# incident

plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:02:08:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:02:08:10 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:02:08:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 173.211.89.140
country_id: 6252001
description:
[2026-06-17 02:08:15 +0000] info [cpaneld] 173.211.89.140 NEW formationfreenet:hDeoBYheNHD998xw address=173.211.89.140,app=cpaneld,creator=formationfreenet,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:02:08:08 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 103.53.219.166
country_id: 2077456
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:103.53.219.166||TA:103.53.219.166||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.175.242.62
country_id: 2635167
description:
2026-06-17 02:08:56 dovecot_login authenticator failed for H=(cameg-togo.tg) [5.175.242.62]:12805: 535 Incorrect authentication data (set_id=sales@mail.cameg-togo.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.252.193.234
country_id: 6251999
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:104.252.193.234||TA:104.252.193.234||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 46.203.103.104
country_id: 2077456
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:46.203.103.104||TA:46.203.103.104||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.238.36.149
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:104.238.36.149||TA:104.238.36.149||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.156
country_id: 2635167
description:
[2026-06-17 02:10:11 +0000] info [cpaneld] 5.230.153.156 NEW zykoahbv:pguPpWzJQSlmXkP_ address=5.230.153.156,app=cpaneld,creator=zykoahbv,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.252.136.70
country_id: 2635167
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:104.252.136.70||TA:104.252.136.70||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.38
country_id: 2635167
domain: delxia.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/zykoahbv/public_html/.300599567516051.php||RSV:8.18||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.250.204.82
country_id: 3144096
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:104.250.204.82||TA:104.250.204.82||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.127.250.242
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:45.127.250.242||TA:45.127.250.242||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.102.210
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:152.232.102.210||TA:152.232.102.210||


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 64.44.62.228
country_id: 6252001
domain: delxia.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/zykoahbv/public_html/.796602686342824.php||RSV:8.18||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.27.173
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:184.174.27.173||TA:184.174.27.173||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.105.128
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:104.239.105.128||TA:104.239.105.128||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.42.116.98
country_id: 2750405
description:
Jun 17 02:11:13 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.42.116.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.42.116.98
country_id: 2750405
description:
2026-06-17 02:11:15 dovecot_plain authenticator failed for H=(fiyvo0sh6dgbalcyd8f) [192.42.116.98]:58929: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 174.140.254.64
country_id: 6252001
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:174.140.254.64||TA:174.140.254.64||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.143.224.37
country_id: 2635167
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:104.143.224.37||TA:104.143.224.37||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 190.14.143.188
country_id: 3595528
description:
2026-06-17 02:12:00 H=([190.14.143.188]) [190.14.143.188]:15598 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 02:12:55 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 88.80.26.2
country_id: 2661886
description:
88.80.26.2 - doufelg [17/Jun/2026:02:13:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10067051&pdata=https%253A%252F%252Fsp-eau.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781662391 HTTP/2.0" 302 0 sp-eau.tg "https://sp-eau.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:88.80.26.2


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 179.48.110.213
country_id: 3469034
description:
179.48.110.213 - - [17/Jun/2026:02:14:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001607&pdata=https%253A%252F%252Ftdn.tg%252Fcentres-traitement-informatique-bceao-recrute%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781662468 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/centres-traitement-informatique-bceao-recrute/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.6854.1293 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:179.48.110.213


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.101.235
country_id: 3865483
description:
Jun 17 02:15:10 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.101.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.42.116.49
country_id: 2750405
description:
2026-06-17 02:16:08 dovecot_plain authenticator failed for H=(ptpc50hwa33e1y1evx52wg) [192.42.116.49]:36224: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.42.116.49
country_id: 2750405
description:
Jun 17 02:16:06 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.42.116.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.101.235
country_id: 3865483
description:
Jun 17 02:15:24 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.101.235 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:02:16:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053012&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781662593 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:02:16:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10118806&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781662584 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [17/Jun/2026:02:16:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7248020&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781662584 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.147.41
country_id: 1819730
description:
Jun 17 02:17:23 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.147.41 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.198.13.207
country_id: 241170
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-18.196.198.13.207||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [17/Jun/2026:02:19:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10316180&pdata=http%253A%252F%252Fcrepsad.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781662768 HTTP/1.1" 302 0 crepsad.tg "http://crepsad.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 02:19:50 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:02:21:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10077087&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781662894 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:02:21:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116910&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781662894 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.246
country_id: 2077456
description:
103.1.212.246 - - [17/Jun/2026:02:21:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10261602&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781662894 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.246


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.83.16
country_id: 6252001
description:
[2026-06-17 02:21:44 +0000] info [cpaneld] 134.195.83.16 NEW wwayrzpl:dJnN45yshJAcY69h address=134.195.83.16,app=cpaneld,creator=wwayrzpl,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:02:24:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:02:24:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:02:24:40 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:02:24:40 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 145.239.188.122
country_id: 3017382
description:
Jun 17 02:25:38 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 145.239.188.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 145.239.188.122
country_id: 3017382
description:
2026-06-17 02:25:40 dovecot_login authenticator failed for H=ip122.ip-145-239-188.eu (ldhktpS) [145.239.188.122]:52477: 535 Incorrect authentication data (set_id=dagl)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 02:28:06 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.215.1.157
country_id: 290557
description:
2026-06-17 02:28:03 dovecot_plain authenticator failed for H=(univ.ucao-uut.tg) [31.215.1.157]:49652: 535 Incorrect authentication data (set_id=welborn.aflou@univ.ucao-uut.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.91.23.74
country_id: 6251999
description:
45.91.23.74 - - [17/Jun/2026:02:28:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10121112&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DYXJkaS5iYW51YWRqaUB0b3BpbmRvLmNvLmlk&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781663305 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=YXJkaS5iYW51YWRqaUB0b3BpbmRvLmNvLmlk" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.91.23.74


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.252.115
country_id: 3469034
description:
Jun 17 02:29:41 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.252.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 145.239.188.122
country_id: 3017382
description:
Jun 17 02:30:05 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 145.239.188.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 145.239.188.122
country_id: 3017382
description:
2026-06-17 02:30:07 dovecot_login authenticator failed for H=ip122.ip-145-239-188.eu (LBp7TB) [145.239.188.122]:63494: 535 Incorrect authentication data (set_id=dagl)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.64.32
country_id: 6252001
description:
Jun 17 02:30:13 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.72.64.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.29.53
country_id: 1269750
description:
Jun 17 02:30:14 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.29.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.67
country_id: 1269750
description:
Jun 17 02:29:25 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.124.64
country_id: 798544
description:
Jun 17 02:29:39 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.124.64 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [17/Jun/2026:02:31:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131100&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781663477 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:02:31:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6592661&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781663475 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.177.158.57
country_id: 357994
description:
Jun 17 02:30:36 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.177.158.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.103.136.43
country_id: 3895114
description:
Jun 17 02:30:38 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.103.136.43 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:02:31:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328169&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781663471 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.64.32
country_id: 6252001
description:
Jun 17 02:30:38 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.72.64.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.76.106.13
country_id: 6252001
description:
Jun 17 02:30:51 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.76.106.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.252.115
country_id: 3469034
description:
Jun 17 02:31:01 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.252.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.36.194.131
country_id: 272103
description:
Jun 17 02:31:19 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.36.194.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.36.194.131
country_id: 272103
description:
Jun 17 02:31:26 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.36.194.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.29.53
country_id: 1269750
description:
Jun 17 02:31:41 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.29.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.182.244.243
country_id: 798544
description:
Jun 17 02:31:56 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.182.244.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 02:35:02 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:02:35:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6581351&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781663724 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.246
country_id: 2077456
description:
103.1.212.246 - - [17/Jun/2026:02:35:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10326678&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781663726 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.246


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:02:35:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934279&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781663725 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 206.206.69.187
country_id: 6252001
domain: cloud-et-racks.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:206.206.69.187||TA:206.206.69.187||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.87.68.194
country_id: 3175395
description:
Jun 17 02:38:19 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.87.68.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.87.68.194
country_id: 3175395
description:
Jun 17 02:38:26 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.87.68.194 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:02:41:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:02:41:05 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:02:41:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:02:41:05 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.42.126.163
country_id: 3469034
description:
[2026-06-17 02:41:49 +0000] info [cpaneld] 179.42.126.163 - droi "GET /login/?login_only=1&user=droi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user droi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.248.185.181
country_id: 3625428
description:
[2026-06-17 02:41:59 +0000] info [cpaneld] 38.248.185.181 - dr "GET /login/?login_only=1&user=dr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.251.101.87
country_id: 3996063
description:
[2026-06-17 02:41:26 +0000] info [cpaneld] 189.251.101.87 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.229.85.161
country_id: 3469034
description:
[2026-06-17 02:41:36 +0000] info [cpaneld] 200.229.85.161 - droitshu "GET /login/?login_only=1&user=droitshu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user droitshu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 90.68.207.154
country_id: 2510769
description:
[2026-06-17 02:41:40 +0000] info [cpaneld] 90.68.207.154 - droitsh "GET /login/?login_only=1&user=droitsh&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user droitsh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.59.3.42
country_id: 3686110
description:
[2026-06-17 02:41:55 +0000] info [cpaneld] 181.59.3.42 - dro "GET /login/?login_only=1&user=dro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dro (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.189.17.149
country_id: 337996
description:
[2026-06-17 02:41:33 +0000] info [cpaneld] 196.189.17.149 - droitshumainstg "GET /login/?login_only=1&user=droitshumainstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user droitshumainstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.71.66.23
country_id: 3469034
description:
[2026-06-17 02:41:40 +0000] info [cpaneld] 177.71.66.23 - droitsh "GET /login/?login_only=1&user=droitsh&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user droitsh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.232.94.115
country_id: 2017370
description:
[2026-06-17 02:41:43 +0000] info [cpaneld] 94.232.94.115 - droits "GET /login/?login_only=1&user=droits&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user droits (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.101.247.170
country_id: 2017370
description:
[2026-06-17 02:41:45 +0000] info [cpaneld] 92.101.247.170 - droit "GET /login/?login_only=1&user=droit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user droit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.183.102.171
country_id: 3865483
description:
[2026-06-17 02:41:46 +0000] info [cpaneld] 186.183.102.171 - droit "GET /login/?login_only=1&user=droit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user droit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.158.10.18
country_id: 1694008
description:
[2026-06-17 02:41:51 +0000] info [cpaneld] 136.158.10.18 - droi "GET /login/?login_only=1&user=droi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user droi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.13.195.108
country_id: 1733045
description:
[2026-06-17 02:41:27 +0000] info [cpaneld] 124.13.195.108 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.6.178.82
country_id: 1694008
description:
[2026-06-17 02:41:38 +0000] info [cpaneld] 124.6.178.82 - droitshu "GET /login/?login_only=1&user=droitshu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user droitshu (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 02:43:17 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.219.1.130
country_id: 2017370
description:
Jun 17 02:42:34 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.219.1.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.130.232
country_id: 99237
description:
Jun 17 02:42:50 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.130.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.224.121.157
country_id: 3469034
description:
Jun 17 02:44:45 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.224.121.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.24.114
country_id: 226074
description:
Jun 17 02:44:22 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.24.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.131.20
country_id: 99237
description:
Jun 17 02:45:25 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.131.20 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [17/Jun/2026:02:46:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10250606&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781664375 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:02:46:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6777189&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781664375 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:02:46:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7246996&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781664386 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:02:46:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988461&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781664390 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.246
country_id: 2077456
description:
103.1.212.246 - - [17/Jun/2026:02:49:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328216&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781664549 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.246


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:02:49:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9684078&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781664548 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:02:49:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9737575&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781664550 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.143.95.26
country_id: 2510769
description:
Jun 17 02:49:31 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.143.95.26 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [17/Jun/2026:02:49:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13080680&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253Da2Fnby1taW5hdG9AcHJlZi5rYWdvc2hpbWEubGcuanA%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781664586 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=a2Fnby1taW5hdG9AcHJlZi5rYWdvc2hpbWEubGcuanA=" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [17/Jun/2026:02:49:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10210202&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DdmlrcmFtLnNpbmdoQGphbGluZGlhLmNvLmlu&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781664589 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=dmlrcmFtLnNpbmdoQGphbGluZGlhLmNvLmlu" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [17/Jun/2026:02:49:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6604650&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DcmFpbmEuZG9yYUBqYWxpbmRpYS5jby5pbg%253D%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781664597 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=cmFpbmEuZG9yYUBqYWxpbmRpYS5jby5pbg==" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 02:50:13 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [17/Jun/2026:02:50:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9936753&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DcmFpbmEuZG9yYUBqYWxpbmRpYS5jby5pbg%253D%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781664631 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=cmFpbmEuZG9yYUBqYWxpbmRpYS5jby5pbg==" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 137.184.246.47
country_id: 6252001
description:
137.184.246.47 - - [17/Jun/2026:02:50:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10262630&pdata=http%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252Facf2d8c858075b0500387330fbe3e107%252Fea425e05eea2788cc063ebda30164563%252F6ceb254a8cb5490cf313a3dfacf56698%252F20b8a46017f76205f06cbecfe393b213%252F714c81ee2d0a7acc45a6c14cc2395b67%252Findex.php%253Fcmd%253Dlogin&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781664648 HTTP/1.1" 302 0 kpmg.tg "http://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/acf2d8c858075b0500387330fbe3e107/ea425e05eea2788cc063ebda30164563/6ceb254a8cb5490cf313a3dfacf56698/20b8a46017f76205f06cbecfe393b213/714c81ee2d0a7acc45a6c14cc2395b67/index.php?cmd=login" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Brave/1 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:137.184.246.47


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.48
country_id: 6252001
description:
205.169.39.48 - - [17/Jun/2026:02:51:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9660823&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DbS5zYXJrYXJAamFsaW5kaWEuY28uaW4%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781664674 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=bS5zYXJrYXJAamFsaW5kaWEuY28uaW4=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.48


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.138.150
country_id: 690791
description:
Jun 17 02:52:07 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.138.150 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [17/Jun/2026:02:52:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10067093&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DbS5zYXJrYXJAamFsaW5kaWEuY28uaW4%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781664744 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=bS5zYXJrYXJAamFsaW5kaWEuY28uaW4=" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.56
country_id: 6252001
description:
205.169.39.56 - - [17/Jun/2026:02:54:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6778723&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DdmlrcmFtLnNpbmdoQGphbGluZGlhLmNvLmlu&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781664840 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=dmlrcmFtLnNpbmdoQGphbGluZGlhLmNvLmlu" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.56


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.60
country_id: 3469034
description:
Jun 17 02:54:05 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.60 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.204
country_id: 6252001
description:
Jun 17 02:54:09 ns5 pure-ftpd[1532188]: (?@198.235.24.204) [INFO] New connection from 198.235.24.204


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.234.26.0
country_id: 1522867
description:
2026-06-17 02:55:11 H=([185.234.26.0]) [185.234.26.0]:24524 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 171.25.193.78
country_id: 2661886
description:
171.25.193.78 - sahamtg [17/Jun/2026:02:55:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131862&pdata=https%253A%252F%252Fsahamtg.com%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781664916 HTTP/2.0" 302 0 sahamtg.com "https://sahamtg.com:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:171.25.193.78


