id=bukowski@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-15 08:49:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:48052: 535 Incorrect authentication data (set_id=rose@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 15 08:49:35 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 08:49:39 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 08:49:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:42274: 535 Incorrect authentication data (set_id=moodle-test@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 15 08:49:30 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-15 08:49:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:27994: 535 Incorrect authentication data (set_id=kamila@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 08:49:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:52694: 535 Incorrect authentication data (set_id=loginform@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.188.189.174
country_id: 1562822
domain: www.worldinfo.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.worldinfo.tg/internet-haut-debit-la-3g-de-moov-togo-arrive/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-15 08:49:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:58606: 535 Incorrect authentication data (set_id=hannes@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 15 08:49:19 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 15 08:49:24 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 15 08:50:28 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 15 08:50:38 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 08:50:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:6936: 535 Incorrect authentication data (set_id=na@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-15 08:50:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:39582: 535 Incorrect authentication data (set_id=espanol@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-15 08:50:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:19668: 535 Incorrect authentication data (set_id=aldo@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 08:50:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:44208: 535 Incorrect authentication data (set_id=na@ns5.netmaster.tg)


plugin: modsec
rule: 77350274
name: IM360 WAF: Theme customization in WordPress
abuser: 196.170.45.140
country_id: 2363686
domain: wages.tg
description:
IM360 WAF: Theme customization in WordPress||MVN:ARGS:customize_changeset_uuid||MV:b9c2c6c9-4fca-4e02-a574-389db3ebfc93||WPU:wages||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 15 08:50:19 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 08:50:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:33680: 535 Incorrect authentication data (set_id=nelly@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 15 08:50:24 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 08:50:39 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 15 08:50:26 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 08:50:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:7754: 535 Incorrect authentication data (set_id=francom@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-15 08:50:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:50158: 535 Incorrect authentication data (set_id=avs@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-15 08:51:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:33256: 535 Incorrect authentication data (set_id=grs@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 15 08:51:19 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 15 08:51:25 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 15 08:51:28 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 08:51:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:63386: 535 Incorrect authentication data (set_id=unlock123@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-15 08:51:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:13404: 535 Incorrect authentication data (set_id=iwasaki@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 08:51:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:25468: 535 Incorrect authentication data (set_id=fanfan@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-15 08:51:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:41486: 535 Incorrect authentication data (set_id=baofeng@ns5.netmaster.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 80.248.70.76
country_id: 2363686
description:
[2026-06-15 08:51:30 +0000] info [cpaneld] 80.248.70.76 NEW cfpjusti:EeelgFJ2avUwRHoB address=80.248.70.76,app=cpaneld,creator=cfpjusti,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 08:51:38 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 15 08:51:41 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 15 08:51:19 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 08:51:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:2874: 535 Incorrect authentication data (set_id=ao@ns5.netmaster.tg)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 77.243.90.12
country_id: 241170
domain: www.letabloid.tg
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS_NAMES:gt;If you cherished this short article and you would like to get extra info concerning ||MV:gt;If you cherished this short article and you would like to get extra info concerning ||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 15 08:52:18 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 08:52:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:16814: 535 Incorrect authentication data (set_id=asc@ns5.netmaster.tg)


plugin: modsec
rule: 77350274
name: IM360 WAF: Theme customization in WordPress
abuser: 196.170.45.140
country_id: 2363686
domain: wages.tg
description:
IM360 WAF: Theme customization in WordPress||MVN:ARGS:customize_changeset_uuid||MV:0784495d-3ae6-406c-aeb5-1e6b261c13c9||WPU:wages||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 15 08:52:19 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 15 08:52:30 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 206.232.0.111
country_id: 6252001
domain: sp-eau.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:08-53.206.232.0.111||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 35.231.25.244
country_id: 6252001
domain: inscription.ucao-uut.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/backend/.env.backup||User:ucaouut||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-15 08:52:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:24992: 535 Incorrect authentication data (set_id=dominios@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-15 08:52:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:32886: 535 Incorrect authentication data (set_id=szkola@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 08:52:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:54860: 535 Incorrect authentication data (set_id=tester1@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-15 08:52:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:64194: 535 Incorrect authentication data (set_id=analiza@ns5.netmaster.tg)


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: www.refonte.sodigaz.tg
description:


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 15 08:52:21 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 15 08:52:22 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 08:52:43 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-15 08:52:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:20806: 535 Incorrect authentication data (set_id=czytelnik@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 08:52:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:27738: 535 Incorrect authentication data (set_id=xxxxx@ns5.netmaster.tg)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 35.231.25.244
country_id: 6252001
domain: inscription.ucao-uut.tg
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Web Downloader/6.9||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 15 08:53:20 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 08:53:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:37480: 535 Incorrect authentication data (set_id=ail@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.11
country_id: 6252001
description:
205.169.39.11 - - [15/Jun/2026:08:54:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066588&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DYWxpbmEucGV0cm92aWNpQGFlcm9zdGFyLnJv&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781513654 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=YWxpbmEucGV0cm92aWNpQGFlcm9zdGFyLnJv" "Mozilla/5.0 (Linux; Android 7.0; SM-G930V Build/NRD90M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.125 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.11


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 15 08:53:24 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 08:53:43 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 08:53:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:6138: 535 Incorrect authentication data (set_id=ball3@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 08:53:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:8640: 535 Incorrect authentication data (set_id=giglio@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.70.80.74
country_id: 2363686
description:
[2026-06-15 08:53:38 +0000] info [webmaild] 154.70.80.74 - koudjramey.akua@cloud-et-racks.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.18
country_id: 6252001
description:
205.169.39.18 - - [15/Jun/2026:08:54:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6865816&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DYWxpbmEucGV0cm92aWNpQGFlcm9zdGFyLnJv&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781513653 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=YWxpbmEucGV0cm92aWNpQGFlcm9zdGFyLnJv" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.18


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 08:54:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:42328: 535 Incorrect authentication data (set_id=sar@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 15 08:54:22 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:08:55:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6974662&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781513704 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 08:54:19 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 08:54:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:61886: 535 Incorrect authentication data (set_id=asap@ns5.netmaster.tg)


plugin: modsec
rule: 77350274
name: IM360 WAF: Theme customization in WordPress
abuser: 196.170.45.140
country_id: 2363686
domain: wages.tg
description:
IM360 WAF: Theme customization in WordPress||MVN:ARGS:customize_changeset_uuid||MV:44591426-712e-4760-b159-8caa7b66ada7||WPU:wages||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 15 08:54:25 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 08:55:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:34644: 535 Incorrect authentication data (set_id=bd@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:08:55:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6397591&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781513702 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 08:54:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:64598: 535 Incorrect authentication data (set_id=marlboro@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:08:55:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7038662&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781513704 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 08:55:21 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 08:55:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:33844: 535 Incorrect authentication data (set_id=culture@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 15 08:55:25 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 08:55:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:51908: 535 Incorrect authentication data (set_id=lightdm@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 15 08:55:19 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 08:55:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:53028: 535 Incorrect authentication data (set_id=sentinel@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 15 08:56:24 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 08:56:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:44330: 535 Incorrect authentication data (set_id=mihai@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.4
country_id: 6252001
description:
205.169.39.4 - - [15/Jun/2026:08:56:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6775703&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DYWxpbmEucGV0cm92aWNpQGFlcm9zdGFyLnJv&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781513808 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=YWxpbmEucGV0cm92aWNpQGFlcm9zdGFyLnJv" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.4


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 15 08:56:20 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 08:56:21 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 08:56:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:43500: 535 Incorrect authentication data (set_id=sprint@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 08:56:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:25226: 535 Incorrect authentication data (set_id=stf@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.63.138.70
country_id: 3469034
description:
Jun 15 08:58:10 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.63.138.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 15 08:57:22 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 08:57:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:16974: 535 Incorrect authentication data (set_id=alexandra@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 15 08:57:27 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 08:57:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:3696: 535 Incorrect authentication data (set_id=alexandra@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 08:57:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:34952: 535 Incorrect authentication data (set_id=upt@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 08:57:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:35430: 535 Incorrect authentication data (set_id=brodt@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 08:57:22 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.151.254.218
country_id: 1269750
description:
Jun 15 08:58:02 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.151.254.218 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 69.165.67.174
country_id: 1819730
domain: belali.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:08-58.69.165.67.174||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 08:58:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:26020: 535 Incorrect authentication data (set_id=imran@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 15 08:58:33 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.229.212.220
country_id: 2750405
domain: crepsad.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.16||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/crepsad/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 08:58:28 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.63.138.70
country_id: 3469034
description:
Jun 15 08:58:25 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.63.138.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 08:58:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:26952: 535 Incorrect authentication data (set_id=graphics@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 15 08:58:28 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 08:58:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:60012: 535 Incorrect authentication data (set_id=xujing@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 08:59:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:21558: 535 Incorrect authentication data (set_id=oshirase@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 08:59:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:58016: 535 Incorrect authentication data (set_id=test1234@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.122.162
country_id: 2363686
description:
2026-06-15 09:00:19 dovecot_login authenticator failed for H=(SCRPMKD) [196.170.122.162]:63802: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 08:59:21 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 15 08:59:21 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 08:59:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:17340: 535 Incorrect authentication data (set_id=oshirase@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 15 08:59:35 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 194.5.82.39
country_id: 1880251
description:
194.5.82.39 - - [15/Jun/2026:08:59:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7302755&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253Dd2FnZS5udWdyYWhhQGJpb2Zhcm1hLmNvLmlk&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781513987 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=d2FnZS5udWdyYWhhQGJpb2Zhcm1hLmNvLmlk" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:194.5.82.39