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:02:54:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:02:54:38 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:02:54:42 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:02:54:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [17/Jun/2026:02:54:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855014&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253Da2Fnby1taW5hdG9AcHJlZi5rYWdvc2hpbWEubGcuanA%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781664893 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=a2Fnby1taW5hdG9AcHJlZi5rYWdvc2hpbWEubGcuanA=" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [17/Jun/2026:02:55:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12872603&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DZ2F1cmF2LmphaW5AamFsaW5kaWEuY28uaW4%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781664946 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=Z2F1cmF2LmphaW5AamFsaW5kaWEuY28uaW4=" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 9.244.0.71
country_id: 6252001
description:
2026-06-17 02:57:33 dovecot_plain authenticator failed for H=dhcp-9-244-0-71.gobrightspeed.net (u0e08rvqi3ojyip0) [9.244.0.71]:41541: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 9.244.0.71
country_id: 6252001
description:
Jun 17 02:57:31 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 9.244.0.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 02:58:28 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.61.184.51
country_id: 6252001
description:
45.61.184.51 - zxtqbmmj [17/Jun/2026:02:58:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7052948&pdata=https%253A%252F%252Fperfect-labo.com%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781665130 HTTP/2.0" 302 0 perfect-labo.com "https://perfect-labo.com:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.61.184.51


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:03:00:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12949657&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781665240 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [17/Jun/2026:03:00:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6844050&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781665244 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:03:00:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7104968&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781665243 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.58.10.200
country_id: 6252001
description:
2026-06-17 03:01:14 dovecot_plain authenticator failed for H=(anozmk94hm8v8zypumpzpym) [172.58.10.200]:24984: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.40.3.95
country_id: 2017370
description:
[2026-06-17 03:01:54 +0000] info [cpaneld] 77.40.3.95 - kavznjyb "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kavznjyb (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [17/Jun/2026:03:02:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6843548&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DYW5hbmQuc2FjaGFuQGphbGluZGlhLmNvLmlu&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781665374 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=YW5hbmQuc2FjaGFuQGphbGluZGlhLmNvLmlu" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:03:04:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6450071&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781665472 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:03:04:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10143436&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781665473 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.246
country_id: 2077456
description:
103.1.212.246 - - [17/Jun/2026:03:04:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999726&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781665477 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.246


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.39.142.51
country_id: 3469034
description:
Jun 17 03:05:47 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.39.142.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 03:05:25 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [17/Jun/2026:03:08:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000538&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DbGl2aWtvQG5ldGV4cHJlc3MuZWU%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781665713 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=bGl2aWtvQG5ldGV4cHJlc3MuZWU=" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.165.214
country_id: 3469034
description:
Jun 17 03:10:19 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.165.214 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:03:10:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:03:10:26 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:03:10:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.91.23.74
country_id: 6251999
description:
45.91.23.74 - - [17/Jun/2026:03:10:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7038057&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DYWRtaW5AdHlsb24uY29t&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781665823 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=YWRtaW5AdHlsb24uY29t" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.91.23.74


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.165.214
country_id: 3469034
description:
Jun 17 03:10:27 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.165.214 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:03:10:23 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.203.231.220
country_id: 2464461
description:
Jun 17 03:12:04 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.203.231.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2026-06-17 03:12:06 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:41140: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.27.42.6
country_id: 6252001
description:
[2026-06-17 03:12:07 +0000] info [cpaneld] 34.27.42.6 - mesyscomcom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [17/Jun/2026:03:12:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6713238&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DbWtnaGFtZGlAbnVwY28uY29t&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781665971 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=bWtnaGFtZGlAbnVwY28uY29t" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [17/Jun/2026:03:12:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934438&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DaWxhbHQtY0BudXBjby5jb20%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781665972 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=aWxhbHQtY0BudXBjby5jb20=" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [17/Jun/2026:03:13:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6463131&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DbWRvc3NhcnktY0BudXBjby5jb20%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781665998 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=bWRvc3NhcnktY0BudXBjby5jb20=" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [17/Jun/2026:03:13:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10078316&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DbWtnaGFtZGlAbnVwY28uY29t&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781666004 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=bWtnaGFtZGlAbnVwY28uY29t" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 03:13:40 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:03:14:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051422&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781666055 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.144
country_id: 6252001
description:
Jun 17 03:14:15 ns5 pure-ftpd[1543253]: (?@198.235.24.144) [INFO] New connection from 198.235.24.144


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.14
country_id: 6252001
description:
205.169.39.14 - - [17/Jun/2026:03:14:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10064788&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DbGl2aWtvQG5ldGV4cHJlc3MuZWU%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781666064 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=bGl2aWtvQG5ldGV4cHJlc3MuZWU=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.14


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [17/Jun/2026:03:14:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9660309&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781666066 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:03:14:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7129195&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781666067 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.129
country_id: 1880251
description:
47.128.121.129 - - [17/Jun/2026:03:15:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9684626&pdata=https%253A%252F%252Ftogomedia24.tg%252F2019%252F07%252F18%252Flocales-2019-la-cour-supreme-rend-son-verdict%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781666106 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/2019/07/18/locales-2019-la-cour-supreme-rend-son-verdict/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [17/Jun/2026:03:15:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050644&pdata=http%253A%252F%252Fflp-tg.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781666128 HTTP/1.1" 302 0 flp-tg.com "http://flp-tg.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 100.53.131.216
country_id: 6252001
domain: cloud-et-racks.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/138.0.7204.23 Safari/537.36||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 142.111.152.59
country_id: 6252001
description:
142.111.152.59 - - [17/Jun/2026:03:16:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12950214&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DY2hyaXN0ZXJyZXluZWxAZHluYWNpYXRlLmNvbS5teQ%253D%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781666175 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=Y2hyaXN0ZXJyZXluZWxAZHluYWNpYXRlLmNvbS5teQ==" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:142.111.152.59


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.91.23.74
country_id: 6251999
description:
45.91.23.74 - - [17/Jun/2026:03:16:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9815447&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DcmFmZXphaEBlbmVncm91cC5jb20ubXk%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781666200 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=cmFmZXphaEBlbmVncm91cC5jb20ubXk=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.91.23.74


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.162.209.1
country_id: 1210997
description:
103.162.209.1 - - [17/Jun/2026:03:16:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6789781&pdata=https%253A%252F%252Fcfpj.tg%252Ftag%252Fblog%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781666209 HTTP/2.0" 302 0 cfpj.tg "https://cfpj.tg/tag/blog/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.6260.1955 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.162.209.1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
country_id: 6252001
description:
2026-06-17 03:18:31 dovecot_login authenticator failed for H=([119.152.102.54]) [74.208.177.56]:56582: 535 Incorrect authentication data (set_id=webmaster@anrtogo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.208.177.56
country_id: 6252001
description:
Jun 17 03:18:29 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.208.177.56 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:03:18:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12950167&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781666318 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.190.6.122
country_id: 2017370
description:
Jun 17 03:19:04 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.190.6.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.190.6.122
country_id: 2017370
description:
2026-06-17 03:19:06 dovecot_login authenticator failed for H=([41.128.181.196]) [94.190.6.122]:43702: 535 Incorrect authentication data (set_id=webmaster)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:03:18:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6385000&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781666317 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.246
country_id: 2077456
description:
103.1.212.246 - - [17/Jun/2026:03:18:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6801000&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781666317 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.246


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [17/Jun/2026:03:19:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13266323&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781666338 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.195
country_id: 1668284
description:
2026-06-17 03:20:22 dovecot_login authenticator failed for H=([36.135.62.96]) [101.13.5.195]:46160: 535 Incorrect authentication data (set_id=webmaster@anrtogo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [17/Jun/2026:03:19:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050394&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DbW5pc3RoYXItY0BudXBjby5jb20%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781666369 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=bW5pc3RoYXItY0BudXBjby5jb20=" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [17/Jun/2026:03:19:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803976&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253Dai5hbGplbnRlcmFAa2J0LmNvbS5rdw%253D%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781666371 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=ai5hbGplbnRlcmFAa2J0LmNvbS5rdw==" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [17/Jun/2026:03:19:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9947035&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781666394 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.5.195
country_id: 1668284
description:
Jun 17 03:20:20 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.5.195 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.91.23.74
country_id: 6251999
description:
45.91.23.74 - - [17/Jun/2026:03:20:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9870698&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DZW1pbHkubW9vQG9pZXNiLmNvbQ%253D%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781666423 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=ZW1pbHkubW9vQG9pZXNiLmNvbQ==" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.91.23.74


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 03:20:37 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 218.57.246.219
country_id: 1814991
description:
2026-06-17 03:21:45 H=([218.57.246.219]) [218.57.246.219]:64096 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [17/Jun/2026:03:22:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6933189&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253Dcm1xYWJiYW5pQG51cGNvLmNvbQ%253D%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781666558 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=cm1xYWJiYW5pQG51cGNvLmNvbQ==" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [17/Jun/2026:03:22:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10064538&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253Dc2t1bWFyLnNtc2FAbnVwY28uY29t&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781666557 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=c2t1bWFyLnNtc2FAbnVwY28uY29t" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.89.246.29
country_id: 6252001
description:
47.89.246.29 - - [17/Jun/2026:03:23:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7052138&pdata=http%253A%252F%252Fbrmn.tg%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781666609 HTTP/1.1" 302 0 brmn.tg "http://brmn.tg:2082/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.89.246.29


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.227.227
country_id: 6252001
description:
47.77.227.227 - - [17/Jun/2026:03:23:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000284&pdata=http%253A%252F%252Ftogomedia24.tg%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781666609 HTTP/1.1" 302 0 togomedia24.tg "http://togomedia24.tg:2082/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.77.227.227


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:03:24:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.88.94.125
country_id: 6252001
description:
47.88.94.125 - - [17/Jun/2026:03:23:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9989226&pdata=http%253A%252F%252Fcafe.tg%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781666601 HTTP/1.1" 302 0 cafe.tg "http://cafe.tg:2082/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.88.94.125


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.118.89
country_id: 6252001
description:
47.251.118.89 - - [17/Jun/2026:03:23:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6711909&pdata=http%253A%252F%252Fdagl.tg%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781666619 HTTP/1.1" 302 0 dagl.tg "http://dagl.tg:2082/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.118.89


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:03:24:02 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:03:24:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:03:24:05 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.245
country_id: 1643084
description:
[2026-06-17 03:24:24 +0000] info [cpaneld] 185.213.83.245 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.117.2
country_id: 226074
description:
Jun 17 03:25:16 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.117.2 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [17/Jun/2026:03:25:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12884333&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DbWRvc3NhcnktY0BudXBjby5jb20%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781666752 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=bWRvc3NhcnktY0BudXBjby5jb20=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.117.2
country_id: 226074
description:
Jun 17 03:25:23 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.117.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-06-17 03:26:05 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:35036: 535 Incorrect authentication data (set_id=egnassingbe@golfe3.mairie.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.251
country_id: 3469034
description:
Jun 17 03:25:36 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.251 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [17/Jun/2026:03:26:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6658665&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253Dc211ZGRpbmF6aXotY0BudXBjby5jb20%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781666783 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=c211ZGRpbmF6aXotY0BudXBjby5jb20=" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.105.206
country_id: 1814991
description:
2026-06-17 03:26:30 dovecot_login authenticator failed for H=([60.173.105.206]) [60.173.105.206]:59165: 535 Incorrect authentication data (set_id=egnassingbe)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.173.105.206
country_id: 1814991
description:
Jun 17 03:26:28 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.173.105.206 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.14
country_id: 6252001
description:
205.169.39.14 - - [17/Jun/2026:03:26:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6984600&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DaHRzaGFtbWFyaUBudXBjby5jb20%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781666781 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=aHRzaGFtbWFyaUBudXBjby5jb20=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.14


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [17/Jun/2026:03:26:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10052499&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253Dd2hoYXJiaUBudXBjby5jb20%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781666788 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=d2hoYXJiaUBudXBjby5jb20=" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.223.144
country_id: 1835841
description:
Jun 17 03:27:43 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.223.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-06-17 03:27:45 dovecot_login authenticator failed for H=([49.124.159.197]) [220.80.223.144]:36890: 535 Incorrect authentication data (set_id=evendeur@soena.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.22.212.32
country_id: 1269750
description:
[2026-06-17 03:27:25 +0000] info [cpaneld] 165.22.212.32 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 142.111.152.59
country_id: 6252001
description:
142.111.152.59 - - [17/Jun/2026:03:29:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050600&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DZW1haWxAcGV0cm9zdGVlbC5jb20uc2c%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781666951 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=ZW1haWxAcGV0cm9zdGVlbC5jb20uc2c=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:142.111.152.59


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 03:28:53 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.51
country_id: 6252001
description:
205.169.39.51 - - [17/Jun/2026:03:30:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6330984&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253Dai5hbGplbnRlcmFAa2J0LmNvbS5rdw%253D%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781667006 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=ai5hbGplbnRlcmFAa2J0LmNvbS5rdw==" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.51


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.208.46.130
country_id: 1522867
description:
Jun 17 03:29:48 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.208.46.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.102.190
country_id: 1269750
description:
Jun 17 03:29:28 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.102.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.102.190
country_id: 1269750
description:
2026-06-17 03:29:30 dovecot_login authenticator failed for H=([202.72.193.34]) [182.95.102.190]:38360: 535 Incorrect authentication data (set_id=pascaljoseph.panassi@sodigaz.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.130
country_id: 1522867
description:
2026-06-17 03:29:50 dovecot_login authenticator failed for H=([45.164.115.86]) [37.208.46.130]:58871: 535 Incorrect authentication data (set_id=pascaljoseph.panassi)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [17/Jun/2026:03:30:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7368045&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781667041 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:03:30:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7052998&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781667041 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:03:30:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804182&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781667042 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.245
country_id: 1643084
description:
[2026-06-17 03:31:48 +0000] info [cpaneld] 185.213.83.245 - afxvhoxo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afxvhoxo (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.189.130.157
country_id: 1269750
domain: sotranetogo.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:56703.sotranetogo.com||ServerName:sotranetogo.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:504bb815164f9dcbe5b9d59d6233687731a23e67||Title:0x96f27539||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.212.225.99
country_id: 1835841
description:
Jun 17 03:32:23 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.212.225.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-06-17 03:32:25 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:42858: 535 Incorrect authentication data (set_id=reseaux@soena.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.84.209.188
country_id: 1814991
description:
2026-06-17 03:32:42 dovecot_login authenticator failed for H=([103.93.37.178]) [223.84.209.188]:51682: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 129.213.158.102
country_id: 6252001
domain: 146.56.180.42:3333
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/146.56.180.42:3333/ HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.212.225.99
country_id: 1835841
description:
Jun 17 03:34:50 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.212.225.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-06-17 03:34:52 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:49212: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.246
country_id: 2077456
description:
103.1.212.246 - - [17/Jun/2026:03:35:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985923&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781667332 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.246


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2026-06-17 03:35:43 dovecot_login authenticator failed for H=(nsg-corporate-89.184.185.122.airtel.in) [119.160.166.237]:33412: 535 Incorrect authentication data (set_id=no-reply)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.147.8.160
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:03-36.45.147.8.160||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:03:35:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184041&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781667330 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 77.83.25.122
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:03-35.77.83.25.122||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 140.235.0.184
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:03-35.140.235.0.184||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.138
country_id: 1269750
description:
2026-06-17 03:35:32 dovecot_login authenticator failed for H=([59.145.116.161]) [182.95.184.138]:46016: 535 Incorrect authentication data (set_id=no-reply@anrtogo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.184.138
country_id: 1269750
description:
Jun 17 03:35:30 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.184.138 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.245.240.189
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:03-35.104.245.240.189||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 03:35:50 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2026-06-17 03:36:02 dovecot_login authenticator failed for H=([169.211.232.182]) [169.211.232.182]:37062: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 83.97.119.82
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:03-36.83.97.119.82||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 193.163.92.240
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:03-36.193.163.92.240||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 167.253.17.20
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:03-35.167.253.17.20||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 140.235.170.116
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:03-35.140.235.170.116||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.160.166.237
country_id: 1820814
description:
Jun 17 03:35:41 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.160.166.237 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 192.101.65.238
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:03-35.192.101.65.238||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 192.101.67.253
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:03-35.192.101.67.253||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 140.235.171.169
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:03-35.140.235.171.169||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.246.51.123
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:03-35.91.246.51.123||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 169.211.232.182
country_id: 1835841
description:
Jun 17 03:36:00 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 169.211.232.182 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 140.235.168.184
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:140.235.168.184||TA:140.235.168.184||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:03:35:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6527174&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781667330 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 178.20.212.251
country_id: 241170
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:03-36.178.20.212.251||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.51
country_id: 6252001
description:
205.169.39.51 - - [17/Jun/2026:03:37:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6396009&pdata=http%253A%252F%252Fflp-tg.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781667432 HTTP/1.1" 302 0 flp-tg.com "http://flp-tg.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.51


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 134.195.83.86
country_id: 6252001
domain: sahamtg.com
description:
IM360 WAF: Possible phishing page detected||SC:/home/sahamtg/public_html/.333876195296355.php||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.110.135
country_id: 1668284
description:
2026-06-17 03:37:45 dovecot_login authenticator failed for H=110-25-110-135.adsl.fetnet.net (ip-68-71-245-203.hosts.zerolag.com) [110.25.110.135]:49821: 535 Incorrect authentication data (set_id=webmaster@cameg-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.110.135
country_id: 1668284
description:
Jun 17 03:37:43 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.110.135 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:03:39:20 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:03:39:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 189.203.104.183
country_id: 3996063
description:
189.203.104.183 - - [17/Jun/2026:03:38:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13016725&pdata=https%253A%252F%252Fcpanel.techinoov.free.netmaster.tg%252F%253Flocale%253Dpl&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781667508 HTTP/2.0" 302 0 cpanel.techinoov.free.netmaster.tg "https://cpanel.techinoov.free.netmaster.tg/?locale=pl" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:189.203.104.183


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:03:39:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:03:39:19 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.168.26
country_id: 2661886
description:
2026-06-17 03:40:07 dovecot_login authenticator failed for H=90-230-168-26-no600.tbcn.telia.com ([182.95.115.194]) [90.230.168.26]:56652: 535 Incorrect authentication data (set_id=pascaljoseph.panassi@sodigaz.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.230.168.26
country_id: 2661886
description:
Jun 17 03:40:05 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.230.168.26 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.175.5.177
country_id: 6252001
description:
[2026-06-17 03:40:26 +0000] info [cpaneld] 107.175.5.177 NEW frtwilql:kcxAMxXdqzqRzj2n address=107.175.5.177,app=cpaneld,creator=frtwilql,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.99.193.135
country_id: 3469034
description:
Jun 17 03:40:43 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.99.193.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.99.193.135
country_id: 3469034
description:
2026-06-17 03:40:45 dovecot_login authenticator failed for H=([45.178.70.3]) [177.99.193.135]:40809: 535 Incorrect authentication data (set_id=pascaljoseph.panassi)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [17/Jun/2026:03:42:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13080682&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DY2NhY2hlcm9AZGxzaS51YS5lcw%253D%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781667759 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=Y2NhY2hlcm9AZGxzaS51YS5lcw==" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.125.196
country_id: 690791
description:
Jun 17 03:42:50 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.125.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 83.142.209.27
country_id: 2635167
description:
2026-06-17 03:42:24 H=([83.142.209.27]) [83.142.209.27]:65218 F=<mail@mailling.co.uk> rejected RCPT <whiteway@white-ways.com>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:03:43:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855319&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781667817 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 03:44:05 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [17/Jun/2026:03:43:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6657640&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781667808 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:03:43:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10381718&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781667816 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.172.84.2
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:eab930c1c833d54303819eebd237706cb7485978||Title:9xwklrcd0e7j9u||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.91.23.74
country_id: 6251999
description:
45.91.23.74 - - [17/Jun/2026:03:45:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065352&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253Dc2NmY3lAc2NmLWdyb3VwLmNvbQ%253D%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781667914 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=c2NmY3lAc2NmLWdyb3VwLmNvbQ==" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36 Edg/139.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.91.23.74


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [17/Jun/2026:03:46:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6515608&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DYWppdGhrdkB0cmFnc3FhdGFyLmNvbQ%253D%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781667962 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=YWppdGhrdkB0cmFnc3FhdGFyLmNvbQ==" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.172.84.2
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7b911ad2dc729563884f58f3b4771e53ec0ba21f||Title:8wklavc7sfxehh||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.172.84.2
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a8eee79776e3bf833295200ae1df5da87b309731||Title:afjw428vo2vba6tprv||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.187.22
country_id: 1269750
description:
2026-06-17 03:46:39 dovecot_login authenticator failed for H=([94.16.17.141]) [182.95.187.22]:51560: 535 Incorrect authentication data (set_id=evendeur@soena.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.237.183.81
country_id: 690791
description:
2026-06-17 03:46:48 dovecot_login authenticator failed for H=([49.124.152.145]) [91.237.183.81]:52184: 535 Incorrect authentication data (set_id=contact@cameg-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [17/Jun/2026:03:46:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9528472&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DYWppdGhrdkB0cmFnc3FhdGFyLmNvbQ%253D%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781668010 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=YWppdGhrdkB0cmFnc3FhdGFyLmNvbQ==" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.217.65.59
country_id: 6252001
description:
34.217.65.59 - - [17/Jun/2026:03:47:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9947289&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252Fcadfa3ecfb3cf582999aab5e7605639c%252Fb1aa8c55fef5735be643c306a6cd33ae%252Findex.php%253Fcmd%253Dnewupld%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781668019 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/cadfa3ecfb3cf582999aab5e7605639c/b1aa8c55fef5735be643c306a6cd33ae/index.php?cmd=newupld/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.114 Safari/537.36 Edge/18.19582" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.217.65.59


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [17/Jun/2026:03:46:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13070024&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DYWhtZWQucmVmYWlAbWVkZ3VsZmNvbnN0cnVjdGlvbi5jb20%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781667994 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=YWhtZWQucmVmYWlAbWVkZ3VsZmNvbnN0cnVjdGlvbi5jb20=" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.187.22
country_id: 1269750
description:
Jun 17 03:46:37 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.187.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.237.183.81
country_id: 690791
description:
Jun 17 03:46:46 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.237.183.81 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.3
country_id: 6252001
description:
205.169.39.3 - - [17/Jun/2026:03:48:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12951191&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DY2NhY2hlcm9AZGxzaS51YS5lcw%253D%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781668092 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=Y2NhY2hlcm9AZGxzaS51YS5lcw==" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.3


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.172.84.2
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4c9691a6b6d367ac69cdf34fafc24483754e4483||Title:8umcx2cfwx0vx8v5kt||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.172.84.2
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:adcacd20ecd2d1abe81a1bcf05a8516e03024eec||Title:6f67fw6ujk2t6v||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.8.120.90
country_id: 3469034
description:
Jun 17 03:48:53 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.8.120.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2026-06-17 03:48:55 dovecot_login authenticator failed for H=([195.222.57.183]) [187.8.120.90]:40015: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.177.78
country_id: 1269750
description:
Jun 17 03:49:29 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.177.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.187.213.29
country_id: 6252001
description:
Jun 17 03:49:44 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.187.213.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-06-17 03:49:46 dovecot_plain authenticator failed for H=(posts) [24.187.213.29]:46036: 535 Incorrect authentication data (set_id=admin@arse.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.172.84.2
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f475ff1177cc5cb5eab38a41305b1954fb3562b8||Title:plrcr6c306w6zg5||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.78
country_id: 1269750
description:
2026-06-17 03:49:31 dovecot_login authenticator failed for H=([174.75.211.217]) [182.95.177.78]:39630: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 142.111.152.59
country_id: 6252001
description:
142.111.152.59 - - [17/Jun/2026:03:50:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7117411&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253Danl0YW5nQGFsLWFtYmlhLmNvbS5teQ%253D%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781668208 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=anl0YW5nQGFsLWFtYmlhLmNvbS5teQ==" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:142.111.152.59


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-06-17 03:50:25 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:55780: 535 Incorrect authentication data (set_id=netflix@emt.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.172.84.2
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4adde7057f765b58c6369795483b5f54b43369bf||Title:guy1h77zei0rr8||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:03:50:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10274914&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781668223 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.246
country_id: 2077456
description:
103.1.212.246 - - [17/Jun/2026:03:50:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065558&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781668225 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.246


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:03:50:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9858967&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781668227 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 03:51:02 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.212.225.99
country_id: 1835841
description:
Jun 17 03:50:23 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.212.225.99 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.172.84.2
country_id: 1269750
domain: misstogo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:guillaume.misstogo.tg||ServerName:misstogo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:260eb814b213aff81ce020565e392163b6b81330||Title:y6hbi71qxq7akr9h||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.103.28.174
country_id: 3625428
description:
[2026-06-17 03:54:06 +0000] info [cpaneld] 190.103.28.174 - confortistg "GET /login/?login_only=1&user=confortistg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user confortistg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.104.32.82
country_id: 3865483
description:
[2026-06-17 03:54:09 +0000] info [cpaneld] 190.104.32.82 - confortis "GET /login/?login_only=1&user=confortis&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user confortis (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 116.111.185.249
country_id: 1562822
description:
[2026-06-17 03:54:12 +0000] info [cpaneld] 116.111.185.249 - conforti "GET /login/?login_only=1&user=conforti&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user conforti (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.104.52.64
country_id: 2589581
description:
[2026-06-17 03:54:12 +0000] info [cpaneld] 105.104.52.64 - confortistg "GET /login/?login_only=1&user=confortistg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user confortistg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.176.72.185
country_id: 3932488
description:
[2026-06-17 03:54:03 +0000] info [cpaneld] 181.176.72.185 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.24.60.173
country_id: 99237
description:
[2026-06-17 03:54:04 +0000] info [cpaneld] 185.24.60.173 - confortis "GET /login/?login_only=1&user=confortis&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user confortis (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.117.185.37
country_id: 2510769
description:
[2026-06-17 03:54:20 +0000] info [cpaneld] 79.117.185.37 - confor "GET /login/?login_only=1&user=confor&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user confor (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.214.134.159
country_id: 2921044
description:
[2026-06-17 03:54:01 +0000] info [cpaneld] 79.214.134.159 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.34.249.13
country_id: 174982
description:
[2026-06-17 03:54:25 +0000] info [cpaneld] 212.34.249.13 - conf "GET /login/?login_only=1&user=conf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user conf (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:03:54:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:03:54:30 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.255.250.97
country_id: 3686110
description:
[2026-06-17 03:54:23 +0000] info [cpaneld] 190.255.250.97 - confor "GET /login/?login_only=1&user=confor&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user confor (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.117.185.37
country_id: 2510769
description:
[2026-06-17 03:54:30 +0000] info [cpaneld] 79.117.185.37 - conf "GET /login/?login_only=1&user=conf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user conf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.22.52.254
country_id: 2017370
description:
[2026-06-17 03:54:23 +0000] info [cpaneld] 89.22.52.254 - confo "GET /login/?login_only=1&user=confo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user confo (has_cpuser_file failed)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:03:54:25 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:03:54:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.113.114.61
country_id: 3658394
description:
[2026-06-17 03:55:45 +0000] info [cpaneld] 181.113.114.61 - cloudetr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudetr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.70.223.135
country_id: 3469034
description:
[2026-06-17 03:57:42 +0000] info [cpaneld] 177.70.223.135 - fomd "GET /login/?login_only=1&user=fomd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fomd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.125.247.157
country_id: 1733045
description:
[2026-06-17 03:57:48 +0000] info [cpaneld] 27.125.247.157 - fomd "GET /login/?login_only=1&user=fomd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fomd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.195.184.244
country_id: 3865483
description:
[2026-06-17 03:57:35 +0000] info [cpaneld] 168.195.184.244 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.137.68.91
country_id: 294640
description:
[2026-06-17 03:57:36 +0000] info [cpaneld] 77.137.68.91 - fomda "GET /login/?login_only=1&user=fomda&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fomda (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.82.40.38
country_id: 6252001
description:
[2026-06-17 03:57:39 +0000] info [cpaneld] 75.82.40.38 - fomdatg "GET /login/?login_only=1&user=fomdatg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fomdatg (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.107.227.98
country_id: 248816
domain: derou.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/derou.tg/en/teams HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.205.160.85
country_id: 290557
description:
[2026-06-17 03:57:34 +0000] info [cpaneld] 176.205.160.85 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 03:59:17 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [17/Jun/2026:03:59:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13146993&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781668793 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.199.31.8
country_id: 2635167
description:
[2026-06-17 04:00:05 +0000] info [webmaild] 138.199.31.8 - rappels@mesyscom.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:04:00:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131301&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781668801 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:03:59:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856196&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781668789 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.141.42.115
country_id: 2260494
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1109499020 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.22
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5496bc40b88d8c5e8e1cb23cb0fc55a0ac86273d||Title:5ulisab1k3v5nh||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 142.111.152.59
country_id: 6252001
description:
142.111.152.59 - - [17/Jun/2026:04:04:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6973077&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DZW5xdWlyaWVzQHN1cmlhdmVudHVyZS5jb20%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781669095 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=ZW5xdWlyaWVzQHN1cmlhdmVudHVyZS5jb20=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:142.111.152.59


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.22
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7e3ecafd644eef3ed901d3b04b9c087cc4177a6f||Title:fmnrodyq1tomkum3n||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.22
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8d4c93e350e689a280c6a88d30d7529253a2f210||Title:66o1owfp0ond3ybwt||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 04:06:15 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.246
country_id: 2077456
description:
103.1.212.246 - - [17/Jun/2026:04:06:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7367624&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781669195 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.246


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:04:06:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132169&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781669197 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.22
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cc3cb829dd3365311f8d3d30824fdf80fa522c5d||Title:ut89rbkvpzjdy6e3wx||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:04:06:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7105898&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781669193 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.245
country_id: 1643084
description:
[2026-06-17 04:07:54 +0000] info [cpaneld] 185.213.83.245 - sprocaadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:04:08:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.22
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f95a29fd89abcaea86491d5739c0da2d0793efd7||Title:oem3hss5m88stqu||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:04:08:19 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:04:08:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:04:08:24 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.22
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d20e775f3292cbbf4af2916d0686ab12cd1b65b7||Title:0s19ecmkrf7xjgp4z||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.22
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5841aafb154def51aa132bda724a7f9d85e380b9||Title:b0zr9d2vcb7nmgrbym||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.22
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:69763ded484ad7eb463afefdfa9378fedc5e972b||Title:cnu4782ymatmtyosp||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 142.111.152.59
country_id: 6252001
description:
142.111.152.59 - - [17/Jun/2026:04:11:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9595031&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DcnVteW5za3lAZGVmYWdyb3VwLmNvbQ%253D%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781669482 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=cnVteW5za3lAZGVmYWdyb3VwLmNvbQ==" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:142.111.152.59


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.160.248.97
country_id: 6252001
description:
2026-06-17 04:12:19 dovecot_plain authenticator failed for H=c-73-160-248-97.hsd1.nj.comcast.net (rri4ehmq7ls1rvjaupvd86g9xlarj) [73.160.248.97]:49581: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.91.23.74
country_id: 6251999
description:
45.91.23.74 - - [17/Jun/2026:04:11:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12935875&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253Dbm5vdmdvcm9kQHN3dHJhdmVsLmF6&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781669480 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=bm5vdmdvcm9kQHN3dHJhdmVsLmF6" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.91.23.74