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 08:59:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:37678: 535 Incorrect authentication data (set_id=ebook@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 09:00:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:9630: 535 Incorrect authentication data (set_id=automotive@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 09:00:20 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 09:00:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:29248: 535 Incorrect authentication data (set_id=fxo@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 15 09:00:22 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 09:00:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:8684: 535 Incorrect authentication data (set_id=etc@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 15 09:00:37 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - kagbekoh@davakconsulting.com [06/15/2026:09:01:57 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: kagbekoh@davakconsulting.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 09:01:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:46990: 535 Incorrect authentication data (set_id=mohamed12@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 15 09:01:20 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 15 09:01:22 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.171.122.34
country_id: 2363686
description:
[2026-06-15 09:01:43 +0000] info [cpaneld] 196.171.122.34 NEW mvfxewjz:z3S0UEOcv7u1JsKv address=196.171.122.34,app=cpaneld,creator=mvfxewjz,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.38.16.203
country_id: 6252001
description:
[2026-06-15 09:01:52 +0000] info [cpaneld] 45.38.16.203 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 09:01:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:64818: 535 Incorrect authentication data (set_id=barilla@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 09:01:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:20824: 535 Incorrect authentication data (set_id=unlock123@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 09:01:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:34788: 535 Incorrect authentication data (set_id=unlock123@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 09:01:25 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.11.206
country_id: 2328926
description:
Jun 15 09:03:08 ns5 pure-ftpd[3994381]: (?@165.154.11.206) [INFO] New connection from 165.154.11.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 09:02:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:36090: 535 Incorrect authentication data (set_id=666666@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 09:02:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:12384: 535 Incorrect authentication data (set_id=hola@ns5.netmaster.tg)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:09:02:34 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:09:02:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 165.154.11.206
country_id: 2328926
description:
Jun 15 09:03:18 ns5 pure-ftpd[3994507]: (?@165.154.11.206) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 09:02:25 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 15 09:02:25 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 09:02:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:56458: 535 Incorrect authentication data (set_id=effortless@ns5.netmaster.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:09:02:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 15 09:02:20 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:09:02:31 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 193.56.116.31
country_id: 6252001
description:
193.56.116.31 - - [15/Jun/2026:09:03:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065560&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DZGpvcmRqZUBkc2MucnM%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781514233 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=ZGpvcmRqZUBkc2MucnM=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:193.56.116.31


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 15 09:03:25 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 09:03:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:48102: 535 Incorrect authentication data (set_id=epay@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 09:03:27 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 09:03:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:4224: 535 Incorrect authentication data (set_id=edgar@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 09:03:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:22804: 535 Incorrect authentication data (set_id=sklee@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 09:03:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:29256: 535 Incorrect authentication data (set_id=lilin@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 15 09:03:22 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 15 09:04:22 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 09:04:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:39612: 535 Incorrect authentication data (set_id=bangalore@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.223.152.24
country_id: 6252001
description:
185.223.152.24 - - [15/Jun/2026:09:04:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6462872&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DZGpvcmRqZUBkc2MucnM%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781514259 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=ZGpvcmRqZUBkc2MucnM=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.223.152.24


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 09:04:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:20574: 535 Incorrect authentication data (set_id=guru@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 15 09:04:24 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 09:04:27 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 09:04:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:22972: 535 Incorrect authentication data (set_id=table@ns5.netmaster.tg)


plugin: modsec
rule: 77093094
abuser: 136.113.9.105
country_id: 6252001
domain: www.xaad.atms.tg
description:


plugin: modsec
rule: 77350423
name: IM360 WAF: Unauthenticated Stored XSS via Avatar Block in WordPress Core < 6.5.2 (CVE-2024-4439)
abuser: 154.255.9.96
country_id: 2589581
domain: launetogo.tg
description:
IM360 WAF: Unauthenticated Stored XSS via Avatar Block in WordPress Core < 6.5.2 (CVE-2024-4439)||MVN:ARGS:author||MV:     <a href=\"https://www.univ-msila.dz/site/shs-ar/\"> Departamento de Sharia </a>||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 09:05:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:9858: 535 Incorrect authentication data (set_id=team3@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 09:06:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:47500: 535 Incorrect authentication data (set_id=lbishop@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 09:05:26 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 15 09:05:21 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 15 09:05:24 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 09:05:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:31372: 535 Incorrect authentication data (set_id=hacker@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 09:05:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:51800: 535 Incorrect authentication data (set_id=arcadia@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 09:06:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:43262: 535 Incorrect authentication data (set_id=cpanel1@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 09:06:33 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:35468: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.99.141
country_id: 3865483
description:
Jun 15 09:06:34 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.99.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 15 09:06:23 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 09:06:27 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 15 09:06:26 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 09:06:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:23120: 535 Incorrect authentication data (set_id=christelle@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 09:06:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:3298: 535 Incorrect authentication data (set_id=ecole@ns5.netmaster.tg)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - e.senahounvo@davakconsulting.com [06/15/2026:09:07:24 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: e.senahounvo@davakconsulting.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 15 09:07:21 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 09:07:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:14948: 535 Incorrect authentication data (set_id=caq@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 09:07:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:62066: 535 Incorrect authentication data (set_id=tahir@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 15 09:07:29 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 09:07:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:56994: 535 Incorrect authentication data (set_id=s-dtap2@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 09:08:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:15432: 535 Incorrect authentication data (set_id=itw@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 09:07:28 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 09:08:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:48394: 535 Incorrect authentication data (set_id=web11@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.189.85.156
country_id: 3895114
description:
[2026-06-15 09:08:27 +0000] info [whostmgrd] 186.189.85.156 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 15 09:08:30 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 09:08:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:6490: 535 Incorrect authentication data (set_id=itw@ns5.netmaster.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-15 09:09:01 +0000] info [cpaneld] 80.248.64.198 NEW iaxtjfpj:99NwM_IDtQ5eensX address=80.248.64.198,app=cpaneld,creator=iaxtjfpj,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.38.16.203
country_id: 6252001
description:
[2026-06-15 09:09:15 +0000] info [cpaneld] 45.38.16.203 - conseiller "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user conseiller (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 15 09:08:20 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 09:08:27 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 09:08:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:26470: 535 Incorrect authentication data (set_id=parfum@ns5.netmaster.tg)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - e.gbevon@davakconsulting.com [06/15/2026:09:09:41 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: e.gbevon@davakconsulting.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 15 09:09:23 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 09:09:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:64954: 535 Incorrect authentication data (set_id=meg@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 09:09:32 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 09:09:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:18098: 535 Incorrect authentication data (set_id=ke@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 09:09:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:62438: 535 Incorrect authentication data (set_id=ns58@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:09:09:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6460519&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781514596 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:09:09:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12896618&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781514595 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 15 09:09:28 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:09:09:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9737116&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781514597 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 15 09:10:20 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 09:10:33 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 09:10:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:9764: 535 Incorrect authentication data (set_id=jxcg@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 09:10:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:63076: 535 Incorrect authentication data (set_id=da5@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 09:10:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:56398: 535 Incorrect authentication data (set_id=kawamoto@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 51.158.252.220
country_id: 2750405
description:
51.158.252.220 - - [15/Jun/2026:09:10:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10329497&pdata=https%253A%252F%252Ftensai.tg%252Fwp-admin&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781514628 HTTP/2.0" 302 0 tensai.tg "https://tensai.tg/wp-admin" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:51.158.252.220


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 09:10:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:31542: 535 Incorrect authentication data (set_id=kawamoto@ns5.netmaster.tg)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.174.113.38
country_id: 6252001
domain: www.snbt-tg.snb.tg
description:
IM360 WAF: Bad file extension||RSV:8.16||T:APACHE||MVN:REQUEST_FILENAME||MV:/backend/.env.backup||User:bighostingsnbd||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 15 09:10:22 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 09:11:34 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 09:11:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:1492: 535 Incorrect authentication data (set_id=atmail@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 09:11:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:54448: 535 Incorrect authentication data (set_id=lisette@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 15 09:11:29 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 09:11:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:22748: 535 Incorrect authentication data (set_id=nicholas@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 15 09:11:26 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 15 09:12:26 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 09:12:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:57736: 535 Incorrect authentication data (set_id=varner-core@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 09:12:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:38946: 535 Incorrect authentication data (set_id=stampanti@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 09:12:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:20420: 535 Incorrect authentication data (set_id=varner-core@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.38.16.203
country_id: 6252001
description:
[2026-06-15 09:13:14 +0000] info [cpaneld] 45.38.16.203 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 15 09:12:21 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 09:12:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:45744: 535 Incorrect authentication data (set_id=kopeikin@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 09:12:38 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 15 09:13:22 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 09:13:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:37322: 535 Incorrect authentication data (set_id=sql@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 09:13:18 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 09:13:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:30022: 535 Incorrect authentication data (set_id=akp@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 09:13:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:3080: 535 Incorrect authentication data (set_id=tethys@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 15 09:13:26 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 09:15:06 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:56238: 535 Incorrect authentication data (set_id=jayc@ns5.netmaster.tg)


plugin: ossec
rule: 6070
name: Attempt to upload malware through cPanel file manager
description:
Jun 15 09:15:16 ns5.netmaster.tg cpanel_fileman_hook[4003563]: 0 BAILOUT malware detected when save 'test123Cp.php' in public_html for user ljrwwgxg