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.14
country_id: 3175395
description:
Jun 17 04:11:21 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.14 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.22
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:526f7d44b801ac6297cdc736843832f6ee0a0f6f||Title:sdlrlsbxt71qjkow||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.22
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c2cffd161a54208f0f5529c8ebfd1022915d170a||Title:2k0obr6q0pgvt5||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.91.23.74
country_id: 6251999
description:
45.91.23.74 - - [17/Jun/2026:04:13:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9868694&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253Dc2FsZXNfYm9ybmVvQGVuZWdyb3VwLmNvbS5teQ%253D%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781669608 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=c2FsZXNfYm9ybmVvQGVuZWdyb3VwLmNvbS5teQ==" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.91.23.74


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.137
country_id: 1880251
description:
47.128.96.137 - - [17/Jun/2026:04:13:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7063410&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fchymall-sairui%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781669629 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/chymall-sairui/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.137


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 34.48.113.242
country_id: 6252001
domain: flp-tg.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.18||T:APACHE||REQUEST_URI:/blog/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:04:14:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7248793&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781669648 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.22
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d5dda237e2e8c045345f2a5745b9a5c53b35976f||Title:frel1szuz391dqhhxp||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 04:14:28 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.22
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:abbb92f5eb6a2f84a4e54f79d93530c358c036ca||Title:k1ne0qylc6hiwpemk||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [17/Jun/2026:04:14:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9922968&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781669660 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.219.46.198
country_id: 3703430
domain: derou.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/derou.tg/Projet_Developpement HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77318023
name: IM360 WAF: Old style account creation and modification in Joomla!
abuser: 163.198.212.96
country_id: 2750405
domain: pnls.tg
description:
IM360 WAF: Old style account creation and modification in Joomla!||MVN:ARGS:view||MV:registration||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.22
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:88f7fcac40ac5f8e6e5ae509a90db711d342979c||Title:t4cb7qchfl21rylt||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.22
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b8f379601758fc447ea8c0392118c5c587c43bde||Title:l8sqyxh8lrd0sh5i||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.119.185
country_id: 1880251
description:
47.128.119.185 - - [17/Jun/2026:04:16:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9618329&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D9731&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781669812 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=9731" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.119.185


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [17/Jun/2026:04:17:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6972565&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253Dc2hvdW5vQHVlYy5hYy5qcA%253D%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781669875 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=c2hvdW5vQHVlYy5hYy5qcA==" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.22
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e0ce62673a7bb3435dd3e28fffd22c2de5bfcd1b||Title:xddybrj9k71qv1uhv||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.22
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7b2fdc97c015b52a6d978db8e3b3be93061b0eb8||Title:miflslaainb18j||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [17/Jun/2026:04:18:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6527176&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DdmluY2VudC50YW5keUBzYXRudXNhLmNvbQ%253D%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781669915 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=dmluY2VudC50YW5keUBzYXRudXNhLmNvbQ==" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.22
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:031bf2f9ec074ee699d75500bef0a79be7a41bfa||Title:odgxikgnalj8prj0h7||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:04:20:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13015962&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781670057 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:04:21:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212054&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781670060 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.246
country_id: 2077456
description:
103.1.212.246 - - [17/Jun/2026:04:21:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9881186&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781670059 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.246


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.22
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2ec4b548292ea81acb5f2896e676e78ae50fa9ec||Title:wso6bylkwxmeeoqimg||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.22
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:03963e33be7b7116a6f89c7bdf19732c1a719eae||Title:8g7lityzlxtgedoi1g||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 04:21:28 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.148
country_id: 3469034
description:
Jun 17 04:21:59 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.148 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.22
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:dced7ede6338c0766e9715ad7be56c008f1196ff||Title:rcvx24boczts713p||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.22
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6d69949f92d18f5c5f95e5f04f0e3edab01e4e89||Title:kagbhinc73a6ntj||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:04:25:17 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 217.8.46.165
country_id: 1220409
description:
2026-06-17 04:24:27 H=([217.8.46.165]) [217.8.46.165]:5525 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:04:25:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:04:25:15 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.149.240.251
country_id: 1168579
description:
103.149.240.251 - - [17/Jun/2026:04:25:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6658965&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DbXVoYW1tYWQua2FzaGlmMjdAaC1wYXJ0bmVycy5jb20%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781670319 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=bXVoYW1tYWQua2FzaGlmMjdAaC1wYXJ0bmVycy5jb20=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.149.240.251


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.22
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:945566f81aa2a372c5c647a3d5c221d58747548a||Title:yv5nvvcwi8w40tck6p||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:04:25:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.22
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b6d540f0202f1fdd862127eb2ed5ccf9cf40b998||Title:j5j0r6v5hfd4mbuu8z||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.56.231
country_id: 1643084
description:
[2026-06-17 04:25:33 +0000] info [cpaneld] 157.66.56.231 - AWADI "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user AWADI (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.215.43.75
country_id: 630336
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1603383986 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.22
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:eb88bec03f60a2bc9498b9701d2137a67def693e||Title:hif6ynkyxw9lx75m9||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:04:28:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9933716&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781670484 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.22
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:63a2a8c8a05b2a1e8dd5be95555d7b74a2143101||Title:1azrdetn5gz058||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:04:28:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6725019&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781670479 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [17/Jun/2026:04:29:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9882215&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DcmFpbmEuZG9yYUBqYWxpbmRpYS5jby5pbg%253D%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781670539 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=cmFpbmEuZG9yYUBqYWxpbmRpYS5jby5pbg==" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 199.101.196.1
country_id: 6252001
description:
[2026-06-17 04:29:07 +0000] info [cpaneld] 199.101.196.1 NEW libertepansel:XS7jR1e7pELJTRac address=199.101.196.1,app=cpaneld,creator=libertepansel,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [17/Jun/2026:04:28:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7127912&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781670499 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.22
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:edf6acce8e2c4072d44ca7b60049604ee9dac7e2||Title:c1nq6dthya61v84||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-17 04:30:10 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:50078: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.22
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:24c6d2b1e6aed9f9784fdbef35a57272e44efebf||Title:fjiu8hqumvzo1hc||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.22.255.28
country_id: 1814991
description:
2026-06-17 04:29:38 dovecot_login authenticator failed for H=([182.95.215.92]) [58.22.255.28]:37685: 535 Incorrect authentication data (set_id=pascaljoseph.panassi@sodigaz.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 04:29:43 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.157.22
country_id: 1861060
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:26c8130ae230edb8a970121d787552ea7e3b397b||Title:iulu80jhmej2v0ag||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.2.44.54
country_id: 1269750
description:
Jun 17 04:30:34 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.2.44.54 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 185.252.220.116
country_id: 798549
description:
[2026-06-17 04:32:01 +0000] info [webmaild] 185.252.220.116 - hboroze@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.211.30.233
country_id: 1210997
description:
[2026-06-17 04:35:12 +0000] info [cpaneld] 103.211.30.233 - ucoan "GET /login/?login_only=1&user=ucoan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucoan (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.118.80.174
country_id: 3686110
description:
[2026-06-17 04:35:13 +0000] info [cpaneld] 200.118.80.174 - ucoan "GET /login/?login_only=1&user=ucoan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucoan (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.188.83.59
country_id: 3469034
description:
[2026-06-17 04:34:52 +0000] info [cpaneld] 45.188.83.59 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.110.69.175
country_id: 290291
description:
[2026-06-17 04:35:08 +0000] info [cpaneld] 78.110.69.175 - ucoange "GET /login/?login_only=1&user=ucoange&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucoange (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.46.39.175
country_id: 3865483
description:
[2026-06-17 04:34:55 +0000] info [cpaneld] 181.46.39.175 - ucoangers "GET /login/?login_only=1&user=ucoangers&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucoangers (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 118.101.203.150
country_id: 1733045
description:
[2026-06-17 04:34:59 +0000] info [cpaneld] 118.101.203.150 - ucoangerstg "GET /login/?login_only=1&user=ucoangerstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucoangerstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.28.64.223
country_id: 3923057
description:
[2026-06-17 04:35:04 +0000] info [cpaneld] 189.28.64.223 - ucoanger "GET /login/?login_only=1&user=ucoanger&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucoanger (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.174.181.197
country_id: 2017370
description:
[2026-06-17 04:35:06 +0000] info [cpaneld] 85.174.181.197 - ucoange "GET /login/?login_only=1&user=ucoange&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucoange (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.166.214.237
country_id: 2635167
description:
[2026-06-17 04:35:19 +0000] info [cpaneld] 86.166.214.237 - uco "GET /login/?login_only=1&user=uco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user uco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.163.182.56
country_id: 1282988
description:
[2026-06-17 04:34:55 +0000] info [cpaneld] 103.163.182.56 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.246.108.124
country_id: 3895114
description:
[2026-06-17 04:35:00 +0000] info [cpaneld] 201.246.108.124 - ucoangerstg "GET /login/?login_only=1&user=ucoangerstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucoangerstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.95.151.116
country_id: 3686110
description:
[2026-06-17 04:35:09 +0000] info [cpaneld] 191.95.151.116 - ucoang "GET /login/?login_only=1&user=ucoang&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucoang (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.119.167.141
country_id: 2542007
description:
[2026-06-17 04:35:23 +0000] info [cpaneld] 196.119.167.141 - uc "GET /login/?login_only=1&user=uc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user uc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 90.194.104.135
country_id: 2635167
description:
[2026-06-17 04:34:57 +0000] info [cpaneld] 90.194.104.135 - ucoangers "GET /login/?login_only=1&user=ucoangers&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucoangers (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.244.62.203
country_id: 3469034
description:
[2026-06-17 04:35:23 +0000] info [cpaneld] 170.244.62.203 - uc "GET /login/?login_only=1&user=uc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user uc (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 04:36:42 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:04:37:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9674343&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781671036 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:04:37:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066330&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781671036 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.246
country_id: 2077456
description:
103.1.212.246 - - [17/Jun/2026:04:37:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9608298&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781671036 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.246


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.14
country_id: 3469034
description:
Jun 17 04:38:24 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.39
country_id: 798544
description:
Jun 17 04:38:44 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.253
country_id: 3175395
description:
Jun 17 04:39:42 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.204.199.194
country_id: 6252001
description:
Jun 17 04:41:19 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.204.199.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.204.199.194
country_id: 6252001
description:
2026-06-17 04:41:21 dovecot_plain authenticator failed for H=(ay14jvzrbflq2kl0pqgilsg5js) [68.204.199.194]:59410: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [17/Jun/2026:04:41:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7432645&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781671307 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:04:41:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7182786&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781671310 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:04:41:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10460055&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781671312 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:04:41:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:04:41:42 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:04:41:46 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:04:41:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 180.72.197.153
country_id: 1733045
description:
180.72.197.153 - - [17/Jun/2026:04:43:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9684117&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DbWFuZHlAZmxvd21hc3Rlci5jb20ubXk%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781671383 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=bWFuZHlAZmxvd21hc3Rlci5jb20ubXk=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Edg/149.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:180.72.197.153


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.57
country_id: 6252001
description:
205.169.39.57 - - [17/Jun/2026:04:42:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9921641&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DdmluY2VudC50YW5keUBzYXRudXNhLmNvbQ%253D%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781671351 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=dmluY2VudC50YW5keUBzYXRudXNhLmNvbQ==" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.57


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.56.231
country_id: 1643084
description:
[2026-06-17 04:44:11 +0000] info [cpaneld] 157.66.56.231 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.14.10
country_id: 226074
description:
Jun 17 04:43:33 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.14.10 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 62.197.45.116
country_id: 2750405
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:04-44.62.197.45.116||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 122.183.49.192
country_id: 1269750
domain: derou.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/derou.tg/fr/slides/11 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 04:44:58 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 66.146.233.252
country_id: 6252001
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:66.146.233.252||TA:66.146.233.252||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.239.249.31
country_id: 3017382
description:
[2026-06-17 04:45:50 +0000] info [cpaneld] 94.239.249.31 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.173.156.113
country_id: 3996063
description:
[2026-06-17 04:45:53 +0000] info [cpaneld] 187.173.156.113 - zephyr "GET /login/?login_only=1&user=zephyr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zephyr (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 5.157.52.30
country_id: 453733
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:04-45.5.157.52.30||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.105.75.169
country_id: 3865483
description:
[2026-06-17 04:45:58 +0000] info [cpaneld] 190.105.75.169 - zephy "GET /login/?login_only=1&user=zephy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zephy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.135.60.22
country_id: 2017370
description:
[2026-06-17 04:46:03 +0000] info [cpaneld] 88.135.60.22 - zep "GET /login/?login_only=1&user=zep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.45.59.20
country_id: 3469034
description:
[2026-06-17 04:46:06 +0000] info [cpaneld] 187.45.59.20 - ze "GET /login/?login_only=1&user=ze&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ze (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.225.60.26
country_id: 2464461
description:
[2026-06-17 04:45:55 +0000] info [cpaneld] 41.225.60.26 - zephyrtg "GET /login/?login_only=1&user=zephyrtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zephyrtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.230.74.68
country_id: 1512440
description:
[2026-06-17 04:46:01 +0000] info [cpaneld] 213.230.74.68 - zeph "GET /login/?login_only=1&user=zeph&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zeph (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.116.66
country_id: 1269750
description:
Jun 17 04:46:20 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.116.66 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.167.193.75
country_id: 2017370
description:
[2026-06-17 04:45:53 +0000] info [cpaneld] 213.167.193.75 - zephyr "GET /login/?login_only=1&user=zephyr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zephyr (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.116.66
country_id: 1269750
description:
2026-06-17 04:46:22 dovecot_login authenticator failed for H=(cdu16d12.cncm.ne.jp) [182.95.116.66]:58334: 535 Incorrect authentication data (set_id=info@cameg-togo.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.230.92.102
country_id: 1512440
description:
2026-06-17 04:47:05 H=([213.230.92.102]) [213.230.92.102]:42385 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 175.141.177.2
country_id: 1733045
description:
175.141.177.2 - - [17/Jun/2026:04:51:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935980&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Favenir-des-fintechs%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781671909 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/avenir-des-fintechs/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2499.1471 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:175.141.177.2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 04:51:56 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 142.111.152.59
country_id: 6252001
description:
142.111.152.59 - - [17/Jun/2026:04:52:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986135&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253Dc3VtYXJub0BlbmVncm91cC5jb20ubXk%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781671930 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=c3VtYXJub0BlbmVncm91cC5jb20ubXk=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:142.111.152.59


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.199.103.80
country_id: 6252001
description:
[2026-06-17 04:53:05 +0000] info [whostmgrd] 185.199.103.80 - root "GET /favicon.ico HTTP/1.1" FAILED LOGIN whostmgrd: login attempt to WHM with bad accesshash or API token


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 185.199.103.80
country_id: 6252001
description:
[2026-06-17 04:53:17 +0000] info [cpaneld] 185.199.103.80 NEW eevbufog:TjaNFc3Ak_wn648K address=185.199.103.80,app=cpaneld,creator=eevbufog,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:04:53:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053782&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781672031 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:04:53:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10380233&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781672029 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.246
country_id: 2077456
description:
103.1.212.246 - - [17/Jun/2026:04:53:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6579558&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781672032 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.246


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 210.245.94.97
country_id: 1562822
description:
2026-06-17 04:55:27 H=([210.245.94.97]) [210.245.94.97]:53308 F=<quickbooks@notification.intuit.com> rejected RCPT <accounting@arse.tg>: No Such User Here


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:04:55:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9871254&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781672127 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [17/Jun/2026:04:55:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6657435&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781672126 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:04:55:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934995&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781672128 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:04:56:44 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:04:56:38 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:04:56:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:04:56:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 142.111.152.59
country_id: 6252001
description:
142.111.152.59 - - [17/Jun/2026:04:58:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6776432&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DaXNrcmF0ZWxAaXNrcmF0ZWwucnU%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781672289 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=aXNrcmF0ZWxAaXNrcmF0ZWwucnU=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:142.111.152.59