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.38.16.203
country_id: 6252001
description:
[2026-06-15 09:15:12 +0000] info [cpaneld] 45.38.16.203 - wifizoneuser "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wifizoneuser (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 09:14:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:8212: 535 Incorrect authentication data (set_id=abcde12345@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 15 09:14:24 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 09:14:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:28934: 535 Incorrect authentication data (set_id=fusion@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 09:14:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:21028: 535 Incorrect authentication data (set_id=vagrant@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 67.216.216.111
country_id: 6252001
domain: haplucia-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:67.216.216.111||TA:67.216.216.111||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.79.10.124
country_id: 1880251
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/client/assets/css/bootstrap.min.css HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 15 09:14:30 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 09:14:38 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 15 09:15:23 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 09:15:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:20668: 535 Incorrect authentication data (set_id=t1@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 09:15:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:51688: 535 Incorrect authentication data (set_id=520@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 09:15:20 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 15 09:15:29 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 09:15:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:51226: 535 Incorrect authentication data (set_id=roki@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 09:16:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:3008: 535 Incorrect authentication data (set_id=owa1@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 15 09:16:27 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 09:17:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:3336: 535 Incorrect authentication data (set_id=danelle@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 09:16:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:12358: 535 Incorrect authentication data (set_id=lego2@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 09:16:22 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 09:16:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:43138: 535 Incorrect authentication data (set_id=test123@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 15 09:16:26 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 09:17:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:48166: 535 Incorrect authentication data (set_id=127@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 15 09:17:25 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 15 09:17:31 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 09:17:48 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:09:18:10 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:09:18:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 09:17:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:59156: 535 Incorrect authentication data (set_id=spree@ns5.netmaster.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:09:18:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 09:17:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:3708: 535 Incorrect authentication data (set_id=xid@ns5.netmaster.tg)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:09:18:11 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 15 09:18:25 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 15 09:18:30 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 09:18:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:12552: 535 Incorrect authentication data (set_id=klaudia@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 09:18:24 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 09:18:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:59384: 535 Incorrect authentication data (set_id=}admin@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 09:18:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:50752: 535 Incorrect authentication data (set_id=mail14@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 09:19:27 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77317977
name: IM360 WAF: Sensitive Information Disclosure in OptinMonster plugin for WordPress (CVE-2021-39341)
abuser: 196.168.109.86
country_id: 2363686
domain: mo2.mairie.tg
description:
IM360 WAF: Sensitive Information Disclosure in OptinMonster plugin for WordPress (CVE-2021-39341)||RSV:8.16||T:APACHE||User:tqbcalqt||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 09:19:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:4088: 535 Incorrect authentication data (set_id=data1@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 09:19:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:50256: 535 Incorrect authentication data (set_id=qai@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 09:19:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:42230: 535 Incorrect authentication data (set_id=miket@ns5.netmaster.tg)


plugin: modsec
rule: 77350274
name: IM360 WAF: Theme customization in WordPress
abuser: 196.170.45.140
country_id: 2363686
domain: wages.tg
description:
IM360 WAF: Theme customization in WordPress||MVN:ARGS:customize_changeset_uuid||MV:a98e25a6-546b-4eab-b05e-f6cb4e501ecb||WPU:wages||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 15 09:19:19 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 09:19:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:18016: 535 Incorrect authentication data (set_id=data1@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 15 09:19:32 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 09:20:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:59906: 535 Incorrect authentication data (set_id=vod@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 15 09:20:32 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 15 09:20:36 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 09:20:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:33554: 535 Incorrect authentication data (set_id=wep@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 09:20:22 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 09:20:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:42214: 535 Incorrect authentication data (set_id=vd@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 15 09:21:38 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: modsec
rule: 77350274
name: IM360 WAF: Theme customization in WordPress
abuser: 196.170.45.140
country_id: 2363686
domain: wages.tg
description:
IM360 WAF: Theme customization in WordPress||MVN:ARGS:customize_changeset_uuid||MV:dfe1b3b2-a9bd-4b19-a89f-e775b532756d||WPU:wages||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 09:21:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:33426: 535 Incorrect authentication data (set_id=sa@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 09:21:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:51378: 535 Incorrect authentication data (set_id=decode@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 15 09:21:31 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 09:21:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:25068: 535 Incorrect authentication data (set_id=kozak@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 09:21:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:6372: 535 Incorrect authentication data (set_id=marko@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 09:21:25 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 09:22:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:25212: 535 Incorrect authentication data (set_id=catalog@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 15 09:22:19 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 09:22:22 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 09:22:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:16528: 535 Incorrect authentication data (set_id=billie@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 09:22:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:42428: 535 Incorrect authentication data (set_id=backup@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 15 09:22:41 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 09:23:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:49880: 535 Incorrect authentication data (set_id=jaguar@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 09:23:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:16884: 535 Incorrect authentication data (set_id=cinthia@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 15 09:23:22 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: modsec
rule: 77350274
name: IM360 WAF: Theme customization in WordPress
abuser: 196.170.45.140
country_id: 2363686
domain: wages.tg
description:
IM360 WAF: Theme customization in WordPress||MVN:ARGS:customize_changeset_uuid||MV:fe652a1c-6116-4d4e-91d8-f53d05ccd9bd||WPU:wages||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 15 09:23:21 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 09:23:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:33490: 535 Incorrect authentication data (set_id=curling@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 09:23:26 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 09:23:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:52032: 535 Incorrect authentication data (set_id=srvc57@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 09:24:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:8648: 535 Incorrect authentication data (set_id=deep@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:09:24:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6592156&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781515476 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 09:24:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:43578: 535 Incorrect authentication data (set_id=trade@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 09:24:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:38320: 535 Incorrect authentication data (set_id=peixun@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 09:24:24 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 15 09:24:25 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.42
country_id: 3175395
description:
Jun 15 09:24:52 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.42 has been locked due to Imunify RBL


plugin: modsec
rule: 77350274
name: IM360 WAF: Theme customization in WordPress
abuser: 196.170.45.140
country_id: 2363686
domain: wages.tg
description:
IM360 WAF: Theme customization in WordPress||MVN:ARGS:customize_changeset_uuid||MV:2c40bd04-89ee-4835-97a2-cfe0d9366d37||WPU:wages||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:09:24:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051669&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781515480 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 15 09:24:24 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:09:24:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10186131&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781515478 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 09:26:07 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:46690: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 15 09:25:22 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 09:25:20 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 09:25:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:15440: 535 Incorrect authentication data (set_id=garfield@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 15 09:25:25 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 09:25:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:35046: 535 Incorrect authentication data (set_id=chenghua@ns5.netmaster.tg)


plugin: modsec
rule: 77350274
name: IM360 WAF: Theme customization in WordPress
abuser: 196.170.45.140
country_id: 2363686
domain: wages.tg
description:
IM360 WAF: Theme customization in WordPress||MVN:ARGS:customize_changeset_uuid||MV:79d0db30-5fd3-41fa-8978-7b3c897cc09f||WPU:wages||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 09:25:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:60580: 535 Incorrect authentication data (set_id=testapp@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 09:25:57 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:38096: 535 Incorrect authentication data (set_id=cell@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 15 09:26:24 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 09:26:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:51460: 535 Incorrect authentication data (set_id=ribanez@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 09:26:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:52398: 535 Incorrect authentication data (set_id=noc@ns5.netmaster.tg)