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.152.154.246
country_id: 3469034
description:
Jun 17 04:58:48 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.152.154.246 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 23.234.90.173
country_id: 6252001
description:
23.234.90.173 - - [17/Jun/2026:04:59:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6528662&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DbmV3Z29hbHMyNUB1a3IubmV0&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781672391 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=bmV3Z29hbHMyNUB1a3IubmV0" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:142.0) Gecko/20100101 Firefox/142.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:23.234.90.173


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 05:00:12 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.5
country_id: 2363686
description:
2026-06-17 05:01:12 dovecot_login authenticator failed for H=(slave.cloud-et-racks.tg) [154.70.82.5]:41070: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.24
country_id: 6252001
description:
205.169.39.24 - - [17/Jun/2026:05:02:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6802072&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DZ2F1cmF2LmphaW5AamFsaW5kaWEuY28uaW4%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781672544 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=Z2F1cmF2LmphaW5AamFsaW5kaWEuY28uaW4=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.24


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [17/Jun/2026:05:02:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13027222&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253Dc2FzaGVocmlAbnVwY28uY29t&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781672559 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=c2FzaGVocmlAbnVwY28uY29t" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.22.212.32
country_id: 1269750
description:
[2026-06-17 05:03:13 +0000] info [cpaneld] 165.22.212.32 - mesyscom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [17/Jun/2026:05:04:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7183723&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DYXNodXNzYWluQG51cGNvLmNvbQ%253D%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781672650 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=YXNodXNzYWluQG51cGNvLmNvbQ==" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.12.160
country_id: 2300660
description:
Jun 17 05:03:40 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.12.160 has been locked due to Imunify RBL


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 54.223.139.243
country_id: 1814991
domain: tdn.tg
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 10; HD1900 Build/QKQ1.190716.003; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/75.0.3770.156 Mobile Safari/537.36  aweme_230400 JsSdk/1.0 NetType/WIFI  AppName/aweme app_version/23.4.0 ByteLocale/zh-CN Region/CN AppSkin/white AppTheme/light BytedanceWebview/d8a21c6 WebView/075113004008||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.52
country_id: 6252001
description:
205.169.39.52 - - [17/Jun/2026:05:04:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934020&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253Dc2FzaGVocmlAbnVwY28uY29t&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781672689 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=c2FzaGVocmlAbnVwY28uY29t" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.52


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.207.107.216
country_id: 2921044
description:
185.207.107.216 - yydrdvav [17/Jun/2026:05:04:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12819607&pdata=https%253A%252F%252Fvitrinenews.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781672692 HTTP/2.0" 302 0 vitrinenews.tg "https://vitrinenews.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.207.107.216


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.119.158
country_id: 1880251
description:
47.128.119.158 - - [17/Jun/2026:05:04:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10263445&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D10435&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781672685 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=10435" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.119.158


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.57
country_id: 6252001
description:
205.169.39.57 - - [17/Jun/2026:05:06:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6909591&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DYXNodXNzYWluQG51cGNvLmNvbQ%253D%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781672760 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=YXNodXNzYWluQG51cGNvLmNvbQ==" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.57


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [17/Jun/2026:05:06:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6317971&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DbXNoYXJlZWYtY0BudXBjby5jb20%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781672765 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=bXNoYXJlZWYtY0BudXBjby5jb20=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.153.174.18
country_id: 298795
description:
Jun 17 05:06:10 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.153.174.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.153.174.18
country_id: 298795
description:
Jun 17 05:06:23 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.153.174.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 05:07:12 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.246
country_id: 2077456
description:
103.1.212.246 - - [17/Jun/2026:05:08:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10197097&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781672881 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.246


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:05:08:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12896410&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781672883 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [17/Jun/2026:05:07:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13145700&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253Dcml0emNhcmx0b25AZW1haWwtbWFycmlvdHQuY29t&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781672851 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=cml0emNhcmx0b25AZW1haWwtbWFycmlvdHQuY29t" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 46.42.248.201
country_id: 1522867
description:
46.42.248.201 - - [17/Jun/2026:05:07:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9870024&pdata=https%253A%252F%252Fwebmail.whereis.free.netmaster.tg%252F%253Flocale%253Dda&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781672875 HTTP/2.0" 302 0 webmail.whereis.free.netmaster.tg "https://webmail.whereis.free.netmaster.tg/?locale=da" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:46.42.248.201


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:05:08:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9790874&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781672879 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [17/Jun/2026:05:11:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12885149&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253Dai5nYXRlbmJ5QG9jbGNwaWNhLm9yZw%253D%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781673070 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=ai5nYXRlbmJ5QG9jbGNwaWNhLm9yZw==" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.13
country_id: 6252001
description:
205.169.39.13 - - [17/Jun/2026:05:10:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12817822&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253Dcm1xYWJiYW5pQG51cGNvLmNvbQ%253D%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781673038 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=cm1xYWJiYW5pQG51cGNvLmNvbQ==" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.13


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:05:10:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803716&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781673039 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:05:10:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7260571&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781673042 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [17/Jun/2026:05:10:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7237271&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781673044 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-17 05:11:31 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:51553: 535 Incorrect authentication data (set_id=pctest)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:05:13:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:05:13:15 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:05:13:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:05:13:17 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 05:15:27 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.213.230.35
country_id: 1512440
description:
2026-06-17 05:16:31 H=([91.203.174.251]) [185.213.230.35]:51069 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.188.146.194
country_id: 6252001
description:
Jun 17 05:18:38 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.188.146.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.188.146.194
country_id: 6252001
description:
2026-06-17 05:18:40 dovecot_plain authenticator failed for H=(igvttdl0pquvgtphxn8e91lftrn) [73.188.146.194]:57221: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.139.18.168
country_id: 6252001
description:
2026-06-17 05:20:39 dovecot_plain authenticator failed for H=(mewojhju2y1rhsjnoccy9yurkp8) [73.139.18.168]:35313: 535 Incorrect authentication data (set_id=supports@mesyscom.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.119.135
country_id: 1880251
description:
47.128.119.135 - - [17/Jun/2026:05:20:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000789&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D10435&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781673641 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=10435" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.119.135


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [17/Jun/2026:05:21:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10078098&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DdGh1eWR0MkBzYWlnb25uZXdwb3J0LmNvbS52bg%253D%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781673659 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=dGh1eWR0MkBzYWlnb25uZXdwb3J0LmNvbS52bg==" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-17 05:21:04 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:49966: 535 Incorrect authentication data (set_id=sehri)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.168
country_id: 1880251
description:
47.128.96.168 - - [17/Jun/2026:05:22:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6384232&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdon-de-mawu-fe-nuse-au-ceg-attikpa%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781673728 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/don-de-mawu-fe-nuse-au-ceg-attikpa/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.168


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:05:21:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7365987&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781673718 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.246
country_id: 2077456
description:
103.1.212.246 - - [17/Jun/2026:05:22:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184801&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781673720 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.246


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.174.198.219
country_id: 3469034
description:
Jun 17 05:22:05 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.174.198.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.174.198.219
country_id: 3469034
description:
2026-06-17 05:22:07 dovecot_plain authenticator failed for H=(eiqf7ny37dj6j5sfecw8vl5ijsl482) [200.174.198.219]:11919: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:05:22:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13277801&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781673725 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [17/Jun/2026:05:23:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10261603&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DcGhpY2hpdEBkaXQuZ28udGg%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781673798 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=cGhpY2hpdEBkaXQuZ28udGg=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 05:22:26 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 82.194.3.102
country_id: 587116
description:
2026-06-17 05:24:02 H=([82.194.3.102]) [82.194.3.102]:59992 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.3
country_id: 6252001
description:
205.169.39.3 - - [17/Jun/2026:05:25:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6527847&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DcGhpY2hpdEBkaXQuZ28udGg%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781673899 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=cGhpY2hpdEBkaXQuZ28udGg=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.3


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [17/Jun/2026:05:24:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9880471&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DcGhpY2hpdEBkaXQuZ28udGg%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781673866 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=cGhpY2hpdEBkaXQuZ28udGg=" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.33
country_id: 6252001
description:
[2026-06-17 05:26:44 +0000] info [cpaneld] 64.44.59.33 NEW sotragonet:g7hl4h_qU_NKPfr6 address=64.44.59.33,app=cpaneld,creator=sotragonet,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [17/Jun/2026:05:27:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13159068&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781674027 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:05:27:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9684939&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781674026 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:05:27:19 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.159.196.77
country_id: 2017370
description:
Jun 17 05:26:43 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.159.196.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.159.196.77
country_id: 2017370
description:
2026-06-17 05:26:45 dovecot_plain authenticator failed for H=(d2ylcmly4e0b4ga4efknvyxmlg7) [213.159.196.77]:65291: 535 Incorrect authentication data (set_id=papson.fiatuwo@mesyscom.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:05:27:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9816726&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781674029 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:05:27:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 212.241.9.139
country_id: 1527747
description:
2026-06-17 05:28:02 H=([212.241.9.139]) [212.241.9.139]:5830 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:05:27:23 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:05:27:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 82.194.3.102
country_id: 587116
description:
2026-06-17 05:28:54 H=([82.194.3.102]) [82.194.3.102]:29805 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [17/Jun/2026:05:28:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6657733&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DdGh1eWR0MkBzYWlnb25uZXdwb3J0LmNvbS52bg%253D%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781674136 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=dGh1eWR0MkBzYWlnb25uZXdwb3J0LmNvbS52bg==" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-17 05:29:55 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:43291: 535 Incorrect authentication data (set_id=mkaiser)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.14
country_id: 6252001
description:
205.169.39.14 - - [17/Jun/2026:05:30:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10274667&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DYWppdGhrdkB0cmFnc3FhdGFyLmNvbQ%253D%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781674240 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=YWppdGhrdkB0cmFnc3FhdGFyLmNvbQ==" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.14


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.216.88.83
country_id: 3469034
description:
Jun 17 05:30:35 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.216.88.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.119.63.193
country_id: 6252001
description:
Jun 17 05:30:38 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.119.63.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.119.63.193
country_id: 6252001
description:
2026-06-17 05:30:40 dovecot_plain authenticator failed for H=(2uqy0jvpq0th1o7na6of1) [66.119.63.193]:39049: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 05:30:41 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 212.241.9.139
country_id: 1527747
description:
2026-06-17 05:30:46 H=([212.241.9.139]) [212.241.9.139]:6003 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.224.80.15
country_id: 1562822
domain: www.wages.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.wages.tg/ HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.145.76.7
country_id: 3686110
description:
[2026-06-17 05:34:19 +0000] info [cpaneld] 186.145.76.7 - arian "GET /login/?login_only=1&user=arian&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user arian (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.211.166.54
country_id: 3895114
description:
[2026-06-17 05:34:22 +0000] info [cpaneld] 190.211.166.54 - aria "GET /login/?login_only=1&user=aria&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aria (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.160.94.84
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/decentralisation-agoe-nyive-1-une-commune-en-pleine-transformation/ HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.23.30.7
country_id: 2361809
description:
[2026-06-17 05:34:13 +0000] info [cpaneld] 102.23.30.7 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.190.192.137
country_id: 2017370
description:
[2026-06-17 05:34:15 +0000] info [cpaneld] 194.190.192.137 - ariana "GET /login/?login_only=1&user=ariana&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ariana (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.235.162.214
country_id: 3469034
description:
[2026-06-17 05:34:18 +0000] info [cpaneld] 186.235.162.214 - arianatg "GET /login/?login_only=1&user=arianatg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user arianatg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.105.147.40
country_id: 3625428
description:
[2026-06-17 05:34:22 +0000] info [cpaneld] 143.105.147.40 - arian "GET /login/?login_only=1&user=arian&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user arian (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.177.188.50
country_id: 2464461
description:
[2026-06-17 05:33:25 +0000] info [cpaneld] 196.177.188.50 - e.sanvee "POST /login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 118.179.129.177
country_id: 1210997
description:
[2026-06-17 05:34:12 +0000] info [cpaneld] 118.179.129.177 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.182.67.230
country_id: 2921044
description:
[2026-06-17 05:34:15 +0000] info [cpaneld] 87.182.67.230 - ariana "GET /login/?login_only=1&user=ariana&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ariana (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.249.94.136
country_id: 2542007
description:
[2026-06-17 05:34:17 +0000] info [cpaneld] 41.249.94.136 - arianatg "GET /login/?login_only=1&user=arianatg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user arianatg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.116.167.193
country_id: 6251999
description:
[2026-06-17 05:34:26 +0000] info [cpaneld] 206.116.167.193 - ari "GET /login/?login_only=1&user=ari&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ari (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.26.39.199
country_id: 2017370
description:
[2026-06-17 05:34:28 +0000] info [cpaneld] 95.26.39.199 - ar "GET /login/?login_only=1&user=ar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.80.205.95
country_id: 3469034
description:
[2026-06-17 05:34:28 +0000] info [cpaneld] 170.80.205.95 - ar "GET /login/?login_only=1&user=ar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ar (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 176.102.65.28
country_id: 3077311
description:
176.102.65.28 - - [17/Jun/2026:05:36:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12950124&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781674600 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:176.102.65.28


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:05:37:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869926&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781674640 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.140.205
country_id: 690791
description:
Jun 17 05:38:13 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.140.205 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.246
country_id: 2077456
description:
103.1.212.246 - - [17/Jun/2026:05:37:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7104665&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781674641 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.246


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:05:37:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12961731&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781674646 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 05:37:39 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-17 05:39:02 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:27072: 535 Incorrect authentication data (set_id=bds)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.140.205
country_id: 690791
description:
Jun 17 05:38:26 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.140.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 80.72.179.12
country_id: 1527747
description:
2026-06-17 05:39:08 H=([80.72.179.12]) [80.72.179.12]:64448 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.223.127
country_id: 6252001
description:
47.77.223.127 - - [17/Jun/2026:05:39:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7378322&pdata=https%253A%252F%252Femt.tg%253A2087%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781674772 HTTP/2.0" 302 0 emt.tg "https://emt.tg:2087/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.77.223.127


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:05:39:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:05:39:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923479&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781674779 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [17/Jun/2026:05:39:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7039897&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781674780 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.88.18.245
country_id: 6252001
description:
47.88.18.245 - - [17/Jun/2026:05:39:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6658198&pdata=https%253A%252F%252Fmediatopnews.tg%253A2087%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781674765 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg:2087/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.88.18.245


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:05:39:37 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:05:39:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:05:39:38 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:05:39:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10250947&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781674778 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:05:39:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13069935&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781674779 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.254.76.66
country_id: 6252001
description:
47.254.76.66 - - [17/Jun/2026:05:39:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7299731&pdata=https%253A%252F%252Fucao-uut.tg%253A2087%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781674764 HTTP/2.0" 302 0 ucao-uut.tg "https://ucao-uut.tg:2087/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.254.76.66


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 24.157.154.85
country_id: 6251999
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/wp-content/uploads/2014/11/R\xc3\xa9sultat_Lot3.pdf HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 185.69.185.66
country_id: 1218197
description:
Jun 17 05:40:39 ns5 pure-ftpd[1650114]: (?@185.69.185.66) [WARNING] Authentication failed for user [root]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.117.137.27
country_id: 130758
description:
2026-06-17 05:41:24 H=([185.117.137.218]) [185.117.137.27]:20740 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.140.38
country_id: 690791
description:
Jun 17 05:42:17 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.140.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.140.38
country_id: 690791
description:
Jun 17 05:42:24 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.140.38 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 93.100.120.28
country_id: 2017370
description:
[2026-06-17 05:44:10 +0000] info [cpaneld] 93.100.120.28 - zo "GET /login/?login_only=1&user=zo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zo (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [17/Jun/2026:05:43:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12937324&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DdG5hc2hyaS1jQG51cGNvLmNvbQ%253D%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781675003 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=dG5hc2hyaS1jQG51cGNvLmNvbQ==" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.44.225.226
country_id: 1694008
description:
[2026-06-17 05:44:01 +0000] info [cpaneld] 143.44.225.226 - zontalo "GET /login/?login_only=1&user=zontalo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zontalo (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.251.193.6
country_id: 2300660
description:
Jun 17 05:44:06 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.251.193.6 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.236.103.132
country_id: 2017370
description:
[2026-06-17 05:44:07 +0000] info [cpaneld] 91.236.103.132 - zon "GET /login/?login_only=1&user=zon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zon (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.189.95.140
country_id: 3996063
description:
[2026-06-17 05:43:46 +0000] info [cpaneld] 187.189.95.140 - zontalomemillenium "GET /login/?login_only=1&user=zontalomemillenium&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zontalomemillenium (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.117.137.27
country_id: 130758
description:
2026-06-17 05:44:09 H=([185.117.137.218]) [185.117.137.27]:13388 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.245
country_id: 1643084
description:
[2026-06-17 05:44:35 +0000] info [cpaneld] 185.213.83.245 - ingertgsarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.196.160.137
country_id: 3175395
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:05-45.196.196.160.137||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 191.101.114.77
country_id: 290557
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:05-45.191.101.114.77||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 05:45:57 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 107.175.13.98
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:05-45.107.175.13.98||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.19.183.66
country_id: 1269750
description:
Jun 17 05:47:54 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.19.183.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.183.66
country_id: 1269750
description:
2026-06-17 05:47:56 dovecot_login authenticator failed for H=([112.48.16.186]) [125.19.183.66]:39516: 535 Incorrect authentication data (set_id=webmaster@cameg-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.8.25.98
country_id: 2750405
description:
45.8.25.98 - - [17/Jun/2026:05:48:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999720&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DdmNzcEB2Y3NwLnJ1&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781675290 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=dmNzcEB2Y3NwLnJ1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.8.25.98


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 45.38.16.203
country_id: 6252001
description:
Jun 17 05:48:26 ns5 pure-ftpd[1656181]: (?@45.38.16.203) [WARNING] Authentication failed for user [czqxxxnu]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.251.236.65
country_id: 1562822
description:
[2026-06-17 05:48:48 +0000] info [cpaneld] 171.251.236.65 - lvdt "GET /login/?login_only=1&user=lvdt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lvdt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.130.39.230
country_id: 3686110
description:
[2026-06-17 05:48:51 +0000] info [cpaneld] 181.130.39.230 - lvdttg "GET /login/?login_only=1&user=lvdttg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lvdttg (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 177.71.78.22
country_id: 3469034
description:
177.71.78.22 - - [17/Jun/2026:05:48:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6841798&pdata=https%253A%252F%252Fcfpj.tg%252Feedo-148219hetid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781675328 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/eedo-148219hetid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:177.71.78.22


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.68.187
country_id: 3190538
domain: www.sthandling-aero.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.sthandling-aero.tg:80/img-sys/server_moved.png HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.97.143.26
country_id: 3585968
description:
[2026-06-17 05:48:55 +0000] info [cpaneld] 138.97.143.26 - lvdttg "GET /login/?login_only=1&user=lvdttg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lvdttg (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.247.67.236
country_id: 290557
domain: www.sthandling-aero.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.sthandling-aero.tg:80/img-sys/server_misconfigured.png HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.231.35.33
country_id: 285570
description:
[2026-06-17 05:48:45 +0000] info [cpaneld] 37.231.35.33 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 38.156.229.226
country_id: 3686110
description:
38.156.229.226 - - [17/Jun/2026:05:48:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934281&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdeces-dun-pieton-percute-par-un-camion%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781675333 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/deces-dun-pieton-percute-par-un-camion/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.8025.1069 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:38.156.229.226


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.56.221.236
country_id: 290557
domain: www.sthandling-aero.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.sthandling-aero.tg:80/img-sys/IP_changed.png HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 185.117.225.127
country_id: 6252001
domain: mesyscom.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/123.0.6312.86 Safari/537.36||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.130
country_id: 1880251
description:
47.128.96.130 - - [17/Jun/2026:05:49:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9868652&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fconstruction-duniversite-a-kpalime%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781675350 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/construction-duniversite-a-kpalime/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.130


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 49.228.47.89
country_id: 1605651
description:
2026-06-17 05:50:29 H=([0.0.0.0]) [49.228.47.89]:56513 F=<John@4452.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 17 05:52:53 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.246
country_id: 2077456
description:
103.1.212.246 - - [17/Jun/2026:05:53:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935210&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781675628 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.246


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:05:53:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7300199&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781675625 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:05:53:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328426&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781675627 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:05:54:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:05:54:26 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:05:54:24 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:05:54:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.69.128.245
country_id: 6252001
description:
2026-06-17 05:54:40 dovecot_plain authenticator failed for H=pool-173-69-128-245.bltmmd.fios.verizon.net (oxqw99cx60wmw7t6hft3mzpti8) [173.69.128.245]:49757: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:05:54:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7118184&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781675687 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:05:54:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9933469&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781675691 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [17/Jun/2026:05:54:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10251104&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781675692 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.6.7.235
country_id: 6252001
description:
[2026-06-17 05:55:00 +0000] info [cpaneld] 50.6.7.235 - mesyscom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.30.36.94
country_id: 2921044
description:
212.30.36.94 - - [17/Jun/2026:05:55:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10195913&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253Da2FsaW5pbmdyYWRfb2ZmaWNlQGluc3BlY3RvcmF0ZS5ydQ%253D%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781675743 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=a2FsaW5pbmdyYWRfb2ZmaWNlQGluc3BlY3RvcmF0ZS5ydQ==" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.30.36.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.243.40.22
country_id: 2635167
description:
2026-06-17 05:57:30 dovecot_login authenticator failed for H=(uelm.com) [185.243.40.22]:58129: 535 Incorrect authentication data (set_id=nashikoh@cafe.tg)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 49.228.47.89
country_id: 1605651
description:
2026-06-17 06:00:40 H=([0.0.0.0]) [49.228.47.89]:59045 F=<John@4452.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.157.169
country_id: 99237
description:
Jun 17 06:02:49 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.157.169 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.214.44.117
country_id: 149590
description:
Jun 17 06:05:33 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.214.44.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.214.44.117
country_id: 149590
description:
2026-06-17 06:05:35 dovecot_login authenticator failed for H=([192.111.134.12]) [102.214.44.117]:44166: 535 Incorrect authentication data (set_id=info@anrtogo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.57
country_id: 6252001
description:
205.169.39.57 - - [17/Jun/2026:06:06:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6778822&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DcmJhaGFkdXIuc21zYUBudXBjby5jb20%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781676367 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=cmJhaGFkdXIuc21zYUBudXBjby5jb20=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.57


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.47.54.231
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/10/WhatsApp-Image-2022-10-15-at-12.34.24-1-1024x683.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2022/10/WhatsApp-Image-2022-10-15-at-12.34.24-1-300x200.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2022/10/WhatsApp-Image-2022-10-15-at-12.34.24-1-768x512.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2022/10/WhatsApp-Image-2022-10-15-at-12.34.24-1-272x182.jpeg 272w, http:/togodailynews.tg/wp-content/uploads/2022/10/WhatsApp-Image-2022-10-15-at-12.34.24-1.jpeg 1080w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 80.80.194.66
country_id: 2017370
description:
2026-06-17 06:08:17 H=([80.80.194.66]) [80.80.194.66]:57713 F=<John@4452.com> rejected RCPT <info@sigm.tg>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.21.70
country_id: 1562822
description:
2026-06-17 06:07:50 dovecot_login authenticator failed for H=([74.119.147.213]) [27.71.21.70]:50740: 535 Incorrect authentication data (set_id=pascaljoseph.panassi)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:06:08:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:06:08:14 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:06:08:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:06:08:18 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.163.52.74
country_id: 1814991
description:
2026-06-17 06:07:36 dovecot_login authenticator failed for H=([182.78.87.2]) [123.163.52.74]:43086: 535 Incorrect authentication data (set_id=pascaljoseph.panassi@sodigaz.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [17/Jun/2026:06:08:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10329708&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781676510 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:06:08:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9805206&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781676510 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:06:08:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9739416&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781676511 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:06:08:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10121319&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781676532 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:06:08:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10382744&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781676534 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.246
country_id: 2077456
description:
103.1.212.246 - - [17/Jun/2026:06:08:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7236291&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781676536 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.246


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.16
country_id: 6252001
description:
205.169.39.16 - - [17/Jun/2026:06:10:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13080989&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DdG5hc2hyaS1jQG51cGNvLmNvbQ%253D%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781676614 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=dG5hc2hyaS1jQG51cGNvLmNvbQ==" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.16


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.9.0.205
country_id: 2921044
description:
2026-06-17 06:14:18 dovecot_plain authenticator failed for H=static.205.0.9.176.clients.your-server.de [176.9.0.205]:51438: 535 Incorrect authentication data (set_id= sessou.e@inger.tg )


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.9.0.205
country_id: 2921044
description:
2026-06-17 06:14:24 dovecot_login authenticator failed for H=static.205.0.9.176.clients.your-server.de [176.9.0.205]:51438: 535 Incorrect authentication data (set_id= sessou.e@inger.tg )


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.116
country_id: 3469034
description:
Jun 17 06:16:18 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.74.176.67
country_id: 6252001
description:
2026-06-17 06:15:41 dovecot_plain authenticator failed for H=(44xf5q7in4x8wl8vbi82yyl39r1u3ie) [66.74.176.67]:55629: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.116
country_id: 3469034
description:
Jun 17 06:16:25 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.5.224.71
country_id: 1814991
description:
Jun 17 06:17:00 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.5.224.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.5.224.71
country_id: 1814991
description:
2026-06-17 06:17:02 dovecot_login authenticator failed for H=([125.19.183.202]) [221.5.224.71]:10476: 535 Incorrect authentication data (set_id=pascaljoseph.panassi@sodigaz.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 109.243.128.76
country_id: 798544
description:
109.243.128.76 - - [17/Jun/2026:06:17:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10250082&pdata=https%253A%252F%252Ftogodailynews.tg%252Fvalorisation-du-metier-denseignant-letat-togolais-reaffirme-son-engagement%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781677028 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/valorisation-du-metier-denseignant-letat-togolais-reaffirme-son-engagement/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2122.1244 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:109.243.128.76


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 141.164.238.110
country_id: 102358
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7a599d442717cde19187b623e9b151ce353f8b2d||Title:cfr2nljauprloqq5||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 112.205.38.218
country_id: 1694008
domain: derou.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/derou.tg/fr/nos-projets/7 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 141.164.238.110
country_id: 102358
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:281af9dbadb7192245046a076694a3c18a307201||Title:w5x7ipdjciyypoiss||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 141.164.238.110
country_id: 102358
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7f5b680321a5c2b174794ede31209693226b9c3e||Title:jpa88evgivf2cv127||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 141.164.238.110
country_id: 102358
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:560bc8d91531f32736b5c11be3b5f78d440220bc||Title:x7jdwsyewi635gy||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.59
country_id: 690791
description:
2026-06-17 06:22:03 H=([77.83.39.59]) [77.83.39.59]:58376 F=<qr11@lifecf.org> rejected RCPT <whiteway@white-ways.com>: The mail server could not deliver mail to whiteway@white-ways.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 141.164.238.110
country_id: 102358
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:acfafc3f7e4857e8eae673b7947618108be35293||Title:w58kr5d43lo6ym||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 141.164.238.110
country_id: 102358
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6d24f278b1950f58220f3bb2b9c00bb0d8dc0082||Title:r7piyau6jbb9vzi59||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:06:24:09 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 42.1.70.202
country_id: 1562822
description:
42.1.70.202 - - [17/Jun/2026:06:24:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10196845&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D14549&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781677458 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=14549" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.7485.1828 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:42.1.70.202


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 141.164.238.110
country_id: 102358
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:34a365d7c160b671dc472c8af1249b27f46d592f||Title:1f662u83ieeuk5||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:06:23:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10316441&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781677405 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:06:23:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9855595&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781677404 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [17/Jun/2026:06:23:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10460871&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781677404 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:06:24:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:06:24:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:06:24:07 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 141.164.238.110
country_id: 102358
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:feb0a1915beedc177f576b1306b6d06c6ce40e7b||Title:ymbp07qngzevz30||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.246
country_id: 2077456
description:
103.1.212.246 - - [17/Jun/2026:06:25:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934180&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781677540 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.246


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:06:25:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7194480&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781677542 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.237.221.207
country_id: 6252001
description:
Jun 17 06:25:49 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.237.221.207 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 141.164.238.110
country_id: 102358
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5e9db5e6274a501a0e9212e67cae3342192e80dd||Title:h1a5kal1lvh18wf67||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:06:25:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10250087&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781677540 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.237.221.207
country_id: 6252001
description:
2026-06-17 06:25:51 dovecot_plain authenticator failed for H=207.sub-97-237-221.myvzw.com (b09bb4nozhhc7uoge3evt7kkvt17c) [97.237.221.207]:34658: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 41.242.161.70
country_id: 953987
description:
41.242.161.70 - - [17/Jun/2026:06:25:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13277803&pdata=https%253A%252F%252Ftogodailynews.tg%252Fmarche-financier-regional-de-lumoa-crepmf-change-de-denomination-et-devient-amf-umoa%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781677557 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/marche-financier-regional-de-lumoa-crepmf-change-de-denomination-et-devient-amf-umoa/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.3996.1194 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:41.242.161.70


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 138.84.115.55
country_id: 1694008
description:
138.84.115.55 - - [17/Jun/2026:06:26:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9750937&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frevision-constitutionnelle-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781677595 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/revision-constitutionnelle-togo/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.9979.1641 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:138.84.115.55


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 141.164.238.110
country_id: 102358
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5e82ff35836bc07767560194dbd08b42386eaf86||Title:iy5erz1n0d3da24mz||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.44.2
country_id: 2395170
description:
Jun 17 06:29:54 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.44.2 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.43.192.3
country_id: 614540
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/10/WhatsApp-Image-2022-10-15-at-12.34.24-1024x683.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2022/10/WhatsApp-Image-2022-10-15-at-12.34.24-300x200.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2022/10/WhatsApp-Image-2022-10-15-at-12.34.24-768x512.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2022/10/WhatsApp-Image-2022-10-15-at-12.34.24-272x182.jpeg 272w, http:/togodailynews.tg/wp-content/uploads/2022/10/WhatsApp-Image-2022-10-15-at-12.34.24.jpeg 1080w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.174.198.86
country_id: 3469034
description:
2026-06-17 06:31:54 dovecot_plain authenticator failed for H=(waa631wet4x7ayf4pgdvki7xe1j76tdz) [200.174.198.86]:1576: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.168.145.164
country_id: 2363686
domain: www.letabloid.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.18||T:APACHE||MV:/wp-json/wp/v2/users/me?context=edit&_locale=user||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.166.179.34
country_id: 1880251
description:
Jun 17 06:35:41 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.166.179.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.154.116.10
country_id: 1814991
description:
Jun 17 06:35:50 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.154.116.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.91.233.238
country_id: 3469034
description:
Jun 17 06:35:57 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.91.233.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.125.21.56
country_id: 3469034
description:
Jun 17 06:35:57 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.125.21.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.91.164.131
country_id: 3469034
description:
Jun 17 06:36:30 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.91.164.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.211.21.213
country_id: 1269750
description:
Jun 17 06:36:37 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.211.21.213 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:06:36:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6644329&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781678208 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.225.28
country_id: 1269750
description:
Jun 17 06:37:08 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.225.28 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:06:37:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9859013&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781678226 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.68.123.34
country_id: 6251999
description:
Jun 17 06:36:37 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.68.123.34 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [17/Jun/2026:06:36:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9881751&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781678207 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:06:36:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7105386&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781678209 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.72.10.16
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/8f8986 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.198.128.204
country_id: 1835841
description:
Jun 17 06:36:27 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.198.128.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.91.233.238
country_id: 3469034
description:
Jun 17 06:36:52 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.91.233.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.64.30.151
country_id: 1643084
description:
Jun 17 06:36:45 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.64.30.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.136.142.13
country_id: 1814991
description:
Jun 17 06:37:22 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.136.142.13 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:06:37:47 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.55.229.68
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/8d9bab HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:06:37:50 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:06:37:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.154.116.10
country_id: 1814991
description:
Jun 17 06:38:13 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.154.116.10 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:06:37:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:06:38:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13200231&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781678306 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:06:38:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7182436&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781678307 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.246
country_id: 2077456
description:
103.1.212.246 - - [17/Jun/2026:06:38:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12950373&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781678307 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.246