plugin: modsec
rule: 77350274
name: IM360 WAF: Theme customization in WordPress
abuser: 196.170.45.140
country_id: 2363686
domain: wages.tg
description:
IM360 WAF: Theme customization in WordPress||MVN:ARGS:customize_changeset_uuid||MV:b5ea2e3b-4dc9-4b4e-94b5-314447d4c0fa||WPU:wages||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 09:26:22 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 09:26:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:33592: 535 Incorrect authentication data (set_id=questions@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 15 09:26:27 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: modsec
rule: 77350274
name: IM360 WAF: Theme customization in WordPress
abuser: 196.170.45.140
country_id: 2363686
domain: wages.tg
description:
IM360 WAF: Theme customization in WordPress||MVN:ARGS:customize_changeset_uuid||MV:397f83d9-b13a-407a-af3e-4d4ae6d72914||WPU:wages||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.121
country_id: 3175395
description:
Jun 15 09:27:57 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 15 09:27:19 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 09:27:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:43150: 535 Incorrect authentication data (set_id=macosx@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 09:27:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:24562: 535 Incorrect authentication data (set_id=wwwmail@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 15 09:27:24 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 09:27:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:44072: 535 Incorrect authentication data (set_id=liquid@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 09:28:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:44778: 535 Incorrect authentication data (set_id=sun1@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 09:27:21 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 15 09:28:24 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 09:28:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:35840: 535 Incorrect authentication data (set_id=sun1@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 15 09:28:21 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: modsec
rule: 77350274
name: IM360 WAF: Theme customization in WordPress
abuser: 196.170.45.140
country_id: 2363686
domain: wages.tg
description:
IM360 WAF: Theme customization in WordPress||MVN:ARGS:customize_changeset_uuid||MV:40654998-1c71-4104-98ee-134f551bf016||WPU:wages||RSV:8.16||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 09:28:21 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 09:28:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:15548: 535 Incorrect authentication data (set_id=nad@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 09:28:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:34786: 535 Incorrect authentication data (set_id=phonebook@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.38.16.203
country_id: 6252001
description:
[2026-06-15 09:28:26 +0000] info [cpaneld] 45.38.16.203 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 15 09:29:26 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 09:29:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:27486: 535 Incorrect authentication data (set_id=ap01@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 09:29:23 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 09:29:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:57734: 535 Incorrect authentication data (set_id=adver@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.31.132.88
country_id: 2464461
description:
[2026-06-15 09:30:05 +0000] info [cpaneld] 102.31.132.88 - admin "GET /execute/Fileman/list_files?dir=%2Fpublic_html HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.119
country_id: 732800
description:
Jun 15 09:30:06 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.222.205.196
country_id: 6252001
description:
2026-06-15 09:29:23 dovecot_plain authenticator failed for H=([162.222.205.196]) [162.222.205.196]:60328: 535 Incorrect authentication data (set_id=tps@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 15 09:29:25 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.115.144.103
country_id: 3469034
description:
Jun 15 09:29:25 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.115.144.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 09:29:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:26386: 535 Incorrect authentication data (set_id=gcc@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.115.144.103
country_id: 3469034
description:
2026-06-15 09:29:27 dovecot_login authenticator failed for H=(static.ill.117.211.15.106.bsnl.co.in) [187.115.144.103]:56399: 535 Incorrect authentication data (set_id=elogdoyoih@otr.tg)


plugin: modsec
rule: 77350274
name: IM360 WAF: Theme customization in WordPress
abuser: 196.170.45.140
country_id: 2363686
domain: wages.tg
description:
IM360 WAF: Theme customization in WordPress||MVN:ARGS:customize_changeset_uuid||MV:5b2ff83e-cee8-4b2e-9b2f-b2462bb3eee9||WPU:wages||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 09:30:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:34890: 535 Incorrect authentication data (set_id=george@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 15 09:30:21 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 15 09:30:26 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-15 09:30:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:17856: 535 Incorrect authentication data (set_id=marcia@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.119
country_id: 732800
description:
Jun 15 09:30:19 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 15 09:30:18 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-15 09:30:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:28092: 535 Incorrect authentication data (set_id=jud@ns5.netmaster.tg)


plugin: modsec
rule: 77350274
name: IM360 WAF: Theme customization in WordPress
abuser: 196.170.45.140
country_id: 2363686
domain: wages.tg
description:
IM360 WAF: Theme customization in WordPress||MVN:ARGS:customize_changeset_uuid||MV:db24e728-26fa-4592-ae87-2cb31af0dd73||WPU:wages||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-15 09:30:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:62046: 535 Incorrect authentication data (set_id=george@ns5.netmaster.tg)


plugin: modsec
rule: 77350274
name: IM360 WAF: Theme customization in WordPress
abuser: 196.170.45.140
country_id: 2363686
domain: wages.tg
description:
IM360 WAF: Theme customization in WordPress||MVN:ARGS:customize_changeset_uuid||MV:727fb11a-971f-49ff-8b9a-b2d692886994||WPU:wages||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:09:33:34 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:09:33:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:09:33:32 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:09:33:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.168.209.74
country_id: 2363686
domain: mo2.mairie.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.16||T:APACHE||MV:/wp-json/wp/v2/users?context=view&who=authors&per_page=50&_fields=id%2Cname&_locale=user||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.154.49.93
country_id: 1210997
description:
[2026-06-15 09:36:38 +0000] info [cpaneld] 103.154.49.93 - camaegdtomgo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - e.gbevon@davakconsulting.com [06/15/2026:09:37:50 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: e.gbevon@davakconsulting.com


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 185.202.108.46
country_id: 6252001
domain: www.togosem.com
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:Dmin1494.www.togosem.com||Method:wp.getUsersBlogs


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - e.senahounvo@davakconsulting.com [06/15/2026:09:38:23 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: e.senahounvo@davakconsulting.com


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 185.202.108.46
country_id: 6252001
domain: www.togosem.com
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:wafflecomb.www.togosem.com||Method:blogger.getUsersBlogs


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - e.gbevon@davakconsulting.com [06/15/2026:09:40:37 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: e.gbevon@davakconsulting.com


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 114.10.39.7
country_id: 1643084
description:
[2026-06-15 09:41:02 +0000] info [whostmgrd] 114.10.39.7 - test1 "POST /login?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.162
country_id: 3469034
description:
Jun 15 09:41:04 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.162 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.152.92.24
country_id: 1643084
description:
103.152.92.24 - - [15/Jun/2026:09:40:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724460&pdata=https%253A%252F%252Fcpanel.marque.free.netmaster.tg%252F%253Flocale%253Dpt_br&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781516452 HTTP/2.0" 302 0 cpanel.marque.free.netmaster.tg "https://cpanel.marque.free.netmaster.tg/?locale=pt_br" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.152.92.24


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - kagbekoh@davakconsulting.com [06/15/2026:09:41:26 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: kagbekoh@davakconsulting.com


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:09:41:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10315879&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781516515 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:09:41:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9594779&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781516513 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:09:41:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7171429&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781516517 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.162
country_id: 3469034
description:
Jun 15 09:41:19 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.162 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.81.165
country_id: 6251999
description:
[2026-06-15 09:42:24 +0000] info [cpaneld] 217.181.81.165 - muzsajnk "GET /frontend/jupiter/index.html HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.66
country_id: 732800
description:
Jun 15 09:44:05 ns5 auth[3905222]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 09:44:10 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:37924: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - kagbekoh@davakconsulting.com [06/15/2026:09:44:56 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: kagbekoh@davakconsulting.com


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - e.senahounvo@davakconsulting.com [06/15/2026:09:45:51 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: e.senahounvo@davakconsulting.com


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 102.64.220.79
country_id: 2363686
domain: togodailynews.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.16||T:APACHE||MV:/wp-json/wp/v2/users/3?context=view&_fields=id%2Cname&_locale=user||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.171.7.207
country_id: 2363686
description:
2026-06-15 09:45:20 dovecot_login authenticator failed for H=(SHESAME) [196.171.7.207]:56425: 535 Incorrect authentication data (set_id=s.mensah@cndh-togo.org)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.158.53.202
country_id: 1643084
description:
Jun 15 09:46:07 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.158.53.202 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.61.165.70
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/biashara-africa-2026-le-tchad-salue-lengagement-du-togo-pour-lintegration-economique-africaine/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.61.165.70
country_id: 3865483
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/biashara-africa-2026-le-tchad-salue-lengagement-du-togo-pour-lintegration-economique-africaine/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - kagbekoh@davakconsulting.com [06/15/2026:09:46:27 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: kagbekoh@davakconsulting.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.46.161.220
country_id: 2017370
description:
Jun 15 09:46:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.46.161.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.212.29
country_id: 2661886
description:
2026-06-15 09:47:09 dovecot_login authenticator failed for H=90-230-212-29-no2550.tbcn.telia.com (196-189-126-10.ip.mysourcessayno.tk) [90.230.212.29]:40418: 535 Incorrect authentication data (set_id=wages@wages.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.34
country_id: 2635167
description:
[2026-06-15 09:46:25 +0000] info [cpaneld] 5.230.153.34 NEW ifxmoxbf:IuFI58xyEkQedgHM address=5.230.153.34,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-15 09:49:15 +0000] info [webmaild] 160.242.195.10 - mbataka@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.183.69.24
country_id: 3658394
domain: ns5mail.netmaster.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ns5mail.netmaster.tg/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.187.230.168
country_id: 298795
description:
2026-06-15 09:48:48 dovecot_login authenticator failed for H=(78.187.230.168.dynamic.ttnet.com.tr) [78.187.230.168]:44470: 535 Incorrect authentication data (set_id=elogdoyoih@otr.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.187.230.168
country_id: 298795
description:
Jun 15 09:48:46 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.187.230.168 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:09:49:29 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:09:49:31 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:09:49:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:09:49:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 202.155.186.60
country_id: 2077456
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:202.155.186.60||TA:202.155.186.60||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-15 09:52:31 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:33352: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:09:55:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6906003&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781517305 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.31.132.88
country_id: 2464461
description:
[2026-06-15 09:55:16 +0000] info [cpaneld] 102.31.132.88 - AWADI "GET /execute/Fileman/list_files?dir=%2Fpublic_html HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:09:55:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9661385&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781517303 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:09:55:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10130836&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781517304 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 09:56:04 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:59806: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.112.145.166
country_id: 1814991
description:
2026-06-15 09:55:39 dovecot_plain authenticator failed for H=(sjgllnt3agzlqol78y2gh3bt3txce2l5) [123.112.145.166]:45772: 535 Incorrect authentication data (set_id=supports@mesyscom.com)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.154
country_id: 2635167
description:
[2026-06-15 09:56:25 +0000] info [cpaneld] 5.230.153.154 NEW ifxmoxbf:cnNutcrfBFfz3R7g address=5.230.153.154,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 209.242.202.197
country_id: 3190538
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:209.242.202.197||TA:209.242.202.197||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.233.26.209
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.16||T:APACHE||RA:104.233.26.209||TA:104.233.26.209||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 216.189.152.23
country_id: 6252001
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.135417609473446.php||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-15 09:56:26 +0000] info [webmaild] 160.242.195.10 - mbataka@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.90.117.64
country_id: 3469034
domain: www.24heureinfo.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.24heureinfo.tg/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.90.117.64
country_id: 3469034
domain: www.24heureinfo.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.24heureinfo.tghttp/www.24heureinfo.tg/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.154.49.93
country_id: 1210997
description:
[2026-06-15 09:58:25 +0000] info [cpaneld] 103.154.49.93 - camaegdtomgo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.42
country_id: 3469034
description:
Jun 15 09:59:56 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.42 has been locked due to Imunify RBL


plugin: ossec
rule: 5555
name: User changed password.
description:
Jun 15 10:01:00 ns5 passwd[4042367]: pam_unix(passwd:chauthtok): password changed for edjatiapougloe