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 146.70.203.23
country_id: 719819
description:
146.70.203.23 - - [17/Jun/2026:06:38:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9790306&pdata=https%253A%252F%252Fafrique-distribution.net&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781678333 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:146.70.203.23


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.194.218.134
country_id: 3017382
description:
[2026-06-17 06:38:56 +0000] info [cpaneld] 185.194.218.134 - amedekabenoit@gmail.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 146.70.203.23
country_id: 719819
description:
146.70.203.23 - - [17/Jun/2026:06:40:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9790306&pdata=https%253A%252F%252Fafrique-distribution.net&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781678333 HTTP/2.0" 404 159 afrique-distribution.net "https://afrique-distribution.net/" "Mozilla/5.0 (iPhone; CPU iPhone OS 14_0_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:146.70.203.23


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.38.45.21
country_id: 290557
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/ac8683 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 61.2.212.194
country_id: 1269750
description:
61.2.212.194 - - [17/Jun/2026:06:43:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9737063&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253Dbi5sYWtzaG1pbmFyYXlhbkB0aGV2YW5pdHljYXNlLmNvbQ%253D%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781678581 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=bi5sYWtzaG1pbmFyYXlhbkB0aGV2YW5pdHljYXNlLmNvbQ==" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Edg/149.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:61.2.212.194


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.82.55
country_id: 6252001
description:
[2026-06-17 06:43:38 +0000] info [cpaneld] 134.195.82.55 NEW ifxmoxbf:s45bXUHCjRxgu6gN address=134.195.82.55,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.231.64.143
country_id: 3017382
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.922746215118321.php||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.59
country_id: 690791
description:
2026-06-17 06:44:00 H=([77.83.39.59]) [77.83.39.59]:51691 F=<jgracia@microcreditoscehe.com> rejected RCPT <whiteway@white-ways.com>: The mail server could not deliver mail to whiteway@white-ways.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.42
country_id: 2635167
description:
[2026-06-17 06:44:36 +0000] info [cpaneld] 5.230.133.42 NEW ifxmoxbf:5sACur0ksiN0fO_g address=5.230.133.42,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 134.195.82.52
country_id: 6252001
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.737872751216398.php||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 93.71.103.137
country_id: 3175395
description:
93.71.103.137 - - [17/Jun/2026:06:45:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9790306&pdata=https%253A%252F%252Fafrique-distribution.net&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781678333 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:93.71.103.137


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 93.71.103.137
country_id: 3175395
description:
93.71.103.137 - - [17/Jun/2026:06:45:27 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9790306&pdata=https%253A%252F%252Fafrique-distribution.net&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781678333" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:93.71.103.137


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 95.59.171.230
country_id: 1522867
description:
2026-06-17 06:46:17 H=([95.59.171.230]) [95.59.171.230]:58792 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.158.200.111
country_id: 3437598
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/619717029 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 155.133.114.67
country_id: 798544
description:
Jun 17 06:47:28 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 155.133.114.67 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 37.237.148.203
country_id: 99237
description:
37.237.148.203 - - [17/Jun/2026:06:49:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9859228&pdata=https%253A%252F%252Fdirect7.tg%252Fjt-de-direct7-les-grands-points-de-lactualite-togolaise-4&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781678941 HTTP/1.1" 302 0 direct7.tg "https://direct7.tg/jt-de-direct7-les-grands-points-de-lactualite-togolaise-4" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:37.237.148.203


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.236.210.123
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/770645540 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.105.247.50
country_id: 6252001
description:
Jun 17 06:50:47 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.105.247.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.105.247.50
country_id: 6252001
description:
2026-06-17 06:50:49 dovecot_plain authenticator failed for H=(prlvw0xekjn6rwnfn9q3) [143.105.247.50]:7768: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.6.15.128
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/5c534a HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.165.168.247
country_id: 3895114
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/ced5db HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:06:52:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:06:52:56 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:06:53:02 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:06:53:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6592619&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781679187 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:06:53:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842521&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781679195 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:06:53:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:06:53:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10119625&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781679185 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.246
country_id: 2077456
description:
103.1.212.246 - - [17/Jun/2026:06:53:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6331286&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781679186 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.246


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:06:53:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7367575&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781679191 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [17/Jun/2026:06:53:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842980&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781679194 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 217.218.223.105
country_id: 130758
description:
2026-06-17 06:56:09 H=([217.218.223.105]) [217.218.223.105]:49298 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.188.234.236
country_id: 3658394
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-25-at-09.05.27-1024x684.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-25-at-09.05.27-300x200.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-25-at-09.05.27-768x513.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-25-at-09.05.27-1536x1025.jpeg 1536w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-25-at-09.05.27-272x182.jpeg 272w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-25-at-09.05.27.jpeg 1600w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 81.249.147.151
country_id: 3017382
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/wp-content/uploads/2024/04/Recrutement-stagiaire-communication-15124_inputCP_VF.pdf HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 43.160.193.182
country_id: 1880251
description:
[2026-06-17 06:56:47 +0000] info [webmaild] 43.160.193.182 - doc.chine@dgdn-togo.tg "GET /cpsess8312897373/3rdparty/roundcube/?_task=mail&_action=list&_refresh=1&_layout=widescreen&_mbox=INBOX&_page=&_remote=1&_unlock=loading1781679396612&_=1781679396531 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [43.160.240.168] != Current IP Address [43.160.193.182]


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 140.99.199.188
country_id: 3017382
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:140.99.199.188||TA:140.99.199.188||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.61.130.187
country_id: 6252001
description:
[2026-06-17 06:58:31 +0000] info [cpaneld] 45.61.130.187 - ingertgsarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.202.174.175
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/925990857 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 101.53.249.232
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/536b7c HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.246.213.160
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/cache/autoptimize/css/autoptimize_single_b8f1656fe74917c0889f45e66ede5492.css?ver=1.0.0 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.93.130.70
country_id: 2510769
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/themes/magxpress/assets/css/swiper-bundle.min.css?ver=1.0.0 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 3.101.230.192
country_id: 6252001
description:
IM360 WAF: Bad file extension||RSV:8.18||T:APACHE||MVN:REQUEST_FILENAME||MV:/nice ports,/Trinity.txt.bak||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.246.207.9
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/cache/autoptimize/css/autoptimize_single_474f2da06b2a20a3d78b023b42995487.css?ver=1.2 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.247.66.137
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-includes/css/admin-bar.min.css?ver=6.9.4 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:07:08:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10077077&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781680112 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.16.243.30
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/937645320 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.247.67.98
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/cache/autoptimize/css/autoptimize_single_fa757170427f0ca61fdafc865cbd50f1.css?ver=1.0.0 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 188.236.58.200
country_id: 285570
description:
188.236.58.200 - - [17/Jun/2026:07:08:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9933155&pdata=https%253A%252F%252Feducplusmedia.tg%252Fpage%252F11%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781680103 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/page/11/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.4663.1900 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:188.236.58.200


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.246
country_id: 2077456
description:
103.1.212.246 - - [17/Jun/2026:07:08:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6789224&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781680110 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.246


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:07:08:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10459234&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781680111 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:07:09:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10197700&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781680194 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:07:09:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10119532&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781680196 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:07:09:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:07:09:30 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [17/Jun/2026:07:09:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985874&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781680195 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.240.230.125
country_id: 2510769
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/cache/autoptimize/css/autoptimize_single_254be852b9f97957423de45bce2e705f.css?ver=1.0.0 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:07:09:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:07:09:35 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 187.190.255.224
country_id: 3996063
description:
187.190.255.224 - - [17/Jun/2026:07:09:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6907543&pdata=https%253A%252F%252Fcpanel.whereis.free.netmaster.tg%252F%253Flocale%253Dfil&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781680175 HTTP/2.0" 302 0 cpanel.whereis.free.netmaster.tg "https://cpanel.whereis.free.netmaster.tg/?locale=fil" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:187.190.255.224


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.71.46.170
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/a1938b HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.142.246.8
country_id: 2287781
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/dbdde2 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.97.27
country_id: 3865483
description:
Jun 17 07:12:05 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.97.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-17 07:13:24 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:41298: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 129.224.207.111
country_id: 163843
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/8a989d HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.112.51.173
country_id: 1269750
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/617388 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.237.122.97
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/096f67 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.34.128.154
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/1277401162 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.215.97.131
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/cfd2d0 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.129.64.191
country_id: 6252001
description:
Jun 17 07:19:49 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.129.64.191 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.129.64.191
country_id: 6252001
description:
2026-06-17 07:19:51 dovecot_plain authenticator failed for H=(e4a1jq96ddg3nkebegqeu31hezjx7j) [23.129.64.191]:1513: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:07:20:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12871826&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781680844 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.246
country_id: 2077456
description:
103.1.212.246 - - [17/Jun/2026:07:20:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6384798&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781680845 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.246


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:07:20:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6449508&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781680847 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.103.185.253
country_id: 1522867
description:
2026-06-17 07:20:38 H=([185.103.185.253]) [185.103.185.253]:15852 F=<John@4452.com> rejected RCPT <majed.zammouri@soroubat.tg>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 122.99.102.93
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1048754699 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.199.148.241
country_id: 192950
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-25-at-09.05.26-1024x683.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-25-at-09.05.26-300x200.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-25-at-09.05.26-768x512.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-25-at-09.05.26-1536x1024.jpeg 1536w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-25-at-09.05.26-272x182.jpeg 272w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-25-at-09.05.26.jpeg 1600w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.41.129
country_id: 6290252
description:
Jun 17 07:22:03 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.41.129 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:07:23:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:07:23:22 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:07:23:24 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [17/Jun/2026:07:23:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6842269&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781681014 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:07:23:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7170713&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781681016 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 213.154.14.49
country_id: 587116
description:
2026-06-17 07:24:07 H=([213.154.14.49]) [213.154.14.49]:52128 F=<John@4452.com> rejected RCPT <visite@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.253.159.121
country_id: 732800
description:
Jun 17 07:24:15 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.253.159.121 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:07:23:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:07:23:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804183&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781681010 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:07:23:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6984297&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781681015 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.253.159.121
country_id: 732800
description:
Jun 17 07:24:28 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.253.159.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.202.84.234
country_id: 130758
description:
2026-06-17 07:26:21 dovecot_plain authenticator failed for H=(c29l0k0bxhflkbauhe3d) [5.202.84.234]:41585: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 23.234.90.173
country_id: 6252001
description:
23.234.90.173 - - [17/Jun/2026:07:25:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10196116&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DbmV3Z29hbHMyNUB1a3IubmV0&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781681135 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=bmV3Z29hbHMyNUB1a3IubmV0" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:142.0) Gecko/20100101 Firefox/142.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:23.234.90.173


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.69.5.145
country_id: 783754
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/1211571715 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.13
country_id: 3469034
description:
Jun 17 07:27:10 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.87.106
country_id: 3865483
description:
Jun 17 07:26:47 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.87.106 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.66.118.212
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/6c6a5d HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.40.55.173
country_id: 3437598
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/99b2c2 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.13
country_id: 3469034
description:
Jun 17 07:27:24 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.13 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 192.227.228.153
country_id: 6252001
description:
192.227.228.153 - - [17/Jun/2026:07:28:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9857682&pdata=http%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252F956caa81b3c8ac8e2112f34b9feb7a31%252F9e748621ef5af3193726f97634097a23%252F1891d514c9aaf242756eccd4b76f285b%252F341167fea77beadc2c68115c2bca1713%252F2472c979c209f4210eb90f3ec0789f65%252Findex.php%253Fcmd%253Dlogin&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781681309 HTTP/1.1" 302 0 kpmg.tg "http://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/956caa81b3c8ac8e2112f34b9feb7a31/9e748621ef5af3193726f97634097a23/1891d514c9aaf242756eccd4b76f285b/341167fea77beadc2c68115c2bca1713/2472c979c209f4210eb90f3ec0789f65/index.php?cmd=login" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:192.227.228.153


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.170.43.53
country_id: 2363686
domain: leadelles.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.18||T:APACHE||MV:/index.php/wp-json/wp/v2/users/3?context=view&_fields=id%2Cname&_locale=user||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-17 07:29:23 +0000] info [webmaild] 196.171.46.177 - matthieu.awide@togointerim.net "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.171.29.125
country_id: 2363686
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.18||T:APACHE||MV:/wp-json/wp/v2/users?context=view&search=&_locale=user||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.171.29.125
country_id: 2363686
domain: lacs1.mairie.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.18||T:APACHE||MV:/wp-json/wp/v2/users?context=view&search=l&_locale=user||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.186.45.28
country_id: 289688
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/346690123 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.236.193.141
country_id: 6252001
description:
2026-06-17 07:32:15 dovecot_plain authenticator failed for H=c-98-236-193-141.hsd1.pa.comcast.net (xb3sqepobdxu5k1q0o7gz9z6oq0g6x) [98.236.193.141]:50536: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.234.201.154
country_id: 953987
description:
Jun 17 07:33:13 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.234.201.154 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.50.149.0
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/1094744546 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.234.201.154
country_id: 953987
description:
Jun 17 07:33:21 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.234.201.154 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.194.78.226
country_id: 6252001
domain: haplucia-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:104.194.78.226||TA:104.194.78.226||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:07:36:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934178&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781681818 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:07:37:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10183573&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781681819 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:07:38:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10341271&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781681883 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:07:38:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13133978&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781681882 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:07:38:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065008&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781681882 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:07:38:35 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:07:38:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:07:38:31 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:07:38:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.88
country_id: 3175395
description:
Jun 17 07:39:29 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.88 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 81.214.73.166
country_id: 298795
domain: 24heureinfo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:07-41.81.214.73.166||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.102.154.143
country_id: 3175395
description:
Jun 17 07:43:13 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.102.154.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.78.112.174
country_id: 1269750
description:
Jun 17 07:44:10 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.78.112.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.112.174
country_id: 1269750
description:
2026-06-17 07:44:12 dovecot_login authenticator failed for H=([211.62.73.218]) [182.78.112.174]:40900: 535 Incorrect authentication data (set_id=pascaljoseph.panassi@sodigaz.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.102.154.143
country_id: 3175395
description:
Jun 17 07:43:25 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.102.154.143 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 190.112.88.156
country_id: 3865483
description:
190.112.88.156 - - [17/Jun/2026:07:43:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6788718&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fseries-a-choisir-au-lycee%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781682218 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/series-a-choisir-au-lycee/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.3873.1343 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:190.112.88.156