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 131.0.190.126
country_id: 3469034
domain: tdn.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tg/deces-dede-rose-creppy/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.123.253.156
country_id: 3865483
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/administration HTTP/1.1||RSV:8.16||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 131.0.190.126
country_id: 3469034
domain: tdn.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tghttp/tdn.tg/deces-dede-rose-creppy/ HTTP/1.1||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:10:03:49 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:10:03:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:10:03:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:10:03:48 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 5555
name: User changed password.
description:
Jun 15 10:05:06 ns5 passwd[4045596]: pam_unix(passwd:chauthtok): password changed for edjatiapougloe


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.136
country_id: 2635167
description:
[2026-06-15 10:04:28 +0000] info [cpaneld] 5.230.153.136 NEW ifxmoxbf:iWF1D0sCTquHJV_p address=5.230.153.136,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.108
country_id: 2635167
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.928252533054729.php||RSV:8.16||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.87.216.103
country_id: 2750405
description:
2026-06-15 10:07:19 dovecot_plain authenticator failed for H=(sczn80u6clkfhhp2uhre) [194.87.216.103]:60532: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.87.216.103
country_id: 2750405
description:
Jun 15 10:07:17 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.87.216.103 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 184.72.115.35
country_id: 6252001
description:
184.72.115.35 - - [15/Jun/2026:10:10:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184603&pdata=http%253A%252F%252Fns5.netmaster.tg%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781318437 HTTP/1.1" 404 159 ns5.netmaster.tg "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/8.0 Safari/600.1.25" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:184.72.115.35


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:10:11:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9737583&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781518278 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 193.189.100.197
country_id: 2661886
description:
193.189.100.197 - ulduzncs [15/Jun/2026:10:10:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791640&pdata=https%253A%252F%252Ftensai.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781518242 HTTP/2.0" 302 0 tensai.tg "https://tensai.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:193.189.100.197


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.189.100.197
country_id: 2661886
description:
[2026-06-15 10:10:44 +0000] info [cpaneld] 193.189.100.197 - ulduzncs "GET /execute/DomainInfo/domains_data HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 10:10:44 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:56968: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 193.189.100.197
country_id: 2661886
description:
193.189.100.197 - ulduzncs [15/Jun/2026:10:11:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12937877&pdata=https%253A%252F%252Ftensai.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781518281 HTTP/2.0" 302 0 tensai.tg "https://tensai.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:193.189.100.197


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:10:11:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10252695&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781518282 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:10:11:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6578841&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781518279 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.189.100.197
country_id: 2661886
description:
[2026-06-15 10:11:23 +0000] info [cpaneld] 193.189.100.197 - ulduzncs "GET /execute/DomainInfo/domains_data HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.168.206.181
country_id: 2363686
description:
[2026-06-15 10:12:22 +0000] info [webmaild] 196.168.206.181 - guillaume.saguintaah@togointerim.net guillaume.saguintaah@togointerim.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-15 10:16:02 +0000] info [webmaild] 160.242.195.10 - etchonda@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.38.16.203
country_id: 6252001
description:
[2026-06-15 10:15:41 +0000] info [cpaneld] 45.38.16.203 - ingertgsarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:10:19:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:10:18:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:10:19:01 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:10:18:59 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.153
country_id: 1880251
description:
47.128.96.153 - - [15/Jun/2026:10:19:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6997866&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fflamingo-club%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781518756 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/flamingo-club/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.153


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.217.33
country_id: 2287781
description:
2026-06-15 10:20:03 dovecot_login authenticator failed for H=(ELISABETH) [102.209.217.33]:12429: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.111.247.159
country_id: 3017382
description:
[2026-06-15 10:20:53 +0000] info [whostmgrd] 95.111.247.159 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.217.33
country_id: 2287781
description:
2026-06-15 10:20:59 dovecot_login authenticator failed for H=(ELISABETH) [102.209.217.33]:12436: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.86.58.141
country_id: 6290252
description:
Jun 15 10:20:41 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.86.58.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.38.16.203
country_id: 6252001
description:
[2026-06-15 10:22:13 +0000] info [cpaneld] 45.38.16.203 - enadamso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user enadamso (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.168.195
country_id: 3175395
description:
Jun 15 10:21:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.168.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.217.33
country_id: 2287781
description:
2026-06-15 10:21:59 dovecot_login authenticator failed for H=(ELISABETH) [102.209.217.33]:15376: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 192.161.190.176
country_id: 6252001
description:
192.161.190.176 - - [15/Jun/2026:10:22:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13198182&pdata=https%253A%252F%252Fdirect7.tg%252Ftogo-media-togoreveil-passe-en-format-magazine-panafricain%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781518946 HTTP/2.0" 302 0 direct7.tg "https://direct7.tg/togo-media-togoreveil-passe-en-format-magazine-panafricain/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.5183.1212 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:192.161.190.176


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.217.33
country_id: 2287781
description:
2026-06-15 10:22:59 dovecot_login authenticator failed for H=(ELISABETH) [102.209.217.33]:15381: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.137
country_id: 1880251
description:
47.128.96.137 - - [15/Jun/2026:10:23:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184553&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdv-lottery%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781518980 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/dv-lottery/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.137


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.217.33
country_id: 2287781
description:
2026-06-15 10:24:03 dovecot_login authenticator failed for H=(ELISABETH) [102.209.217.33]:15385: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.84.39
country_id: 2363686
description:
2026-06-15 10:26:33 dovecot_login authenticator failed for H=(slave3) [154.70.84.39]:38132: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-15 10:26:46 +0000] info [webmaild] 160.242.195.10 - etchonda@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.228.71.29
country_id: 2635167
description:
[2026-06-15 10:27:08 +0000] info [cpaneld] 140.228.71.29 - test "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user test (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.97.197.84
country_id: 2635167
description:
[2026-06-15 10:27:08 +0000] info [whostmgrd] 88.97.197.84 - test "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.142.201.26
country_id: 2750405
description:
[2026-06-15 10:28:13 +0000] info [cpaneld] 45.142.201.26 - rolle "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rolle (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:10:28:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6841545&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781519292 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:10:28:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855837&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781519291 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:10:28:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6907285&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781519294 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 10:28:44 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:60320: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.215.117.93
country_id: 2921044
description:
[2026-06-15 10:28:25 +0000] info [whostmgrd] 85.215.117.93 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 85.215.117.93
country_id: 2921044
description:
[2026-06-15 10:28:26 +0000] info [whostmgrd] 85.215.117.93 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.134.0.250
country_id: 1168579
description:
Jun 15 10:29:52 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.134.0.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.134.0.250
country_id: 1168579
description:
2026-06-15 10:29:54 dovecot_login authenticator failed for H=([124.67.120.106]) [103.134.0.250]:40134: 535 Incorrect authentication data (set_id=wages@wages.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:10:33:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:10:33:36 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:10:33:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 216.189.152.23
country_id: 6252001
description:
[2026-06-15 10:33:58 +0000] info [cpaneld] 216.189.152.23 NEW wcnyaruu:RivJGnUFt6qihbr_ address=216.189.152.23,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:10:33:38 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 195.7.12.78
country_id: 1522867
description:
2026-06-15 10:33:48 H=([195.7.12.78]) [195.7.12.78]:54420 F=<John@4452.com> rejected RCPT <kumar@white-ways.com>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.83.5.75
country_id: 3017382
description:
[2026-06-15 10:36:03 +0000] info [cpaneld] 51.83.5.75 - kwbcfbmo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kwbcfbmo (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 195.7.12.78
country_id: 1522867
description:
2026-06-15 10:35:56 H=([195.7.12.78]) [195.7.12.78]:55705 F=<John@4452.com> rejected RCPT <kumar@white-ways.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.109.174.168
country_id: 3469034
description:
Jun 15 10:36:42 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.109.174.168 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.186
country_id: 1880251
description:
47.128.121.186 - - [15/Jun/2026:10:38:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000274&pdata=https%253A%252F%252Fdirect7.tg%252Ftag%252Fmile-top-2019%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781519896 HTTP/2.0" 302 0 direct7.tg "https://direct7.tg/tag/mile-top-2019/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.186


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.130
country_id: 1880251
description:
47.128.96.130 - - [15/Jun/2026:10:40:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7104154&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fnoel%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781520011 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/noel/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.130


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 35.226.16.57
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Votre IP (35.226.16.57) a \xc3\xa9t\xc3\xa9 signal\xc3\xa9e pour de potentielles violations de s\xc3\xa9curit\xc3\xa9.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.16||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.0
country_id: 6252001
description:
205.169.39.0 - - [15/Jun/2026:10:41:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6449048&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DYWRlZWwua2hhbkBmYXRpbWEtZ3JvdXAuY29t&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781520077 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=YWRlZWwua2hhbkBmYXRpbWEtZ3JvdXAuY29t" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 200.150.240.220
country_id: 3895114
description:
200.150.240.220 - - [15/Jun/2026:10:41:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986394&pdata=https%253A%252F%252Ftogodailynews.tg%252Fla-cps-un-outil-strategique-essentiel-pour-la-reduction-de-lincidence-du-paludisme%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781520115 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/la-cps-un-outil-strategique-essentiel-pour-la-reduction-de-lincidence-du-paludisme/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.6351.1070 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:200.150.240.220


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.38.16.203
country_id: 6252001
description:
[2026-06-15 10:42:05 +0000] info [cpaneld] 45.38.16.203 - hcbcmrio "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User hcbcmrio has their account suspended. Login blocked.


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 45.38.16.203
country_id: 6252001
description:
[2026-06-15 10:42:05 +0000] info [cpaneld] 45.38.16.203 - lxsenjdd_farms "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lxsenjdd_farms (has_cpuser_file failed)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 102.64.220.79
country_id: 2363686
domain: togodailynews.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.16||T:APACHE||MV:/wp-json/wp/v2/users/1?context=view&_fields=id%2Cname&_locale=user||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:10:44:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7183557&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781520262 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:10:44:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10340505&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781520259 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:10:44:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7379096&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781520258 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 102.64.220.79
country_id: 2363686
domain: togodailynews.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.16||T:APACHE||MV:/wp-json/wp/v2/users?context=view&search=gmail.com&_locale=user||


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL track
abuser: 35.226.16.57
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: WordPress Bruteforce RBL track||Name:||WPU:||User:nrzector||Script:/home/nrzector/public_html/xmlrpc.php||RSV:8.17||T:APACHE||MV:/xmlrpc.php||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.103.121.241
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:10-47.146.103.121.241||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:10:48:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:10:48:15 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:10:48:14 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:10:48:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 35.226.16.57
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Votre IP (35.226.16.57) a \xc3\xa9t\xc3\xa9 signal\xc3\xa9e pour de potentielles violations de s\xc3\xa9curit\xc3\xa9.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 5.181.171.195
country_id: 2017370
domain: togosem.com
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:Fre@dJdl5820HDjfe.togosem.com||Method:wp.getUsersBlogs


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 102.64.220.79
country_id: 2363686
domain: togodailynews.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.17||T:APACHE||MV:/wp-json/wp/v2/users?context=view&who=authors&per_page=100&_fields=id%2Cname&_locale=user||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.103.121.241
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:10-51.146.103.121.241||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.56
country_id: 1880251
description:
47.128.121.56 - - [15/Jun/2026:10:52:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13289626&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcategory%252Fsociete%252Fpage%252F6%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781520721 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/category/societe/page/6/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.56


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 185.117.225.36
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.17||T:APACHE||MV:/index.php/wp-json/wp/v2/users/me?context=edit&_locale=user||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 10:52:54 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:42978: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.38.16.203
country_id: 6252001
description:
[2026-06-15 10:54:08 +0000] info [cpaneld] 45.38.16.203 - k.eklou "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user k.eklou (has_cpuser_file failed)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 195.63.20.20
country_id: 2921044
domain: mesyscom.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.17||T:APACHE||MV:/wp-json/wp/v2/users/||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 10:57:02 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:53264: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.142.159
country_id: 690791
description:
Jun 15 10:59:11 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.142.159 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:10:59:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10143389&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781521157 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 192.161.164.16
country_id: 1643084
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:togo-systeme-public-renforce-et-protection-sociale-accrue/||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:10:59:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9751190&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781521163 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 102.64.221.105
country_id: 2363686
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.17||T:APACHE||MV:/wp-json/wp/v2/users/2?context=view&_fields=id%2Cname&_locale=user||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:10:59:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923951&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781521159 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - e.gbevon@davakconsulting.com [06/15/2026:10:59:34 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: e.gbevon@davakconsulting.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.142.159
country_id: 690791
description:
Jun 15 10:59:24 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.142.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 11:01:07 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:36626: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.69
country_id: 3469034
description:
Jun 15 11:01:32 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.175.242.39
country_id: 2635167
description:
2026-06-15 11:01:46 dovecot_login authenticator failed for H=(cameg-togo.tg) [5.175.242.39]:46387: 535 Incorrect authentication data (set_id=sales@mail.cameg-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.141
country_id: 1880251
description:
47.128.96.141 - - [15/Jun/2026:11:03:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6713961&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Falpha-blondy%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781521412 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/alpha-blondy/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.141


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 11:03:54 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:53108: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:11:04:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:11:04:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:11:04:24 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:11:04:25 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 102.64.220.79
country_id: 2363686
domain: togodailynews.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.17||T:APACHE||MV:/wp-json/wp/v2/users/1?context=view&_fields=id%2Cname&_locale=user||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.243
country_id: 2363686
description:
2026-06-15 11:04:22 dovecot_login authenticator failed for H=(Nas) [154.70.82.243]:40412: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.74
country_id: 2635167
description:
[2026-06-15 11:05:00 +0000] info [cpaneld] 5.230.133.74 NEW wcnyaruu:52gcR29PtT5Hf636 address=5.230.133.74,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 186.233.115.58
country_id: 3469034
description:
186.233.115.58 - - [15/Jun/2026:11:06:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9685356&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcategory%252Fsociete%252Fpage%252F19%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781521559 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/category/societe/page/19/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.8071.1742 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:186.233.115.58


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 154.70.80.74
country_id: 2363686
description:
[2026-06-15 11:07:17 +0000] info [cpaneld] 154.70.80.74 NEW cloudetracks:Z6iQgukRvwMJbsLk address=154.70.80.74,app=cpaneld,creator=cloudetracks,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - nicolas.ah@cloud-et-racks.tg [06/15/2026:11:08:18 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: nicolas.ah@cloud-et-racks.tg


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.219.12.66
country_id: 3469034
description:
Jun 15 11:07:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.219.12.66 has been locked due to Imunify RBL


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 110.249.202.202
country_id: 1814991
domain: dagl.tg
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 11:07:58 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:55788: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.107
country_id: 1880251
description:
47.128.122.107 - - [15/Jun/2026:11:07:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10133353&pdata=https%253A%252F%252Ftogodailynews.tg%252Finondation-la-population-de-la-region-des-savanes-invitee-a-la-vigilance-et-au-respect-des-consignes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781521642 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/inondation-la-population-de-la-region-des-savanes-invitee-a-la-vigilance-et-au-respect-des-consignes/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.107


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 45.89.242.33
country_id: 2635167
domain: togosem.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/WordPressCore/||WPU:||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.31.20
country_id: 1880251
domain: belali.tg
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.56.227
country_id: 1643084
description:
[2026-06-15 11:08:30 +0000] info [whostmgrd] 157.66.56.227 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 157.66.56.227
country_id: 1643084
description:
[2026-06-15 11:08:32 +0000] info [whostmgrd] 157.66.56.227 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 11:10:05 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:46530: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 128.199.123.37
country_id: 1880251
description:
[2026-06-15 11:12:02 +0000] info [cpaneld] 128.199.123.37 - mesyscomcom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 77.68.83.86
country_id: 2635167
domain: ca-togo.org
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.17||T:APACHE||MV:/images/images/cache.php||SC:/home/egjvuiox/public_html/images/images||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.230.153.46
country_id: 2635167
description:
[2026-06-15 11:12:51 +0000] info [cpaneld] 5.230.153.46 - camaegdtomgo "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 185.192.69.161
country_id: 2635167
domain: togosem.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/aogodmm/public_html/wp-includes/sodium_compat/src/Compat.php||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 185.192.69.166
country_id: 2635167
domain: togosem.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/aogodmm/public_html/wp-includes/sodium_compat/src/Crypto32.php||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:11:13:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10393197&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781522002 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [15/Jun/2026:11:13:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10120339&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781522006 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.195.82.54
country_id: 6252001
description:
[2026-06-15 11:13:30 +0000] info [cpaneld] 134.195.82.54 - camaegdtomgo "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:11:13:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262165&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781522005 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 85.215.117.93
country_id: 2921044
description:
[2026-06-15 11:13:57 +0000] info [whostmgrd] 85.215.117.93 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.215.117.93
country_id: 2921044
description:
[2026-06-15 11:13:56 +0000] info [whostmgrd] 85.215.117.93 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.83.5.75
country_id: 3017382
description:
[2026-06-15 11:14:18 +0000] info [cpaneld] 51.83.5.75 - pduusmyf "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - kagbekoh@davakconsulting.com [06/15/2026:11:14:53 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: kagbekoh@davakconsulting.com