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 196.170.43.53
country_id: 2363686
domain: leadelles.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.18||T:APACHE||MV:/index.php/wp-json/wp/v2/users/me?_locale=user||


plugin: modsec
rule: 77350553
name: IM360 WAF: Drupalgeddon test (CVE-2018-7602)
abuser: 107.151.195.176
country_id: 6252001
domain: www.togofeed.com
description:
IM360 WAF: Drupalgeddon test (CVE-2018-7602)||MVN:ARGS_NAMES:\\xc48\\xb8\\xff\\xbb\\x89Bo\\xd7\\x1a\\x14x) \\xb6V\\xf4\"\\x11@6\\x0e\\xec\\x9e\\x009\\xb3\\x18\\x96\\xf0Gtb\\xf7@\\xf8\\x07\\xc2A0\\xc9B\\xc2\\xb2\\r\\xbbAi\\xf9:\\xf3P\\xaf\\v\\xe0\\xf8\\n\\x81\\xb2Zb[#\\x89\\xc5\\x0f\\xa3C\\xc5\\x9fZ\\xf5\\x01\\xae%\\xe0S\\x16\\xa3\\xac*4)\\x11\\x8f\\xa3pW\\x86e\\x02r\\xc1J\\xfbl\\xb9\\xf3nR\\x9b\\xc8\\xef\\x85Np<\\x92R\\xfd9;/Y\\xf8j\\v|\\x03\\xc4\\xc8\\x9b\\xcd]o\\xfc.\\xbb\\b\\x11\\x05\\t\\xb7\\xca\\xc2\\x10\\x02\\xf4\\x1e\\x010h\\x18\\x9d\\x98\\x91\\xc2\\xb42\\xba\\xdcAn\\x18(\\x14\\x06l\\xb5\\x0ce\\xf9\\xbe\\xd7\\x90\\x15\\x04\\xe6\\xcf\\x02\\xc1\\x8e/JJ\\xfc\\x1c\\x15q4d5\\xd0\\xc1\\x8e\\xff\\xbd\\x9b\\x98%\\x94/% 8<\\xda\\x92\\x8cz3\\xb6\\xfd\\xb4xc\\xf3\\x1b\\x10.\\x96X\\x80\"\\xa0\\xe9q||MV:\xc48\xb8\xff\xbb\x89Bo\xd7\x1a\x14x) \xb6V\xf4\"\x11@6\x0e\xec\x9e\x009\xb3\x18\x96\xf0Gtb\xf7@\xf8\x07\xc2A0\xc9B\xc2\xb2\r\xbbAi\xf9:\xf3P\xaf\v\xe0\xf8\n\x81\xb2Zb[#\x89\xc5\x0f\xa3C\xc5\x9fZ\xf5\x01\xae%\xe0S\x16\xa3\xac*4)\x11\x8f\xa3pW\x86e\x02r\xc1J\xfbl\xb9\xf3nR\x9b\xc8\xef\x85Np<\x92R\xfd9;/Y\xf8j\v|\x03\xc4\xc8\x9b\xcd]o\xfc.\xbb\b\x11\x05\t\xb7\xca\xc2\x10\x02\xf4\x1e\x010h\x18\x9d\x98\x91\xc2\xb42\xba\xdcAn\x18(\x14\x06l\xb5\x0ce\xf9\xbe\xd7\x90\x15\x04\xe6\xcf\x02\xc1\x8e/JJ\xfc\x1c\x15q4d5\xd0\xc1\x8e\xff\xbd\x9b\x98%\x94/% 8<\xda\x92\x8cz3\xb6\xfd\xb4xc\xf3\x1b\x10.\x96X\x80\"\xa0\xe9q||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 177.8.134.180
country_id: 3469034
description:
177.8.134.180 - - [17/Jun/2026:07:44:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10471878&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Frevalorisation-du-smig-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781682267 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/revalorisation-du-smig-au-togo/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.8972.1213 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:177.8.134.180


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 80.248.72.20
country_id: 2363686
description:
[2026-06-17 07:46:49 +0000] info [webmaild] 80.248.72.20 - support@cloud-et-racks.tg "POST /cpsess9831401522/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [80.248.64.198] != Current IP Address [80.248.72.20]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 91.251.153.60
country_id: 130758
description:
2026-06-17 07:47:30 H=([91.251.153.60]) [91.251.153.60]:4684 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 87.167.214.64
country_id: 2921044
domain: www.arse.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:07-48.87.167.214.64||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.171.46.177
country_id: 2363686
description:
2026-06-17 07:49:08 dovecot_login authenticator failed for H=(ASSRH7) [196.171.46.177]:51693: 535 Incorrect authentication data (set_id=sandra.amana@togointerim.net)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.208.110.59
country_id: 2921044
domain: www.arse.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:07-48.92.208.110.59||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 94.134.179.79
country_id: 2921044
domain: www.arse.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:07-49.94.134.179.79||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.36.108.114
country_id: 2921044
domain: www.arse.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:07-49.91.36.108.114||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.17.37.57
country_id: 1819730
description:
[2026-06-17 07:50:13 +0000] info [webmaild] 84.17.37.57 - pmidamon@otr.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 87.157.40.74
country_id: 2921044
domain: www.arse.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:07-49.87.157.40.74||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.49.238.54
country_id: 2921044
domain: www.arse.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:07-49.91.49.238.54||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:07:53:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6644882&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781682789 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.129.51
country_id: 99237
description:
Jun 17 07:52:50 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.129.51 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:07:52:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6657942&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781682771 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.98.92
country_id: 3865483
description:
Jun 17 07:52:51 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.98.92 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [17/Jun/2026:07:53:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9921690&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781682782 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:07:53:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6788242&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781682783 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.101
country_id: 3175395
description:
Jun 17 07:53:08 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.101 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:07:54:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9987434&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781682842 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:07:54:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13016940&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781682844 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.190.201.27
country_id: 3469034
description:
45.190.201.27 - - [17/Jun/2026:07:54:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6659222&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fpasseport-electronique-du-ghana%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781682858 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/passeport-electronique-du-ghana/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.7693.1225 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.190.201.27


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.171.46.177
country_id: 2363686
description:
2026-06-17 07:53:25 dovecot_login authenticator failed for H=(ASSRH7) [196.171.46.177]:54177: 535 Incorrect authentication data (set_id=sandra.amana@togointerim.net)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 37.215.46.146
country_id: 630336
description:
37.215.46.146 - - [17/Jun/2026:07:54:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6592105&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fcandidat-au-bepc-se-donne-la-mort-par-pendaison%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781682890 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/candidat-au-bepc-se-donne-la-mort-par-pendaison/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.6135.1129 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:37.215.46.146


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.171.46.177
country_id: 2363686
description:
2026-06-17 07:55:21 dovecot_login authenticator failed for H=(ASSRH7) [196.171.46.177]:54210: 535 Incorrect authentication data (set_id=sandra.amana@togointerim.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 91.251.153.60
country_id: 130758
description:
2026-06-17 07:55:26 H=([91.251.153.60]) [91.251.153.60]:4697 F=<John@4452.com> rejected RCPT <contact@cloud-et-racks.tg>: Sender verify failed


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:07:55:47 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 185.252.220.116
country_id: 798549
description:
[2026-06-17 07:56:20 +0000] info [webmaild] 185.252.220.116 - hboroze@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:07:55:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:07:55:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:07:55:48 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.171.46.177
country_id: 2363686
description:
2026-06-17 07:56:16 dovecot_login authenticator failed for H=(ASSRH7) [196.171.46.177]:54214: 535 Incorrect authentication data (set_id=sandra.amana@togointerim.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.236
country_id: 3469034
description:
Jun 17 07:57:10 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.171.46.177
country_id: 2363686
description:
2026-06-17 07:57:18 dovecot_login authenticator failed for H=(ASSRH7) [196.171.46.177]:54219: 535 Incorrect authentication data (set_id=sandra.amana@togointerim.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 185.252.220.116
country_id: 798549
description:
[2026-06-17 07:57:20 +0000] info [webmaild] 185.252.220.116 - hboroze@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.184.180.170
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/03/Page-2-B.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2023/03/Page-2-B-300x199.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2023/03/Page-2-B-768x510.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2023/03/Page-2-B-272x182.jpg 272w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.236
country_id: 3469034
description:
Jun 17 07:57:25 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.236 has been locked due to Imunify RBL


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.172.194.93
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:page_title||MV:Apoth\xc3\xa9ose des Evala 2024\xc2\xa0: Le chef de l\xe2\x80\x99\xc3\x89tat f\xc3\xa9licite la jeunesse pour la bonne tenue des festivit\xc3\xa9s||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.171.46.177
country_id: 2363686
description:
2026-06-17 07:58:21 dovecot_login authenticator failed for H=(ASSRH7) [196.171.46.177]:54222: 535 Incorrect authentication data (set_id=sandra.amana@togointerim.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 1.26.176.46
country_id: 1814991
description:
2026-06-17 07:59:02 H=([1.26.176.46]) [1.26.176.46]:1585 F=<John@4452.com> rejected RCPT <agounkej@ucao-uut.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.59.115.202
country_id: 6252001
description:
Jun 17 08:00:48 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.59.115.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.59.115.202
country_id: 6252001
description:
2026-06-17 08:00:50 dovecot_plain authenticator failed for H=(kdjnqic3l7wv1hago5iky3thlp82) [172.59.115.202]:31801: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.36.191.21
country_id: 2750405
description:
185.36.191.21 - - [17/Jun/2026:08:00:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10196679&pdata=https%253A%252F%252Fbutodra.tg%252Fwp-login.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781683256 HTTP/2.0" 302 0 butodra.tg "https://butodra.tg/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.36.191.21


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 185.36.191.21
country_id: 2750405
domain: butodra.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.18||T:APACHE||MV:/wp-json/wp/v2/users/me?_locale=user||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 185.36.191.21
country_id: 2750405
domain: butodra.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.18||T:APACHE||MV:/wp-json/wp/v2/users/?who=authors&per_page=100&_locale=user||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.171.46.177
country_id: 2363686
description:
2026-06-17 08:02:35 dovecot_login authenticator failed for H=(ASSRH7) [196.171.46.177]:54261: 535 Incorrect authentication data (set_id=sandra.amana@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.171.46.177
country_id: 2363686
description:
2026-06-17 08:03:33 dovecot_login authenticator failed for H=(ASSRH7) [196.171.46.177]:54267: 535 Incorrect authentication data (set_id=sandra.amana@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.171.46.177
country_id: 2363686
description:
2026-06-17 08:04:42 dovecot_login authenticator failed for H=(ASSRH7) [196.171.46.177]:54268: 535 Incorrect authentication data (set_id=sandra.amana@togointerim.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.29.15
country_id: 3625428
description:
Jun 17 08:04:44 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.29.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.89.29.15
country_id: 3625428
description:
2026-06-17 08:04:46 dovecot_plain authenticator failed for H=(1w7fsu5869g1gnalsmt3neeny4qpfx) [190.89.29.15]:50497: 535 Incorrect authentication data (set_id=info@keedyfarms.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.171.46.177
country_id: 2363686
description:
2026-06-17 08:05:40 dovecot_login authenticator failed for H=(ASSRH7) [196.171.46.177]:54269: 535 Incorrect authentication data (set_id=sandra.amana@togointerim.net)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [17/Jun/2026:08:07:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10314393&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781683635 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 203.57.50.250
country_id: 2077456
description:
203.57.50.250 - - [17/Jun/2026:08:07:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9673836&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781683636 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.57.50.250


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.171.46.177
country_id: 2363686
description:
2026-06-17 08:06:41 dovecot_login authenticator failed for H=(ASSRH7) [196.171.46.177]:54273: 535 Incorrect authentication data (set_id=sandra.amana@togointerim.net)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 158.173.66.40
country_id: 2077456
description:
158.173.66.40 - - [17/Jun/2026:08:07:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9726056&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781683632 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:158.173.66.40


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:08:07:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13136285&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781683632 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:08:07:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9936026&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781683640 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.171.46.177
country_id: 2363686
description:
2026-06-17 08:07:38 dovecot_login authenticator failed for H=(ASSRH7) [196.171.46.177]:54282: 535 Incorrect authentication data (set_id=sandra.amana@togointerim.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.171.46.177
country_id: 2363686
description:
2026-06-17 08:08:55 dovecot_login authenticator failed for H=(ASSRH7) [196.171.46.177]:54289: 535 Incorrect authentication data (set_id=sandra.amana@togointerim.net)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:08:09:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10183832&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781683741 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:08:09:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10208361&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781683743 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 114.74.22.65
country_id: 2077456
description:
114.74.22.65 - - [17/Jun/2026:08:09:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9858713&pdata=https%253A%252F%252Fcpanel.appflutter.free.netmaster.tg%252F%253Flocale%253Dfi&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781683759 HTTP/2.0" 302 0 cpanel.appflutter.free.netmaster.tg "https://cpanel.appflutter.free.netmaster.tg/?locale=fi" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:114.74.22.65


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.171.46.177
country_id: 2363686
description:
2026-06-17 08:09:24 dovecot_login authenticator failed for H=(ASSRH7) [196.171.46.177]:54292: 535 Incorrect authentication data (set_id=sandra.amana@togointerim.net)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:08:10:55 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:08:10:56 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [17/Jun/2026:08:10:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.88.98.130
country_id: 6251999
description:
[2026-06-17 08:11:11 +0000] info [webmaild] 149.88.98.130 - sahondo@otr.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.216.166.30
country_id: 3595528
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/09/WhatsApp-Image-2023-09-26-at-18.42.04-2.jpeg 1080w, http:/togodailynews.tg/wp-content/uploads/2023/09/WhatsApp-Image-2023-09-26-at-18.42.04-2-300x196.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2023/09/WhatsApp-Image-2023-09-26-at-18.42.04-2-1024x670.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2023/09/WhatsApp-Image-2023-09-26-at-18.42.04-2-768x503.jpeg 768w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.88
country_id: 2077456
description:
103.108.92.88 - - [17/Jun/2026:08:10:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.88


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 77.243.90.12
country_id: 241170
domain: www.letabloid.tg
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS_NAMES:gt;If you have any inquiries pertaining to in which and how to use ||MV:gt;If you have any inquiries pertaining to in which and how to use ||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 179.6.43.109
country_id: 3932488
description:
179.6.43.109 - - [17/Jun/2026:08:11:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065515&pdata=https%253A%252F%252Fcpanel.appflutter.free.netmaster.tg%252F%253Flocale%253Dzh_tw&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781683883 HTTP/2.0" 302 0 cpanel.appflutter.free.netmaster.tg "https://cpanel.appflutter.free.netmaster.tg/?locale=zh_tw" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:179.6.43.109


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.6.206.13
country_id: 1820814
description:
Jun 17 08:13:02 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.6.206.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.228.102.165
country_id: 1835841
description:
Jun 17 08:13:02 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.228.102.165 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 37.211.110.142
country_id: 289688
domain: bawasongroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:68398.bawasongroup.com||ServerName:bawasongroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:36e0879042b24c83396308656d42b95abe18ecfa||Title:0xb05407f5||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 111.15.169.69
country_id: 1814991
description:
2026-06-17 08:12:27 H=([111.15.169.69]) [111.15.169.69]:64758 F=<John@4452.com> rejected RCPT <j.delbegue@tps.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.141.193.42
country_id: 1835841
description:
Jun 17 08:13:28 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.141.193.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.36.194.131
country_id: 272103
description:
Jun 17 08:13:34 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.36.194.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.154.116.10
country_id: 1814991
description:
Jun 17 08:14:01 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.154.116.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.21.243.58
country_id: 1814991
description:
Jun 17 08:14:08 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.21.243.58 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.225.47
country_id: 1880251
description:
[2026-06-17 08:14:39 +0000] info [cpaneld] 129.212.225.47 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.141.193.42
country_id: 1835841
description:
Jun 17 08:14:47 ns5 auth[1130641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.141.193.42 has been locked due to Imunify RBL