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 54.227.14.141
country_id: 6252001
domain: ns9.netmaster.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/138.0.7204.23 Safari/537.36||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:11:20:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:11:20:10 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.247.65.26
country_id: 2635167
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/uploads/2024/11/WhatsApp-Image-2024-11-09-at-12.17.17-768x432.jpeg HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.107
country_id: 1880251
description:
47.128.122.107 - - [15/Jun/2026:11:21:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988712&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftransfert-de-propriete-mecanisation-independante-de-plaintes-foncieres%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781522517 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/transfert-de-propriete-mecanisation-independante-de-plaintes-foncieres/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.107


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.57.52.109
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:POST http:/togodailynews.tg:80/wp-admin/admin-ajax.php HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 102.64.221.105
country_id: 2363686
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.17||T:APACHE||MV:/wp-json/wp/v2/users?context=view&search=l&_locale=user||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 102.64.221.105
country_id: 2363686
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.17||T:APACHE||MV:/wp-json/wp/v2/users?context=view&search=lacs1.mairie.t&_locale=user||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - kagbekoh@davakconsulting.com [06/15/2026:11:23:47 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: kagbekoh@davakconsulting.com


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.114.40
country_id: 2363686
description:
[2026-06-15 11:24:22 +0000] info [webmaild] 196.170.114.40 - agou1@agou1.mairie.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.169.31.202] != Current IP Address [196.170.114.40]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.173.39.103
country_id: 2017370
description:
2026-06-15 11:25:29 dovecot_plain authenticator failed for H=broadband-109-173-39-103.ip.moscow.rt.ru (unglize) [109.173.39.103]:58096: 535 Incorrect authentication data (set_id=arse@arse.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.173.39.103
country_id: 2017370
description:
Jun 15 11:25:27 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.173.39.103 has been locked due to Imunify RBL


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 104.243.196.251
country_id: 2661886
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:le-togo-accelere-son-ecosysteme-dinnovations-avec-des-initiatives-cles/||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.26
country_id: 2635167
description:
[2026-06-15 11:27:03 +0000] info [cpaneld] 5.230.153.26 NEW ifxmoxbf:WIojnR4yZXcEudmS address=5.230.153.26,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.110
country_id: 2635167
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.712998807909413.php||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:11:28:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9672294&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781522885 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:11:28:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7052697&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781522887 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 73.158.223.192
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/tag/covid-19/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.143.114.106
country_id: 3996063
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/category/evenement/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.37.119.53
country_id: 286963
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/category/football/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 23.20.64.76
country_id: 6252001
domain: case-afrique.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/129.0.0.0 Safari/537.36||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.161.186.154
country_id: 290291
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/visite-du-ministre-allemand-de-la-cooperation-economique-et-du-developpement HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:11:32:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:11:32:51 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 11:32:33 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:43258: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.97.77.135
country_id: 2328926
description:
2026-06-15 11:34:04 dovecot_plain authenticator failed for H=(localhost) [98.97.77.135]:41960: 535 Incorrect authentication data (set_id=kido@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.248.65.30
country_id: 1835841
description:
Jun 15 11:33:42 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.248.65.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 11:35:36 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:34862: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 181.191.144.194
country_id: 3469034
description:
181.191.144.194 - - [15/Jun/2026:11:35:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13201556&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcategory%252Fsociete%252Fpage%252F53%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781523342 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/category/societe/page/53/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.4434.1940 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:181.191.144.194


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 44.240.155.235
country_id: 6252001
domain: www.sahamtg.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:../dev/cmdb/sslvpn_websession HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:11:42:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13014423&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781523753 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 11:42:40 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:52806: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:11:42:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13082261&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781523753 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.50.216.71
country_id: 2661886
description:
[2026-06-15 11:43:51 +0000] info [cpaneld] 149.50.216.71 - Turbolte "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Turbolte (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 11:44:54 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:58124: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.185.173.167
country_id: 1814991
description:
Jun 15 11:44:35 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.185.173.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.185.173.167
country_id: 1814991
description:
2026-06-15 11:44:37 dovecot_login authenticator failed for H=(107-132-153-59.lightspeed.rcsntx.sbcglobal.net) [110.185.173.167]:60238: 535 Incorrect authentication data (set_id=dasha9198@atms.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.239.84.130
country_id: 2017370
description:
Jun 15 11:45:30 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.239.84.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.84.130
country_id: 2017370
description:
2026-06-15 11:45:32 dovecot_login authenticator failed for H=([200.107.163.195]) [83.239.84.130]:34037: 535 Incorrect authentication data (set_id=ayi@ekeasarl.com)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.165.143
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>le dynamisme \xc3\xa9conomique du togo s\xc3\xa9duit \xc3\xa0 nouveau les investisseurs de la sous-r\xc3\xa9gion. le tr\xc3\xa9sor public togolais a boucl\xc3\xa9, vendredi 12 juin dernier, une nouvelle op\xc3\xa9ration hautement r\xc3\xa9ussie sur le march\xc3\xa9 financier r\xc3\xa9gional de l\xe2\x80\x99union mon\xc3\xa9taire ouest-africaine (umoa), d\xc3\xa9passant ses objectifs initiaux.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>en qu\xc3\xaate de 35 milliards francs cfa pour soutenir ses projets de d\xc3\xa9veloppement, le tr\xc3\xa9sor public togolais a vu les propositions des investisseurs affluer. l'enveloppe globale mise sur la table par le march\xc3\xa9 a atteint le montant impressionnant de 89,4 milliards fcfa, soit un taux de couverture exceptionnel de 255,45 %.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31146,\"width\":\"634px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/image-30-724x1024.png\" alt=\"\" class=\"wp-image-31146\" style=\"width:634px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>face \xc3\xa0 cet engouement, le tr\xc3\xa9sor public a finalement retenu 38,5 milliards fcfa, une performance qui t\xc3\xa9moigne de la solide confiance des acteurs financiers dans la signature souveraine du pays.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>dans les d\xc3\xa9tails, l'op\xc3\xa9ration s'est appuy\xc3\xa9e sur des obligations assimilables du tr\xc3\xa9sor (oat) avec des maturit\xc3\xa9s \xc3\xa0 moyen et long terme, r\xc3\xa9mun\xc3\xa9r\xc3\xa9es sur des maturit\xc3\xa9s de 3, 5 et 7 ans, \xc3\xa0 des taux d\xe2\x80\x99int\xc3\xa9r\xc3\xaat respectifs de 6,15&nbsp;%, 6,35&nbsp;% et 6,50&nbsp;%.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>notons que le choix de diversifier les maturit\xc3\xa9s (3, 5 et 7 ans) permet \xc3\xa0 l'\xc3\x89tat togolais de lisser le remboursement de sa dette tout en s'adaptant aux diff\xc3\xa9rents profils d'investisseurs du march\xc3\xa9 de l'umoa.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img alt=\"\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>ce nouveau succ\xc3\xa8s vient gonfler les compteurs, car \xc3\xa0 ce jour, le montant total des fonds lev\xc3\xa9s par le togo s'\xc3\xa9l\xc3\xa8ve \xc3\xa0 181,5 milliards fcfa. le pays a ainsi d\xc3\xa9j\xc3\xa0 r\xc3\xa9alis\xc3\xa9 39,2 % de son objectif annuel, qui est fix\xc3\xa9 \xc3\xa0 463 milliards fcfa pour l'exercice en cours.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>la r\xc3\xa9daction</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 36.70.11.90
country_id: 1643084
description:
[2026-06-15 11:46:19 +0000] info [whostmgrd] 36.70.11.90 - anadebfreenetmas "POST /login?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.165.143
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>le dynamisme \xc3\xa9conomique du togo s\xc3\xa9duit \xc3\xa0 nouveau les investisseurs de la sous-r\xc3\xa9gion. le tr\xc3\xa9sor public togolais a boucl\xc3\xa9, vendredi 12 juin dernier, une nouvelle op\xc3\xa9ration hautement r\xc3\xa9ussie sur le march\xc3\xa9 financier r\xc3\xa9gional de l\xe2\x80\x99union mon\xc3\xa9taire ouest-africaine (umoa), d\xc3\xa9passant ses objectifs initiaux.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>en qu\xc3\xaate de 35 milliards francs cfa pour soutenir ses projets de d\xc3\xa9veloppement, le tr\xc3\xa9sor public togolais a vu les propositions des investisseurs affluer. l'enveloppe globale mise sur la table par le march\xc3\xa9 a atteint le montant impressionnant de 89,4 milliards fcfa, soit un taux de couverture exceptionnel de 255,45 %.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31146,\"width\":\"634px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/image-30-724x1024.png\" alt=\"\" class=\"wp-image-31146\" style=\"width:634px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>face \xc3\xa0 cet engouement, le tr\xc3\xa9sor public a finalement retenu 38,5 milliards fcfa, une performance qui t\xc3\xa9moigne de la solide confiance des acteurs financiers dans la signature souveraine du pays.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>dans les d\xc3\xa9tails, l'op\xc3\xa9ration s'est appuy\xc3\xa9e sur des obligations assimilables du tr\xc3\xa9sor (oat) avec des maturit\xc3\xa9s \xc3\xa0 moyen et long terme, r\xc3\xa9mun\xc3\xa9r\xc3\xa9es sur des maturit\xc3\xa9s de 3, 5 et 7 ans, \xc3\xa0 des taux d\xe2\x80\x99int\xc3\xa9r\xc3\xaat respectifs de 6,15&nbsp;%, 6,35&nbsp;% et 6,50&nbsp;%.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>notons que le choix de diversifier les maturit\xc3\xa9s (3, 5 et 7 ans) permet \xc3\xa0 l'\xc3\x89tat togolais de lisser le remboursement de sa dette tout en s'adaptant aux diff\xc3\xa9rents profils d'investisseurs du march\xc3\xa9 de l'umoa.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31157,\"width\":\"628px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/18d98b1d-0295-41c7-afab-fc9c13606bd0-724x1024.jpg\" alt=\"\" class=\"wp-image-31157\" style=\"width:628px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>ce nouveau succ\xc3\xa8s vient gonfler les compteurs, car \xc3\xa0 ce jour, le montant total des fonds lev\xc3\xa9s par le togo s'\xc3\xa9l\xc3\xa8ve \xc3\xa0 181,5 milliards fcfa. le pays a ainsi d\xc3\xa9j\xc3\xa0 r\xc3\xa9alis\xc3\xa9 39,2 % de son objectif annuel, qui est fix\xc3\xa9 \xc3\xa0 463 milliards fcfa pour l'exercice en cours.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>la r\xc3\xa9daction</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:11:49:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:11:49:06 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.6.38
country_id: 3469034
description:
Jun 15 11:49:37 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.6.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.142.167
country_id: 1814991
description:
Jun 15 11:50:09 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.142.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.98.41.27
country_id: 1269750
description:
Jun 15 11:49:37 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.98.41.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
country_id: 1814991
description:
2026-06-15 11:50:11 dovecot_login authenticator failed for H=([112.194.142.167]) [112.194.142.167]:38764: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.143.235.118
country_id: 1835841
description:
Jun 15 11:49:54 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.143.235.118 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-15 11:51:06 +0000] info [webmaild] 196.171.46.177 - contact@togointerim.net "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.51.44.46
country_id: 798544
description:
Jun 15 11:51:06 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.51.44.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.173
country_id: 1269750
description:
Jun 15 11:51:07 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.184.85.167
country_id: 3469034
description:
Jun 15 11:50:19 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.184.85.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.6.38
country_id: 3469034
description:
Jun 15 11:50:19 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.6.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.242
country_id: 1269750
description:
Jun 15 11:50:35 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.75.215.245
country_id: 1269750
description:
Jun 15 11:51:08 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.75.215.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.142.167
country_id: 1814991
description:
Jun 15 11:51:00 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.142.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.184.85.167
country_id: 3469034
description:
Jun 15 11:51:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.184.85.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.239.84.130
country_id: 2017370
description:
Jun 15 11:51:47 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.239.84.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.6.38
country_id: 3469034
description:
Jun 15 11:52:11 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.6.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.22.48.19
country_id: 2017370
description:
Jun 15 11:52:11 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.22.48.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.75.215.245
country_id: 1269750
description:
Jun 15 11:51:55 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.75.215.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.76.106.13
country_id: 6252001
description:
Jun 15 11:52:08 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.76.106.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.239.84.130
country_id: 2017370
description:
Jun 15 11:52:38 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.239.84.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 11:53:13 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:33608: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.129.64.214
country_id: 6252001
description:
2026-06-15 11:54:15 dovecot_plain authenticator failed for H=(33sd8yh9pst3vmet2r9cn9a2847x) [23.129.64.214]:46375: 535 Incorrect authentication data (set_id=wilfried.t@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.115.219.90
country_id: 1814991
description:
Jun 15 11:54:54 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.115.219.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.115.219.90
country_id: 1814991
description:
2026-06-15 11:54:56 dovecot_login authenticator failed for H=([103.147.248.44]) [49.115.219.90]:50488: 535 Incorrect authentication data (set_id=elogdoyoih@otr.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.0.117.79
country_id: 3469034
domain: derou.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/derou.tg/contact HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:11:56:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7379353&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781524575 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:11:56:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6331336&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781524571 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 102.64.220.79
country_id: 2363686
domain: togodailynews.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.17||T:APACHE||MV:/wp-json/wp/v2/users?context=view&search=gmail.com&_locale=user||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 163.198.111.25
country_id: 953987
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:163.198.111.25||TA:163.198.111.25||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 11:56:40 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:44088: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 205.169.39.15
country_id: 6252001
domain: ucao-uut.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/127.0.6533.119 Safari/537.36||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.32.184
country_id: 298795
description:
Jun 15 11:58:03 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.32.184 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 185.132.179.31
country_id: 2750405
domain: snb.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:72769.snb.tg||ServerName:snb.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:64cf8a8360149b75074f419ecbf7a0e38dc27b4e||Title:0xd4aa95fe||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 11:59:12 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:56184: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 91.132.198.12
country_id: 6252001
domain: www.letabloid.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:andreaslerma410||Email:andreas.andreas@cebovi.greenweed.sbs||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77142124
name: IM360 WAF: Track WordPress registration flood
abuser: 91.132.198.12
country_id: 6252001
domain: www.letabloid.tg
description:
IM360 WAF: Track WordPress registration flood||WPU:||RSV:8.17||T:APACHE||MVN:ARGS:action||MV:register||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.169.24.40
country_id: 2363686
domain: togomedia24.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.17||T:APACHE||MV:/wp-json/wp/v2/users/me?context=edit&_locale=user||


plugin: modsec
rule: 77317977
name: IM360 WAF: Sensitive Information Disclosure in OptinMonster plugin for WordPress (CVE-2021-39341)
abuser: 196.169.24.40
country_id: 2363686
domain: togomedia24.tg
description:
IM360 WAF: Sensitive Information Disclosure in OptinMonster plugin for WordPress (CVE-2021-39341)||RSV:8.17||T:APACHE||User:ecukpqcm||


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 40.114.79.135
country_id: 6252001
domain: www.gstock.soena.tg
description:
IM360 WAF: Request body parsing error||err_msg:Multipart parsing error: Multipart: No boundaries found in payload.||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 40.114.79.135
country_id: 6252001
domain: www.gstock.soena.tg
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.15.170.24
country_id: 3175395
description:
2026-06-15 12:01:31 dovecot_login authenticator failed for H=host024-170-015-185.retemetis.net [185.15.170.24]:44959: 535 Incorrect authentication data (set_id=test@arse.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 12:03:00 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:50588: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: www.securite.cloud-et-racks.tg
description:


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.50.216.71
country_id: 2661886
description:
[2026-06-15 12:02:27 +0000] info [cpaneld] 149.50.216.71 - Turbolte "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Turbolte (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:12:04:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:12:04:50 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-15 12:05:09 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:60842: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.75.124.28
country_id: 1562822
description:
[2026-06-15 12:05:37 +0000] info [cpaneld] 27.75.124.28 - togoinrdceh "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.169.24.40
country_id: 2363686
domain: togomedia24.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<span style=\"font-family: verdana, geneva, sans-serif;\">quelques jours apr\xc3\xa8s la r\xc3\xa9union de haut niveau du 18 avril, le togo a officiellement lanc\xc3\xa9 sa strat\xc3\xa9gie togo-sahel 2026-2028. cette feuille de route ambitieuse place lom\xc3\xa9 comme un pont entre le sahel et la communaut\xc3\xa9 internationale. elle repose sur cinq piliers principaux, dont le dialogue politique avec l\xe2\x80\x99alliance des \xc3\x89tats du sahel (aes).</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">le ministre des affaires \xc3\xa9trang\xc3\xa8res, robert dussey, a insist\xc3\xa9 sur le r\xc3\xb4le de m\xc3\xa9diateur que le togo souhaite jouer. des d\xc3\xa9l\xc3\xa9gations du mali, du burkina faso et du niger ont salu\xc3\xa9 cette initiative, vue comme une opportunit\xc3\xa9 de coop\xc3\xa9ration concr\xc3\xa8te au-del\xc3\xa0 des divisions r\xc3\xa9gionales.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">cette strat\xc3\xa9gie intervient dans un contexte de tensions persistantes au sahel, avec des besoins urgents en mati\xc3\xa8re de s\xc3\xa9curit\xc3\xa9, de d\xc3\xa9veloppement et d\xe2\x80\x99int\xc3\xa9gration \xc3\xa9conomique. le togo propose une approche pragmatique, loin des id\xc3\xa9ologies, centr\xc3\xa9e sur les r\xc3\xa9alit\xc3\xa9s du terrain.</span>\r\n\r\n<span style=\"font-family: verdana, geneva, sans-serif;\">les analystes estiment que cette d\xc3\xa9marche renforce la visibilit\xc3\xa9 diplomatique du pays et pourrait ouvrir la voie \xc3\xa0 de nouveaux financements internationaux pour des projets transfrontaliers. la mise en \xc5\x93uvre d\xc3\xa9butera progressivement dans les prochains mois.</span>||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.48
country_id: 2635167
description:
[2026-06-15 12:07:04 +0000] info [cpaneld] 5.230.153.48 NEW wcnyaruu:4scIRzI6Cpadtecf address=5.230.153.48,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: www.selithgroup.com
description:


