# incident

plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.38.207.199
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:239c63f572401baf51ba7e95fc46d0973d9dfb33||Title:vd4autsjfz6bms2p||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 196.3.98.26
country_id: 1036973
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a7da87397bf03188dcbe7b86f3030a39d60529ee||Title:0x42cdf72f||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 196.3.98.26
country_id: 1036973
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cabe4b9568536082b77f61f3a152c76a0b470a0a||Title:0x817757a2||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.38.207.199
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fce0d622113f03db82a65f441f0bb93e9c053589||Title:9dxs27xn7x956isv||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-18 06:38:26 +0000] info [cpaneld] 102.54.238.57 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.38.207.199
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f96b3ec3c57bf8d52c22b16a390fee68581e0bac||Title:dk2j72adlcdp9odon||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.52.135.119
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/05/images-1-1.jpg 275w, http:/togodailynews.tg/wp-content/uploads/2024/05/images-1-1-272x182.jpg 272w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 196.3.98.26
country_id: 1036973
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6a2ac0c64376f07b00c0da807636377427364516||Title:0xb305bca7||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.38.207.199
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:794e70973ec969c81ee52465abc25d574827ae05||Title:0i2bmjt9j5yqpe0||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 196.3.98.26
country_id: 1036973
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3f71ea186628a3414334991dbc0d53c1ef777129||Title:0xb319fda9||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.35.93
country_id: 953987
description:
Jun 18 06:39:35 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.35.93 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.38.207.199
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2ac7950f49686ff91190d46697234f9865c8b872||Title:0npk44zu7orgt8x1b||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 196.3.98.26
country_id: 1036973
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ee2279bab55335b76ebbd157ea18c8bcf3b8c568||Title:0x3206c6b0||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.38.207.199
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ba9ff7b051f1075b393b1295b243ba629f1ffa46||Title:bpctlmbibnjs8qezp||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 196.3.98.26
country_id: 1036973
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:886b780b0f8fb96043ae9c0c8806d326422f6fd5||Title:0x82b3662c||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.38.207.199
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1dc1821895e29db77b7c5c7eb9ad0733ce78f3f8||Title:ip2bxap8jdtcub||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.60.197.156
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/64506484 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 196.3.98.26
country_id: 1036973
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2b29a45f9254dca318246a9522d0280607072e17||Title:0x036d1b6d||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 196.3.98.26
country_id: 1036973
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9fee12462967f1118d0c3b061d1356c2cbd45648||Title:0x4592d308||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 144.126.240.247
country_id: 1880251
description:
144.126.240.247 - - [18/Jun/2026:06:43:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6910356&pdata=http%253A%252F%252Fyzsfow.mediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781765031 HTTP/1.1" 302 0 yzsfow.mediatopnews.tg "http://yzsfow.mediatopnews.tg/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:144.126.240.247


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:06:44:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7169945&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781765054 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 188.130.221.106
country_id: 2017370
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:06-43.188.130.221.106||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.38.198.245
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f6db0d9e73bccc74400dc201d8a576835e945b78||Title:e4qdbikakn5rtc||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.38.198.245
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:21d609283a6c339b34987010c483eaa48cb59c07||Title:x2r2hvsga0mfusys||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 196.3.98.26
country_id: 1036973
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:48fba35bd0f5c6194fae4f24c6a0879305d0e6a6||Title:0x02fe6882||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 196.3.98.26
country_id: 1036973
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b6115a038bedd36344b58d3e4b3d772a3f316b93||Title:0x3fbb88a4||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.133
country_id: 2635167
description:
[2026-06-18 06:46:05 +0000] info [cpaneld] 5.230.133.133 NEW wcnyaruu:0WmtXHyMmpyAGahX address=5.230.133.133,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.38.198.245
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:813ac699252ffda6a8090facd260c2f4f20406b2||Title:r2tv6j0hw09hx0pv||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 196.3.98.26
country_id: 1036973
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ba310f34c89801ca884642e98b311e72f14e5fe0||Title:0x324afa0e||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.38.198.245
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0052580ea82fac4f931e70dbe607efb34154ac1b||Title:v5rh3fhf5vmehm67k||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.96.195.87
country_id: 3865483
description:
Jun 18 06:47:00 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.96.195.87 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 196.3.98.26
country_id: 1036973
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c64ec18fb38e733edfbf34967432189309781c7b||Title:0x21aea0b7||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.38.200.53
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ff07907b251af1358b1dcc33bfc027fc3b91f417||Title:bcp05g4prulh3ni||RSV:8.18||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.202.254.152
country_id: 2562770
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:142.202.254.152||TA:142.202.254.152||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 196.3.98.26
country_id: 1036973
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:90c2b3c4880a852ee80b2eb19d8417cf4e2780ac||Title:0x8d136727||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.38.200.53
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:659e402a22b9ce4f50cf867286be95e7e7baad59||Title:gaxp54jvfqlfccx3i3||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 196.3.98.26
country_id: 1036973
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0088f3765553e24ac77ce4cc7ce091faa6edcf8e||Title:0x458ef223||RSV:8.18||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 194.113.119.75
country_id: 2921044
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:194.113.119.75||TA:194.113.119.75||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 188.113.207.1
country_id: 1512440
description:
2026-06-18 06:50:17 H=([188.113.207.1]) [188.113.207.1]:22047 F=<John@4452.com> rejected RCPT <fernand@sodigaz.tg>: Sender verify failed


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.38.200.53
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c4d04ebc6504d6757f4954341fda7e59c6e6593b||Title:r3irmx2rbgjzmza||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:06:50:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13016263&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781765415 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.38.200.53
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f67cfb1b8a482b069f8d38090b7e63af520d2ea5||Title:cz4tmfuhftxvgya3yd||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.120.153
country_id: 3865483
description:
Jun 18 06:50:27 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.120.153 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 196.3.98.26
country_id: 1036973
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bb67799d5070e0ece7d80193f2c0420fe04b3d67||Title:0xa7458a85||RSV:8.18||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.253.48.174
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:104.253.48.174||TA:104.253.48.174||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 80.251.232.242
country_id: 2017370
description:
[2026-06-18 06:51:57 +0000] info [cpaneld] 80.251.232.242 - bier "GET /login/?login_only=1&user=bier&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bier (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.49.108.234
country_id: 2017370
description:
[2026-06-18 06:52:00 +0000] info [cpaneld] 185.49.108.234 - bie "GET /login/?login_only=1&user=bie&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bie (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 196.3.98.26
country_id: 1036973
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8459110d2cda9360249808cb873da2b20b3e1261||Title:0x82bc8e04||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.245.89.53
country_id: 2589581
description:
[2026-06-18 06:51:46 +0000] info [cpaneld] 154.245.89.53 - bieredja "GET /login/?login_only=1&user=bieredja&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bieredja (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.38.200.53
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1cce6c7ba5ab5194aa0d7c9b8ba8b2b41fc5bd41||Title:5009pz022l583tj1yc||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.38.200.53
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9a3bb46b4eb98ca5862b094cf7052647af1c481e||Title:atpb18gz618qvn7hp||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 188.113.207.1
country_id: 1512440
description:
2026-06-18 06:52:51 H=([188.113.207.1]) [188.113.207.1]:22093 F=<John@4452.com> rejected RCPT <fernand@sodigaz.tg>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.245
country_id: 3469034
description:
Jun 18 06:52:59 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.245 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 196.3.98.26
country_id: 1036973
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:324adf7aabedd68757c450b9d13286469e1e8a1a||Title:0x3b41d808||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.38.200.53
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:efaeb54e5d976481b56bfba5136fc12b22106132||Title:ir0905l5vthg1gplj||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 196.3.98.26
country_id: 1036973
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7bc145fa2fa2ecf1fd5aa3e7428b9995203c7ea1||Title:0xab56b4b1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.38.200.53
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:641c14d45435b6ef5b60412cd79315952c93c467||Title:4nyex1j85eyqlgpqv||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.95.42.251
country_id: 953987
description:
[2026-06-18 06:54:46 +0000] info [cpaneld] 197.95.42.251 - cfmitg "GET /login/?login_only=1&user=cfmitg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cfmitg (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 196.3.98.26
country_id: 1036973
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f13dda474468f649d1f8b19d66791e69b65e9280||Title:0x6bc340a6||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.93.113.96
country_id: 2017370
description:
[2026-06-18 06:54:36 +0000] info [cpaneld] 77.93.113.96 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.38.200.53
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:78b99b06c896aafc637b52763f99d4d68c096c13||Title:ll2ccbejcedoaa||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 196.3.98.26
country_id: 1036973
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9af00ada8fcb812d537687e0a854eb93afd4b01b||Title:0x7faabd38||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 196.3.98.26
country_id: 1036973
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a12499c9e9ee88f24adc4bd3dac7112463b88b75||Title:0xff3e43e3||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.38.200.53
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:614964d4d899116cbb65f3ca0295a97f03c26def||Title:651v5mhfzc7den5w||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.202.192.22
country_id: 290557
description:
[2026-06-18 06:57:05 +0000] info [cpaneld] 94.202.192.22 - zontalomemilleniumtg "GET /login/?login_only=1&user=zontalomemilleniumtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zontalomemilleniumtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 148.227.69.97
country_id: 3865483
description:
[2026-06-18 06:57:06 +0000] info [cpaneld] 148.227.69.97 - atmstg "GET /login/?login_only=1&user=atmstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user atmstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.82.164.33
country_id: 3625428
description:
[2026-06-18 06:57:11 +0000] info [cpaneld] 200.82.164.33 - at "GET /login/?login_only=1&user=at&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user at (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.177.77.149
country_id: 3469034
description:
[2026-06-18 06:57:22 +0000] info [cpaneld] 45.177.77.149 - zonta "GET /login/?login_only=1&user=zonta&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zonta (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.53.133.6
country_id: 3469034
description:
[2026-06-18 06:57:51 +0000] info [cpaneld] 177.53.133.6 - las "GET /login/?login_only=1&user=las&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user las (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.38.200.53
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c23f2f6d5b85a5bcf08bc06a6ccc94902adc184e||Title:e5c8rn97xrolp5xosq||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 196.3.98.26
country_id: 1036973
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6ec4ab4644aa754be140ae8511bc2be9bd4c6b89||Title:0xbf77382f||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.6.153.122
country_id: 2635167
description:
[2026-06-18 06:57:44 +0000] info [cpaneld] 94.6.153.122 - lasnb "GET /login/?login_only=1&user=lasnb&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lasnb (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.204.33.31
country_id: 1168579
description:
[2026-06-18 06:57:27 +0000] info [cpaneld] 103.204.33.31 - zont "GET /login/?login_only=1&user=zont&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zont (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.136.203.30
country_id: 1210997
description:
[2026-06-18 06:57:42 +0000] info [cpaneld] 103.136.203.30 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.7.187.183
country_id: 3469034
description:
Jun 18 06:57:57 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.7.187.183 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.158.230.190
country_id: 2400553
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1977846916 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 196.3.98.26
country_id: 1036973
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:76af90303096c697f12e1ffb618452e632144d7a||Title:0x589ded1a||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.38.200.53
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1d0ff6adcab8428a4c58f44029bd587c09d0a770||Title:m3y5wn3m5om0ydyw||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.38.200.53
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:90848239c687d71c30fc5debcbdb340625ec0cec||Title:b766ptm8axcuuz||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:06:59:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6787994&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781765965 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 196.3.98.26
country_id: 1036973
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:40f6a22626437786415950b62bd2075605ee40f9||Title:0xdbc48be7||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.90
country_id: 1269750
description:
Jun 18 06:59:51 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.90 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.38.200.53
country_id: 1168579
domain: sp-eau.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:richgnim22.sp-eau.tg||ServerName:sp-eau.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4b53d05b0aa44d85e6fb19c5cd298fcf8a562bb7||Title:mftosv8rgs6lzoxt21||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 196.3.98.26
country_id: 1036973
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c30a77638274b08da780db0265f89a0dc16fade1||Title:0xc70577c5||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.208.54.64
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/05/infirmier-africain.jpg 1023w, http:/togodailynews.tg/wp-content/uploads/2024/05/infirmier-africain-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2024/05/infirmier-africain-768x512.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2024/05/infirmier-africain-272x182.jpg 272w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 18 07:02:42 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.169.16.242
country_id: 2363686
description:
[2026-06-18 07:03:58 +0000] info [cpaneld] 196.169.16.242 - myxlsnta "GET /cpsess7090208477/frontend/jupiter/mail/webmailform.html?user=odoo1%40dagl.tg&return_request_uri=%2Fcpsess7090208477%2Ffrontend%2Fjupiter%2Femail_accounts%2Findex.html HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [196.168.208.72] != Current IP Address [196.169.16.242]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.169.16.242
country_id: 2363686
description:
[2026-06-18 07:04:01 +0000] info [cpaneld] 196.169.16.242 - myxlsnta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 139.135.36.84
country_id: 1168579
description:
[2026-06-18 07:04:15 +0000] info [cpaneld] 139.135.36.84 - cec "GET /login/?login_only=1&user=cec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cec (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.169.16.242
country_id: 2363686
description:
[2026-06-18 07:04:14 +0000] info [cpaneld] 196.169.16.242 NEW myxlsnta:iMPzK5MZe8nvnpMh address=196.169.16.242,app=cpaneld,creator=myxlsnta,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.192.250.4
country_id: 3865483
description:
[2026-06-18 07:04:19 +0000] info [cpaneld] 190.192.250.4 - ce "GET /login/?login_only=1&user=ce&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ce (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.215.229.71
country_id: 3895114
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/09/Togo-Education-de-qualite-une-priorite-du-chef-de-lEtat-1.jpg 1080w, http:/togodailynews.tg/wp-content/uploads/2024/09/Togo-Education-de-qualite-une-priorite-du-chef-de-lEtat-1-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2024/09/Togo-Education-de-qualite-une-priorite-du-chef-de-lEtat-1-1024x683.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/09/Togo-Education-de-qualite-une-priorite-du-chef-de-lEtat-1-768x512.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2024/09/Togo-Education-de-qualite-une-priorite-du-chef-de-lEtat-1-272x182.jpg 272w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - odoo1@dagl.tg [06/18/2026:07:04:29 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: odoo1@dagl.tg


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 102.165.55.238
country_id: 953987
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:07-04.102.165.55.238||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 72.56.148.200
country_id: 597427
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:page_title||MV:Evala 2023\xc2\xa0: Chants et danses, une tradition culturelle qui se perp\xc3\xa9tue||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 144.48.52.102
country_id: 783754
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:07-04.144.48.52.102||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 144.48.52.235
country_id: 783754
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:07-05.144.48.52.235||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 191.101.114.21
country_id: 290557
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:07-04.191.101.114.21||RSV:8.18||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - odoo2@dagl.tg [06/18/2026:07:05:30 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: odoo2@dagl.tg


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.31.149.69
country_id: 2635167
domain: www.letabloid.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.letabloid.tg/wp-content/uploads/2020/10/APPEL-AUX-PARENTS-2020.pdf HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.163.108.237
country_id: 3895114
description:
[2026-06-18 07:05:40 +0000] info [cpaneld] 190.163.108.237 - chusotg "GET /login/?login_only=1&user=chusotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user chusotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 116.96.44.109
country_id: 1562822
description:
[2026-06-18 07:05:50 +0000] info [cpaneld] 116.96.44.109 - ch "GET /login/?login_only=1&user=ch&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ch (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.196.253.94
country_id: 2635167
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:07-05.196.196.253.94||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.158.58.175
country_id: 1512440
description:
[2026-06-18 07:05:37 +0000] info [cpaneld] 94.158.58.175 - chuso "GET /login/?login_only=1&user=chuso&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user chuso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.142.152.207
country_id: 1733045
description:
[2026-06-18 07:05:43 +0000] info [cpaneld] 161.142.152.207 - chus "GET /login/?login_only=1&user=chus&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user chus (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 108.25.79.232
country_id: 6252001
domain: letabloid.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/letabloid.tg/wp-content/uploads/2020/10/APPEL-AUX-PARENTS-2020.pdf HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 181.215.16.116
country_id: 290557
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:07-05.181.215.16.116||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 102.165.54.4
country_id: 953987
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:07-06.102.165.54.4||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:07:07:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869166&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781766425 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.188.233.158
country_id: 1835841
description:
Jun 18 07:08:15 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.188.233.158 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 180.75.245.251
country_id: 1733045
description:
180.75.245.251 - - [18/Jun/2026:07:07:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13015954&pdata=https%253A%252F%252Ftogodailynews.tg%252Ffocac2024-faure-gnassingbe-rencontre-les-investisseurs-chinois%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781766454 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/focac2024-faure-gnassingbe-rencontre-les-investisseurs-chinois/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2300.1258 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:180.75.245.251


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.202.234.35
country_id: 130758
description:
Jun 18 07:08:00 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.202.234.35 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.122.168.216
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/fonds-africain-de-developpement-cinq-pays-membres-regionaux-de-la-bad-prendront-part-a-la-reconstitution-des-ressources/ HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.122.168.216
country_id: 3469034
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/fonds-africain-de-developpement-cinq-pays-membres-regionaux-de-la-bad-prendront-part-a-la-reconstitution-des-ressources/ HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 186.179.10.156
country_id: 3996063
domain: macite.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:186.179.10.156||TA:186.179.10.156||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.246
country_id: 1269750
description:
Jun 18 07:09:58 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.190
country_id: 2510769
description:
Jun 18 07:09:37 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 18 07:11:17 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.188.233.158
country_id: 1835841
description:
Jun 18 07:11:26 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.188.233.158 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.235.163.208
country_id: 1210997
description:
[2026-06-18 07:13:16 +0000] info [cpaneld] 103.235.163.208 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.39.92.163
country_id: 3865483
description:
[2026-06-18 07:13:22 +0000] info [cpaneld] 186.39.92.163 - cafeit "GET /login/?login_only=1&user=cafeit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafeit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.244.177
country_id: 1733045
description:
[2026-06-18 07:13:26 +0000] info [cpaneld] 180.75.244.177 - cafeittg "GET /login/?login_only=1&user=cafeittg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafeittg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.101.231.170
country_id: 1605651
description:
[2026-06-18 07:13:30 +0000] info [cpaneld] 171.101.231.170 - cafei "GET /login/?login_only=1&user=cafei&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafei (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.226.132.8
country_id: 3017382
description:
[2026-06-18 07:13:37 +0000] info [cpaneld] 82.226.132.8 - caf "GET /login/?login_only=1&user=caf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user caf (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.27.147
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/7f767c HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:07:15:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10393753&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781766903 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.196
country_id: 2510769
description:
Jun 18 07:14:47 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.186.154.43
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1582456512 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.141.175.170
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1889687519 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.161.195.77
country_id: 1643084
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2020/11/D\xc3\xa9veloppement-\xc3\xa0-la-base.jpeg 800w, http:/togodailynews.tg/wp-content/uploads/2020/11/D\xc3\xa9veloppement-\xc3\xa0-la-base-300x225.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2020/11/D\xc3\xa9veloppement-\xc3\xa0-la-base-768x576.jpeg 768w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.163.54
country_id: 1819730
description:
[2026-06-18 07:18:11 +0000] info [cpaneld] 104.28.163.54 - cvajhehu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cvajhehu (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.252.109.178
country_id: 3469034
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:104.252.109.178||TA:104.252.109.178||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 18 07:18:26 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.196.21
country_id: 3469034
description:
Jun 18 07:18:29 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.196.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.23.247.168
country_id: 953987
description:
Jun 18 07:18:25 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.23.247.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.118.126
country_id: 1269750
description:
2026-06-18 07:19:58 dovecot_login authenticator failed for H=([49.125.203.165]) [122.184.118.126]:48872: 535 Incorrect authentication data (set_id=simtaya@cfpj.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.211.105.56
country_id: 3996063
description:
[2026-06-18 07:21:03 +0000] info [cpaneld] 187.211.105.56 - fundacionesperanzatogo "GET /login/?login_only=1&user=fundacionesperanzatogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacionesperanzatogo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.161.190.125
country_id: 290291
description:
[2026-06-18 07:21:07 +0000] info [cpaneld] 109.161.190.125 - fundacionesperanzatogotg "GET /login/?login_only=1&user=fundacionesperanzatogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fundacionesperanzatogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.190.21.114
country_id: 3996063
description:
[2026-06-18 07:21:20 +0000] info [cpaneld] 187.190.21.114 - funda "GET /login/?login_only=1&user=funda&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user funda (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.6.74.109
country_id: 6254930
description:
[2026-06-18 07:21:22 +0000] info [cpaneld] 213.6.74.109 - fund "GET /login/?login_only=1&user=fund&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fund (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.190.28.113
country_id: 3996063
description:
[2026-06-18 07:21:25 +0000] info [cpaneld] 187.190.28.113 - fun "GET /login/?login_only=1&user=fun&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fun (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.232.95.29
country_id: 3895114
description:
[2026-06-18 07:21:31 +0000] info [cpaneld] 45.232.95.29 - fu "GET /login/?login_only=1&user=fu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fu (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:07:23:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7444325&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781767413 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.139.41.76
country_id: 2300660
description:
2026-06-18 07:26:36 dovecot_login authenticator failed for H=(41.139.41.76) [41.139.41.76]:55147: 535 Incorrect authentication data (set_id=adegunle.bikounle@togosem.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.234.161.16
country_id: 1562822
description:
[2026-06-18 07:27:52 +0000] info [cpaneld] 171.234.161.16 - tilitulabtg "GET /login/?login_only=1&user=tilitulabtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tilitulabtg (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.154.64.136
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/84837c HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.65.102.2
country_id: 102358
description:
[2026-06-18 07:28:04 +0000] info [cpaneld] 64.65.102.2 - tilitu "GET /login/?login_only=1&user=tilitu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tilitu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.245.227.94
country_id: 3996063
description:
[2026-06-18 07:28:12 +0000] info [cpaneld] 177.245.227.94 - til "GET /login/?login_only=1&user=til&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user til (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 36.252.241.176
country_id: 1282988
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/07/image-9.png 945w, http:/togodailynews.tg/wp-content/uploads/2024/07/image-9-300x225.png 300w, http:/togodailynews.tg/wp-content/uploads/2024/07/image-9-768x576.png 768w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.0.168.242
country_id: 3686110
description:
[2026-06-18 07:28:08 +0000] info [cpaneld] 167.0.168.242 - tili "GET /login/?login_only=1&user=tili&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tili (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.99.252.75
country_id: 3686110
description:
[2026-06-18 07:27:54 +0000] info [cpaneld] 190.99.252.75 - tilitula "GET /login/?login_only=1&user=tilitula&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tilitula (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.167.124.148
country_id: 3686110
description:
[2026-06-18 07:28:15 +0000] info [cpaneld] 45.167.124.148 - ti "GET /login/?login_only=1&user=ti&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ti (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:07:28:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10143134&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781767693 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 112.201.135.195
country_id: 1694008
description:
[2026-06-18 07:28:29 +0000] info [cpaneld] 112.201.135.195 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.253.166.27
country_id: 3686110
description:
[2026-06-18 07:28:32 +0000] info [cpaneld] 190.253.166.27 - ameak "GET /login/?login_only=1&user=ameak&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ameak (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.36.148.99
country_id: 3865483
description:
[2026-06-18 07:28:39 +0000] info [cpaneld] 179.36.148.99 - amea "GET /login/?login_only=1&user=amea&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user amea (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 216.173.80.166
country_id: 6251999
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:216.173.80.166||TA:216.173.80.166||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.103.31.125
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/6a6a67 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.241.46.134
country_id: 3895114
description:
[2026-06-18 07:31:46 +0000] info [cpaneld] 201.241.46.134 - bawason "GET /login/?login_only=1&user=bawason&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bawason (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.145.118.28
country_id: 1210997
description:
[2026-06-18 07:31:58 +0000] info [cpaneld] 103.145.118.28 - bawa "GET /login/?login_only=1&user=bawa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bawa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.107.142.88
country_id: 290557
description:
[2026-06-18 07:32:03 +0000] info [cpaneld] 5.107.142.88 - baw "GET /login/?login_only=1&user=baw&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user baw (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.51.32.56
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/1537474364 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.244.152.192
country_id: 99237
description:
[2026-06-18 07:31:49 +0000] info [cpaneld] 185.244.152.192 - bawaso "GET /login/?login_only=1&user=bawaso&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bawaso (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 93.71.224.160
country_id: 3175395
description:
93.71.224.160 - - [18/Jun/2026:07:32:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053485&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fprison-ferme-requis-contre-koffi-olomide%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781767921 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/prison-ferme-requis-contre-koffi-olomide/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.2098.1692 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:93.71.224.160


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.188.102.180
country_id: 3625428
description:
[2026-06-18 07:31:32 +0000] info [cpaneld] 186.188.102.180 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.179.126.209
country_id: 2017370
description:
[2026-06-18 07:32:07 +0000] info [cpaneld] 95.179.126.209 - ba "GET /login/?login_only=1&user=ba&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ba (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-18 07:32:22 +0000] info [webmaild] 196.171.46.177 - gilbert.kakabiti@togointerim.net "GET /cpsess8742115690/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.214.117.107
country_id: 953987
description:
[2026-06-18 07:31:35 +0000] info [cpaneld] 102.214.117.107 - bawasongroup "GET /login/?login_only=1&user=bawasongroup&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bawasongroup (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.139.186.229
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/1557927673 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.203.236.85
country_id: 3996063
description:
[2026-06-18 07:35:14 +0000] info [cpaneld] 189.203.236.85 - smar "GET /login/?login_only=1&user=smar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user smar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.25.15.124
country_id: 2017370
description:
[2026-06-18 07:35:17 +0000] info [cpaneld] 95.25.15.124 - sma "GET /login/?login_only=1&user=sma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sma (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.88.51.68
country_id: 1522867
description:
[2026-06-18 07:35:11 +0000] info [cpaneld] 178.88.51.68 - smart "GET /login/?login_only=1&user=smart&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user smart (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.38.171.42
country_id: 3865483
description:
[2026-06-18 07:35:22 +0000] info [cpaneld] 179.38.171.42 - sm "GET /login/?login_only=1&user=sm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sm (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:07:38:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13265304&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781768332 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.118.212.117
country_id: 3865483
description:
[2026-06-18 07:40:22 +0000] info [cpaneld] 181.118.212.117 - togointe "GET /login/?login_only=1&user=togointe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.77.202.210
country_id: 2542007
description:
[2026-06-18 07:39:42 +0000] info [cpaneld] 105.77.202.210 - zontal "GET /login/?login_only=1&user=zontal&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zontal (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 1.55.15.213
country_id: 1562822
description:
[2026-06-18 07:39:54 +0000] info [cpaneld] 1.55.15.213 - zon "GET /login/?login_only=1&user=zon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zon (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.35.164.125
country_id: 2017370
description:
[2026-06-18 07:40:14 +0000] info [cpaneld] 212.35.164.125 - togointerim "GET /login/?login_only=1&user=togointerim&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointerim (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.217.106.116
country_id: 3996063
description:
[2026-06-18 07:39:35 +0000] info [cpaneld] 189.217.106.116 - zontalomemilleniumtg "GET /login/?login_only=1&user=zontalomemilleniumtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zontalomemilleniumtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 223.24.140.55
country_id: 1605651
description:
[2026-06-18 07:39:46 +0000] info [cpaneld] 223.24.140.55 - zonta "GET /login/?login_only=1&user=zonta&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zonta (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.231.255.131
country_id: 3624060
description:
[2026-06-18 07:39:59 +0000] info [cpaneld] 152.231.255.131 - zo "GET /login/?login_only=1&user=zo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.4.238.252
country_id: 2510769
description:
[2026-06-18 07:40:12 +0000] info [cpaneld] 31.4.238.252 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.60.92.63
country_id: 6254930
description:
[2026-06-18 07:40:18 +0000] info [cpaneld] 46.60.92.63 - togointerimnet "GET /login/?login_only=1&user=togointerimnet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointerimnet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.56.193.77
country_id: 99237
description:
[2026-06-18 07:40:44 +0000] info [cpaneld] 185.56.193.77 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.140.204.21
country_id: 1210997
description:
[2026-06-18 07:40:39 +0000] info [cpaneld] 103.140.204.21 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.151.32
country_id: 2363686
description:
[2026-06-18 07:41:45 +0000] info [webmaild] 196.170.151.32 - ingersarlu@inger.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.131.228.223
country_id: 3469034
description:
[2026-06-18 07:43:12 +0000] info [cpaneld] 201.131.228.223 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.248.227.127
country_id: 3686110
description:
[2026-06-18 07:43:16 +0000] info [cpaneld] 190.248.227.127 - ekinamag "GET /login/?login_only=1&user=ekinamag&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekinamag (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.176.112.44
country_id: 690791
description:
[2026-06-18 07:43:31 +0000] info [cpaneld] 185.176.112.44 - ekin "GET /login/?login_only=1&user=ekin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ekin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 125.27.36.59
country_id: 1605651
description:
[2026-06-18 07:43:37 +0000] info [cpaneld] 125.27.36.59 - ek "GET /login/?login_only=1&user=ek&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ek (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 69.165.67.134
country_id: 1819730
domain: mail.sodigaz.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:07-43.69.165.67.134||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.25.58.91
country_id: 3932488
description:
[2026-06-18 07:44:19 +0000] info [cpaneld] 38.25.58.91 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.117.236.4
country_id: 2542007
description:
[2026-06-18 07:43:33 +0000] info [cpaneld] 196.117.236.4 - eki "GET /login/?login_only=1&user=eki&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eki (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.211.214.112
country_id: 1733045
description:
[2026-06-18 07:44:23 +0000] info [cpaneld] 113.211.214.112 - wellcity "GET /login/?login_only=1&user=wellcity&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wellcity (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.158.51
country_id: 1819730
description:
[2026-06-18 07:45:16 +0000] info [whostmgrd] 104.28.158.51 - rolle "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.163.154.139
country_id: 1562822
description:
[2026-06-18 07:44:34 +0000] info [cpaneld] 14.163.154.139 - wellci "GET /login/?login_only=1&user=wellci&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wellci (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.222.63.229
country_id: 3923057
description:
[2026-06-18 07:44:47 +0000] info [cpaneld] 177.222.63.229 - wel "GET /login/?login_only=1&user=wel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wel (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 70.50.153.116
country_id: 6251999
description:
70.50.153.116 - - [18/Jun/2026:07:45:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6722928&pdata=https%253A%252F%252Fcpanel.ns1.netmaster.tg%252F%253Flocale%253Dde&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781768701 HTTP/2.0" 302 0 cpanel.ns1.netmaster.tg "https://cpanel.ns1.netmaster.tg/?locale=de" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:70.50.153.116


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:07:44:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934952&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781768676 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 69.165.67.134
country_id: 1819730
domain: mail.sodigaz.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:07-44.69.165.67.134||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 104.28.158.51
country_id: 1819730
description:
Jun 18 07:45:18 ns5 pure-ftpd[2687032]: (?@104.28.158.51) [WARNING] Authentication failed for user [rolle]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.159.51.233
country_id: 3625428
description:
[2026-06-18 07:45:21 +0000] info [cpaneld] 38.159.51.233 - its "GET /login/?login_only=1&user=its&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user its (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.146.112.62
country_id: 587116
description:
[2026-06-18 07:44:29 +0000] info [cpaneld] 185.146.112.62 - wellcit "GET /login/?login_only=1&user=wellcit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wellcit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.45.25
country_id: 1733045
description:
[2026-06-18 07:45:28 +0000] info [cpaneld] 180.75.45.25 - it "GET /login/?login_only=1&user=it&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user it (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 90.204.247.11
country_id: 2635167
description:
[2026-06-18 07:47:13 +0000] info [cpaneld] 90.204.247.11 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.12.184.89
country_id: 3437598
description:
[2026-06-18 07:47:19 +0000] info [cpaneld] 186.12.184.89 - its "GET /login/?login_only=1&user=its&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user its (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.245.143.214
country_id: 1210997
description:
[2026-06-18 07:47:28 +0000] info [cpaneld] 43.245.143.214 - it "GET /login/?login_only=1&user=it&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user it (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.17.88
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/03/Cooperation-Togo-USA-un-Representant-de-la-Maison-Blanche-recu-par-le-President-du-Conseil.webp 800w, http:/togodailynews.tg/wp-content/uploads/2026/03/Cooperation-Togo-USA-un-Representant-de-la-Maison-Blanche-recu-par-le-President-du-Conseil-300x207.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/03/Cooperation-Togo-USA-un-Representant-de-la-Maison-Blanche-recu-par-le-President-du-Conseil-768x531.webp 768w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.6.174
country_id: 690791
description:
Jun 18 07:49:46 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.6.174 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.162.161.68
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/12/Solidarite-CHU-SO.png 744w, http:/togodailynews.tg/wp-content/uploads/2023/12/Solidarite-CHU-SO-300x159.png 300w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 41.207.188.29
country_id: 2363686
description:
41.207.188.29 - - [18/Jun/2026:07:52:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7181928&pdata=https%253A%252F%252Fdagl.tg%252Fcommunes%252F5-commune-du-golfe-2&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781769138 HTTP/2.0" 302 0 dagl.tg "https://dagl.tg/communes/5-commune-du-golfe-2" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:41.207.188.29


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.191.11.138
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1192697902 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.166.94.181
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/681000734 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.14
country_id: 6252001
description:
205.169.39.14 - - [18/Jun/2026:07:52:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054511&pdata=http%253A%252F%252Fbelali.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781769143 HTTP/1.1" 302 0 belali.tg "http://belali.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.14


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 64.49.38.48
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:07-52.64.49.38.48||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [18/Jun/2026:07:54:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738132&pdata=http%253A%252F%252Fwww.sodigaz.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781769278 HTTP/1.1" 302 0 www.sodigaz.tg "http://www.sodigaz.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:07:54:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723478&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781769290 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.229.114.137
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/785f55 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:08:00:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6525847&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781769607 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 116.30.11.38
country_id: 1814991
description:
116.30.11.38 - - [18/Jun/2026:08:02:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7041381&pdata=https%253A%252F%252Flct-togo.tg%252Fpost-sitemap.xml&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781769739 HTTP/2.0" 302 0 lct-togo.tg "https://lct-togo.tg/post-sitemap.xml" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.1 Safari/605.1.15" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:116.30.11.38


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.69.59.181
country_id: 1210997
description:
[2026-06-18 08:03:02 +0000] info [cpaneld] 103.69.59.181 - zeph "GET /login/?login_only=1&user=zeph&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zeph (has_cpuser_file failed)


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.174.173.123
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:renforcement-du-systeme-educatif-le-gouvernement-recrute-4501-enseignants/||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.113.205.20
country_id: 6252001
description:
[2026-06-18 08:02:48 +0000] info [cpaneld] 172.113.205.20 - zephyr "GET /login/?login_only=1&user=zephyr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zephyr (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 41.207.188.29
country_id: 2363686
description:
41.207.188.29 - - [18/Jun/2026:08:06:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001351&pdata=https%253A%252F%252Fwww.arse.tg%252Fwp-content%252Fuploads%252F2021%252F10%252FRapport-activites-ARSE-2018-VF-003.pdf&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781769972 HTTP/2.0" 302 0 www.arse.tg "https://www.arse.tg/wp-content/uploads/2021/10/Rapport-activites-ARSE-2018-VF-003.pdf" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:41.207.188.29


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 116.162.196.145
country_id: 1814991
description:
Jun 18 08:05:40 ns5 pure-ftpd[2700076]: (?@116.162.196.145) [INFO] New connection from 116.162.196.145


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.254.103.48
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/04/66\xe1\xb5\x89-anniversaire-de-lindependance-du-Togo-le-President-du-Conseil-ravive-la-flamme-nationale.webp 800w, http:/togodailynews.tg/wp-content/uploads/2026/04/66\xe1\xb5\x89-anniversaire-de-lindependance-du-Togo-le-President-du-Conseil-ravive-la-flamme-nationale-300x288.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/04/66\xe1\xb5\x89-anniversaire-de-lindependance-du-Togo-le-President-du-Conseil-ravive-la-flamme-nationale-768x738.webp 768w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:08:07:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7236760&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781770057 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.12
country_id: 1880251
description:
47.128.96.12 - - [18/Jun/2026:08:08:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9936231&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-legalisation-documents-bac-2-supprimee%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781770122 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-legalisation-documents-bac-2-supprimee/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.12


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 175.100.52.35
country_id: 1831722
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/04/Copilot_20260422_164208.webp 1536w, http:/togodailynews.tg/wp-content/uploads/2026/04/Copilot_20260422_164208-300x200.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/04/Copilot_20260422_164208-1024x683.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/04/Copilot_20260422_164208-768x512.webp 768w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.70.81.34
country_id: 2363686
description:
[2026-06-18 08:10:02 +0000] info [cpaneld] 154.70.81.34 - jmtctoni "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 154.70.81.34
country_id: 2363686
description:
[2026-06-18 08:10:05 +0000] info [cpaneld] 154.70.81.34 NEW jmtctoni:ato98Y2JMzzaZxsq address=154.70.81.34,app=cpaneld,creator=jmtctoni,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.123.7.75
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/2125582847 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:08:12:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7103853&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781770369 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: modsec
rule: 77488182
name: IM360 WAF: Track WP role promotion to administrator (UI)
abuser: 102.64.221.67
country_id: 2363686
domain: zephyr.tg
description:
IM360 WAF: Track WP role promotion to administrator (UI)||WPU:otiya||Target:19||RSV:8.18||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 151.237.177.92
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:151.237.177.92||TA:151.237.177.92||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.202
country_id: 1880251
description:
47.128.96.202 - - [18/Jun/2026:08:20:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9816426&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffc-barca%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781770810 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/fc-barca/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.202


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.182
country_id: 1880251
description:
47.128.96.182 - - [18/Jun/2026:08:20:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10197657&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Felimination-des-eperviers-du-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781770817 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/elimination-des-eperviers-du-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.182


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.198.159
country_id: 99237
description:
2026-06-18 08:20:31 dovecot_login authenticator failed for H=([50.77.90.194]) [65.20.198.159]:50827: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.142
country_id: 1880251
description:
47.128.96.142 - - [18/Jun/2026:08:20:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10261607&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Felimination-des-eperviers-du-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781770833 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/elimination-des-eperviers-du-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.142


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.39.138.197
country_id: 102358
description:
[2026-06-18 08:23:11 +0000] info [cpaneld] 51.39.138.197 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.174.68.247
country_id: 1282988
description:
[2026-06-18 08:23:18 +0000] info [cpaneld] 103.174.68.247 - alloacio "GET /login/?login_only=1&user=alloacio&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user alloacio (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 119.10.180.42
country_id: 1643084
description:
[2026-06-18 08:23:24 +0000] info [cpaneld] 119.10.180.42 - alloaciotg "GET /login/?login_only=1&user=alloaciotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user alloaciotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.190.28.237
country_id: 298795
description:
[2026-06-18 08:23:39 +0000] info [cpaneld] 78.190.28.237 - allo "GET /login/?login_only=1&user=allo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user allo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.8.56.104
country_id: 3469034
description:
[2026-06-18 08:23:49 +0000] info [cpaneld] 201.8.56.104 - al "GET /login/?login_only=1&user=al&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user al (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:08:23:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10078871&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781771034 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.214.116.87
country_id: 6252001
description:
[2026-06-18 08:23:36 +0000] info [cpaneld] 66.214.116.87 - alloa "GET /login/?login_only=1&user=alloa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user alloa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.171.208.237
country_id: 1562822
description:
[2026-06-18 08:23:44 +0000] info [cpaneld] 14.171.208.237 - all "GET /login/?login_only=1&user=all&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user all (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.206.123.244
country_id: 2287781
description:
[2026-06-18 08:24:23 +0000] info [cpaneld] 102.206.123.244 - istm "GET /login/?login_only=1&user=istm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user istm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.134.95
country_id: 3865483
description:
[2026-06-18 08:24:37 +0000] info [cpaneld] 98.97.134.95 - is "GET /login/?login_only=1&user=is&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user is (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.245.195.182
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:172.245.195.182||TA:172.245.195.182||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.76.51.103
country_id: 1562822
description:
[2026-06-18 08:24:30 +0000] info [cpaneld] 115.76.51.103 - istmtg "GET /login/?login_only=1&user=istmtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user istmtg (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 3.22.234.39
country_id: 6252001
description:
[2026-06-18 08:25:50 +0000] info [whostmgrd] 3.22.234.39 - root "GET /json-api/listaccts?api.version=1 HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 3.22.234.39
country_id: 6252001
description:
[2026-06-18 08:25:46 +0000] info [whostmgrd] 3.22.234.39 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.6.206.13
country_id: 1820814
description:
Jun 18 08:26:42 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.6.206.13 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 148.135.144.212
country_id: 6252001
domain: www.togosem.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:148.135.144.212||TA:148.135.144.212||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 173.239.219.244
country_id: 6252001
domain: www.togosem.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:173.239.219.244||TA:173.239.219.244||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.68.185.73
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/HTML/BODY/DIV[@id='page']/*[1][self::DIV]/*[14][self::SECTION]/*[2][self::DIV]/*[1][self::DIV]/*[1][self::DIV]/*[7][self::DIV]/*[1][self::ARTICLE]/*[1][self::DIV]/*[1][self::A]/*[1][self::IMG] HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.233.73.239
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/05/WhatsApp-Image-2026-05-13-at-22.27.26-1.webp 1600w, http:/togodailynews.tg/wp-content/uploads/2026/05/WhatsApp-Image-2026-05-13-at-22.27.26-1-300x225.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/05/WhatsApp-Image-2026-05-13-at-22.27.26-1-1024x768.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/05/WhatsApp-Image-2026-05-13-at-22.27.26-1-768x576.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/05/WhatsApp-Image-2026-05-13-at-22.27.26-1-1536x1152.webp 1536w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 38.154.205.120
country_id: 6252001
domain: www.togosem.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:38.154.205.120||TA:38.154.205.120||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:08:28:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9740188&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781771312 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.244.227.150
country_id: 3489940
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/HTML/BODY/DIV[@id='page']/*[1][self::DIV]/*[13][self::MAIN]/*[1][self::SECTION]/*[1][self::DIV]/*[1][self::DIV]/*[2][self::DIV]/*[1][self::ARTICLE]/*[1][self::DIV]/*[1][self::A]/*[1][self::IMG] HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.42.151.159
country_id: 2017370
description:
[2026-06-18 08:30:59 +0000] info [whostmgrd] 46.42.151.159 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.107.230.156
country_id: 290557
description:
[2026-06-18 08:33:14 +0000] info [cpaneld] 5.107.230.156 - bawasongroup "GET /login/?login_only=1&user=bawasongroup&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bawasongroup (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.59.193.53
country_id: 3865483
description:
[2026-06-18 08:32:44 +0000] info [cpaneld] 200.59.193.53 - droitshumains "GET /login/?login_only=1&user=droitshumains&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user droitshumains (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.136.148.206
country_id: 99237
description:
[2026-06-18 08:32:46 +0000] info [cpaneld] 185.136.148.206 - droitshumainstg "GET /login/?login_only=1&user=droitshumainstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user droitshumainstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 131.72.84.103
country_id: 3469034
description:
[2026-06-18 08:32:56 +0000] info [cpaneld] 131.72.84.103 - droitsh "GET /login/?login_only=1&user=droitsh&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user droitsh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.13.195.114
country_id: 1733045
description:
[2026-06-18 08:33:13 +0000] info [cpaneld] 124.13.195.114 - dr "GET /login/?login_only=1&user=dr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.169.214.18
country_id: 3469034
description:
[2026-06-18 08:33:20 +0000] info [cpaneld] 45.169.214.18 - bawasong "GET /login/?login_only=1&user=bawasong&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bawasong (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.162.211.250
country_id: 3895114
description:
[2026-06-18 08:33:06 +0000] info [cpaneld] 45.162.211.250 - droi "GET /login/?login_only=1&user=droi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user droi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.68.16.186
country_id: 2017370
description:
[2026-06-18 08:33:18 +0000] info [cpaneld] 188.68.16.186 - bawasongroupcom "GET /login/?login_only=1&user=bawasongroupcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bawasongroupcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.169.218.51
country_id: 3865483
description:
[2026-06-18 08:33:09 +0000] info [cpaneld] 181.169.218.51 - dro "GET /login/?login_only=1&user=dro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dro (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.107.30.166
country_id: 290557
description:
[2026-06-18 08:33:10 +0000] info [cpaneld] 5.107.30.166 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.78.238.141
country_id: 690791
description:
[2026-06-18 08:32:41 +0000] info [cpaneld] 185.78.238.141 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.138.71.122
country_id: 2017370
description:
[2026-06-18 08:33:02 +0000] info [cpaneld] 5.138.71.122 - droit "GET /login/?login_only=1&user=droit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user droit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.237.233.132
country_id: 2464461
description:
[2026-06-18 08:33:29 +0000] info [cpaneld] 196.237.233.132 - bawaso "GET /login/?login_only=1&user=bawaso&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bawaso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.88.222.17
country_id: 1522867
description:
[2026-06-18 08:33:33 +0000] info [cpaneld] 178.88.222.17 - bawas "GET /login/?login_only=1&user=bawas&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bawas (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.199.226.178
country_id: 1282988
description:
[2026-06-18 08:33:42 +0000] info [cpaneld] 113.199.226.178 - baw "GET /login/?login_only=1&user=baw&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user baw (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.202
country_id: 3469034
description:
Jun 18 08:34:23 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.35.93
country_id: 953987
description:
Jun 18 08:34:53 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.35.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.91
country_id: 1269750
description:
Jun 18 08:35:33 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.91 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.1.27.162
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/05/Elaboration-de-la-feuille-de-route-gouvernementale-2026-2031-consultation-des-parties-prenantes-au-developpement-300x183.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/05/Elaboration-de-la-feuille-de-route-gouvernementale-2026-2031-consultation-des-parties-prenantes-au-developpement-768x468.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/05/Elaboration-de-la-feuille-de-route-gouvernementale-2026-2031-consultation-des-parties-prenantes-au-developpement.webp 800w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 89.43.132.40
country_id: 719819
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/HTML/BODY/DIV[@id='page']/*[1][self::DIV]/*[9][self::SECTION]/*[1][self::DIV]/*[1][self::DIV]/*[1][self::DIV]/*[1][self::DIV]/*[1][self::ARTICLE]/*[1][self::DIV]/*[2][self::A]/*[1][self::IMG] HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.209.37.229
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/HTML/BODY/DIV[@id='page']/*[1][self::DIV]/*[11][self::SECTION]/*[1][self::DIV]/*[1][self::DIV]/*[2][self::DIV]/*[1][self::DIV]/*[1][self::DIV]/*[1][self::DIV]/*[2][self::DIV]/*[2][self::DIV]/*[2][self::DIV]/*[1][self::ARTICLE]/*[1][self::DIV]/*[1][self::A]/*[1][self::IMG] HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.235.138.166
country_id: 2589581
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/HTML/BODY/DIV[@id='page']/*[1][self::DIV]/*[14][self::SECTION]/*[2][self::DIV]/*[1][self::DIV]/*[1][self::DIV]/*[3][self::DIV]/*[1][self::ARTICLE]/*[1][self::DIV]/*[1][self::A]/*[1][self::IMG] HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 154.70.80.74
country_id: 2363686
description:
[2026-06-18 08:38:53 +0000] info [webmaild] 154.70.80.74 - cloudetracks "GET /cpsess2046296561/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.171.7.207
country_id: 2363686
description:
2026-06-18 08:38:49 dovecot_login authenticator failed for H=(SHESAME) [196.171.7.207]:55771: 535 Incorrect authentication data (set_id=cndhtogo@cndh-togo.org)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:08:39:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6515102&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781771944 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.237.37.164
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/HTML/BODY/DIV[@id='page']/*[1][self::DIV]/*[11][self::SECTION]/*[1][self::DIV]/*[1][self::DIV]/*[2][self::DIV]/*[1][self::DIV]/*[1][self::DIV]/*[1][self::DIV]/*[3][self::DIV]/*[2][self::DIV]/*[1][self::DIV]/*[1][self::ARTICLE]/*[1][self::DIV]/*[1][self::A]/*[1][self::IMG] HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - info@cloud-et-racks.tg [06/18/2026:08:40:52 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: info@cloud-et-racks.tg


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 198.163.195.13
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/04/kev-1024x497-1-300x146.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/04/kev-1024x497-1-768x373.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/04/kev-1024x497-1.webp 1024w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.164.64.84
country_id: 3658394
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/05/five-afdb-reg-members-1500.webp 1300w, http:/togodailynews.tg/wp-content/uploads/2023/05/five-afdb-reg-members-1500-300x123.webp 300w, http:/togodailynews.tg/wp-content/uploads/2023/05/five-afdb-reg-members-1500-1024x421.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2023/05/five-afdb-reg-members-1500-768x316.webp 768w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - sandrine.a@cloud-et-racks.tg [06/18/2026:08:43:17 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: sandrine.a@cloud-et-racks.tg


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.174.241.237
country_id: 3865483
description:
[2026-06-18 08:42:49 +0000] info [cpaneld] 190.174.241.237 - chuso "GET /login/?login_only=1&user=chuso&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user chuso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 204.137.189.171
country_id: 3508796
description:
[2026-06-18 08:42:52 +0000] info [cpaneld] 204.137.189.171 - chusotg "GET /login/?login_only=1&user=chusotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user chusotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.75.45.220
country_id: 2542007
description:
[2026-06-18 08:42:54 +0000] info [cpaneld] 196.75.45.220 - chus "GET /login/?login_only=1&user=chus&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user chus (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.239.135.8
country_id: 690791
description:
[2026-06-18 08:42:57 +0000] info [cpaneld] 185.239.135.8 - chu "GET /login/?login_only=1&user=chu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user chu (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.37.47.128
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/HTML/BODY/DIV[@id='page']/*[1][self::DIV]/*[13][self::MAIN]/*[1][self::SECTION]/*[1][self::DIV]/*[1][self::DIV]/*[1][self::DIV]/*[1][self::ARTICLE]/*[1][self::DIV]/*[1][self::A]/*[1][self::IMG] HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.6.26.227
country_id: 3932488
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/837d65 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 1.178.119.107
country_id: 6254930
description:
[2026-06-18 08:44:23 +0000] info [cpaneld] 1.178.119.107 - benatex "GET /login/?login_only=1&user=benatex&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user benatex (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:08:44:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6909031&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781772270 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.153.70.173
country_id: 102358
description:
[2026-06-18 08:44:32 +0000] info [cpaneld] 46.153.70.173 - benat "GET /login/?login_only=1&user=benat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user benat (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 148.227.91.110
country_id: 3469034
description:
[2026-06-18 08:44:41 +0000] info [cpaneld] 148.227.91.110 - ben "GET /login/?login_only=1&user=ben&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ben (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.233.41.254
country_id: 2017370
description:
[2026-06-18 08:44:26 +0000] info [cpaneld] 91.233.41.254 - benatextg "GET /login/?login_only=1&user=benatextg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user benatextg (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-18 08:48:43 +0000] info [webmaild] 102.176.253.226 - dgi@ucao-uut.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.94.149.58
country_id: 3895114
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-25-at-08.09.33-300x217.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-25-at-08.09.33-1024x739.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-25-at-08.09.33-768x554.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/04/WhatsApp-Image-2026-04-25-at-08.09.33.webp 1280w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.151.32
country_id: 2363686
description:
[2026-06-18 08:49:41 +0000] info [webmaild] 196.170.151.32 - wiyao.g@inger.tg "GET /cpsess6054090833/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.170.66.202] != Current IP Address [196.170.151.32]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.92.29.41
country_id: 163843
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/05/WhatsApp-Image-2026-05-13-at-22.27.26.webp 1600w, http:/togodailynews.tg/wp-content/uploads/2026/05/WhatsApp-Image-2026-05-13-at-22.27.26-300x225.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/05/WhatsApp-Image-2026-05-13-at-22.27.26-1024x768.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/05/WhatsApp-Image-2026-05-13-at-22.27.26-768x576.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/05/WhatsApp-Image-2026-05-13-at-22.27.26-1536x1152.webp 1536w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.10.127
country_id: 2300660
description:
Jun 18 08:52:05 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.10.127 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-18 08:52:04 +0000] info [cpaneld] 102.54.238.57 - arsetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.206.113.185
country_id: 6290252
description:
Jun 18 08:53:02 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.206.113.185 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.134.58.103
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/HTML/BODY/DIV[@id='page']/*[1][self::DIV]/*[11][self::SECTION]/*[1][self::DIV]/*[1][self::DIV]/*[2][self::DIV]/*[1][self::DIV]/*[1][self::DIV]/*[1][self::DIV]/*[2][self::DIV]/*[2][self::DIV]/*[1][self::DIV]/*[1][self::ARTICLE]/*[1][self::DIV]/*[1][self::A]/*[1][self::IMG] HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:08:53:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10381724&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781772797 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.77.177.111
country_id: 3469034
description:
Jun 18 08:54:38 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.77.177.111 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.0.5.92
country_id: 192950
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/HTML/BODY/DIV[@id='page']/*[1][self::DIV]/*[10][self::SECTION]/*[1][self::DIV]/*[2][self::DIV]/*[1][self::DIV]/*[1][self::DIV]/*[4][self::DIV]/*[1][self::ARTICLE]/*[1][self::DIV]/*[1][self::A]/*[1][self::IMG] HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.211.114.134
country_id: 1269750
domain: derou.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/derou.tg/fr/nos-projets/Concours HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.162
country_id: 3175395
description:
Jun 18 08:55:39 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.162 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.184.246.187
country_id: 290291
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/Paix-et-stabilite-en-Afrique-le-President-du-Conseil-echange-avec-une-delegation-des-Nations-unies-768x614.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/Paix-et-stabilite-en-Afrique-le-President-du-Conseil-echange-avec-une-delegation-des-Nations-unies-300x240.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/Paix-et-stabilite-en-Afrique-le-President-du-Conseil-echange-avec-une-delegation-des-Nations-unies.webp 800w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:09:00:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9739926&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781773215 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.253.27.219
country_id: 1880251
description:
[2026-06-18 08:59:44 +0000] info [cpaneld] 103.253.27.219 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.102.129.206
country_id: 2635167
description:
2026-06-18 09:00:06 dovecot_login authenticator failed for H=mail.xn--80aaibk1do.org (yliSxjkjfJ) [149.102.129.206]:38016: 535 Incorrect authentication data (set_id=infos@mesyscom.com)


plugin: ossec
rule: 11009
name: WHM login success
abuser: 104.28.154.50
country_id: 2510769
description:
[2026-06-18 09:00:38 +0000] info [whostmgrd] 104.28.154.50 NEW root:Fib_EytJYaAQ9DCO address=104.28.154.50,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.102.129.206
country_id: 2635167
description:
2026-06-18 09:00:45 dovecot_login authenticator failed for H=mail.xn--80aaibk1do.org (Pmbvdbnv) [149.102.129.206]:51558: 535 Incorrect authentication data (set_id=infos@mesyscom.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.174.34.73
country_id: 2017370
description:
[2026-06-18 09:02:18 +0000] info [cpaneld] 79.174.34.73 - ucaouuttg "GET /login/?login_only=1&user=ucaouuttg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucaouuttg (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.173.31.158
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/HTML/BODY/DIV[@id='page']/*[1][self::DIV]/*[14][self::SECTION]/*[2][self::DIV]/*[1][self::DIV]/*[1][self::DIV]/*[4][self::DIV]/*[1][self::ARTICLE]/*[1][self::DIV]/*[1][self::A]/*[1][self::IMG] HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 118.179.3.70
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/HTML/BODY/DIV[@id='page']/*[1][self::DIV]/*[11][self::SECTION]/*[1][self::DIV]/*[1][self::DIV]/*[2][self::DIV]/*[1][self::DIV]/*[1][self::DIV]/*[1][self::DIV]/*[2][self::DIV]/*[2][self::DIV]/*[2][self::DIV]/*[3][self::ARTICLE]/*[1][self::DIV]/*[1][self::A]/*[1][self::IMG] HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.182.190.181
country_id: 953987
description:
[2026-06-18 09:02:16 +0000] info [cpaneld] 102.182.190.181 - ucaouut "GET /login/?login_only=1&user=ucaouut&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.157.124.154
country_id: 2635167
description:
[2026-06-18 09:02:34 +0000] info [cpaneld] 109.157.124.154 - uca "GET /login/?login_only=1&user=uca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user uca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.45.132.237
country_id: 3865483
description:
[2026-06-18 09:02:32 +0000] info [cpaneld] 181.45.132.237 - ucao "GET /login/?login_only=1&user=ucao&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucao (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 144.124.196.33
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/HTML/BODY/DIV[@id='page']/*[1][self::DIV]/*[14][self::SECTION]/*[2][self::DIV]/*[1][self::DIV]/*[1][self::DIV]/*[6][self::DIV]/*[1][self::ARTICLE]/*[1][self::DIV]/*[1][self::A]/*[1][self::IMG] HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.118.62.13
country_id: 3469034
description:
[2026-06-18 09:02:27 +0000] info [cpaneld] 138.118.62.13 - ucaou "GET /login/?login_only=1&user=ucaou&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ucaou (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 46.202.227.125
country_id: 6252001
domain: 24heureinfo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:46.202.227.125||TA:46.202.227.125||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.26.238.109
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/HTML/BODY/DIV[@id='page']/*[1][self::DIV]/*[9][self::SECTION]/*[1][self::DIV]/*[1][self::DIV]/*[1][self::DIV]/*[2][self::DIV]/*[1][self::ARTICLE]/*[1][self::DIV]/*[2][self::A]/*[1][self::IMG] HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 174.140.200.254
country_id: 6252001
domain: dagl.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:174.140.200.254||TA:174.140.200.254||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:09:06:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10392473&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781773595 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.52
country_id: 2635167
description:
[2026-06-18 09:08:09 +0000] info [cpaneld] 5.230.153.52 NEW qfaclpeg:7j5_VGbDTfMTVdUx address=5.230.153.52,app=cpaneld,creator=qfaclpeg,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.112.216.162
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/HTML/BODY/DIV[@id='page']/*[1][self::DIV]/*[9][self::SECTION]/*[1][self::DIV]/*[1][self::DIV]/*[1][self::DIV]/*[4][self::DIV]/*[1][self::ARTICLE]/*[1][self::DIV]/*[2][self::A]/*[1][self::IMG] HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 101.53.251.247
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/HTML/BODY/DIV[@id='page']/*[1][self::DIV]/*[9][self::SECTION]/*[2][self::SECTION]/*[1][self::DIV]/*[1][self::DIV]/*[2][self::DIV]/*[1][self::DIV]/*[4][self::DIV]/*[1][self::ARTICLE]/*[1][self::DIV]/*[1][self::A]/*[1][self::IMG] HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.30.109.176
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/HTML/BODY/DIV[@id='page']/*[1][self::DIV]/*[10][self::SECTION]/*[1][self::DIV]/*[2][self::DIV]/*[1][self::DIV]/*[1][self::DIV]/*[5][self::DIV]/*[1][self::ARTICLE]/*[1][self::DIV]/*[1][self::A]/*[1][self::IMG] HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.179.60.8
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/04/IMG_0013-Avec-accentuation-Bruit-300x240.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/04/IMG_0013-Avec-accentuation-Bruit-1024x819.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/04/IMG_0013-Avec-accentuation-Bruit-768x614.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/04/IMG_0013-Avec-accentuation-Bruit-1536x1229.webp 1536w, http:/togodailynews.tg/wp-content/uploads/2026/04/IMG_0013-Avec-accentuation-Bruit-2048x1638.webp 2048w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.210.229.245
country_id: 99237
domain: derou.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/derou.tg/fr/nos-projets/Service_Developpement HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.148
country_id: 1880251
description:
47.128.96.148 - - [18/Jun/2026:09:14:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13341340&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftogolais-vivants-au-senegal%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781774052 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/togolais-vivants-au-senegal/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.148


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.231.28.148
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/HTML/BODY/DIV[@id='page']/*[1][self::DIV]/*[9][self::SECTION]/*[1][self::DIV]/*[1][self::DIV]/*[1][self::DIV]/*[3][self::DIV]/*[1][self::ARTICLE]/*[1][self::DIV]/*[2][self::A]/*[1][self::IMG] HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.12.190.120
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/HTML/BODY/DIV[@id='page']/*[1][self::DIV]/*[10][self::SECTION]/*[1][self::DIV]/*[2][self::DIV]/*[1][self::DIV]/*[1][self::DIV]/*[3][self::DIV]/*[1][self::ARTICLE]/*[1][self::DIV]/*[1][self::A]/*[1][self::IMG] HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:09:17:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7236805&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781774219 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.143.26.22
country_id: 933860
description:
Jun 18 09:18:28 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.143.26.22 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:09:21:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13003114&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781774495 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.77.179.42
country_id: 3469034
description:
Jun 18 09:22:19 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.77.179.42 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.188.224.169
country_id: 337996
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/HTML/BODY/DIV[@id='page']/*[1][self::DIV]/*[9][self::SECTION]/*[2][self::SECTION]/*[1][self::DIV]/*[1][self::DIV]/*[2][self::DIV]/*[2][self::DIV]/*[6][self::ARTICLE]/*[1][self::DIV]/*[1][self::A]/*[1][self::IMG] HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.162.88.160
country_id: 690791
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/HTML/BODY/DIV[@id='page']/*[1][self::DIV]/*[9][self::SECTION]/*[2][self::SECTION]/*[1][self::DIV]/*[1][self::DIV]/*[2][self::DIV]/*[2][self::DIV]/*[5][self::ARTICLE]/*[1][self::DIV]/*[1][self::A]/*[1][self::IMG] HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 145.255.78.151
country_id: 286963
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/HTML/BODY/DIV[@id='page']/*[1][self::DIV]/*[10][self::SECTION]/*[1][self::DIV]/*[2][self::DIV]/*[1][self::DIV]/*[1][self::DIV]/*[7][self::DIV]/*[1][self::ARTICLE]/*[1][self::DIV]/*[1][self::A]/*[1][self::IMG] HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.77.179.42
country_id: 3469034
description:
Jun 18 09:22:25 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.77.179.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.55.177.213
country_id: 3469034
description:
Jun 18 09:23:50 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.55.177.213 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.68.76.241
country_id: 192950
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/757f7c HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.99.160
country_id: 3865483
description:
Jun 18 09:28:22 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.99.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.99.160
country_id: 3865483
description:
Jun 18 09:28:28 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.99.160 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.168
country_id: 1880251
description:
47.128.96.168 - - [18/Jun/2026:09:29:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9750376&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fdede-rose-creppy-morte%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781774969 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/dede-rose-creppy-morte/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.168


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.162
country_id: 1880251
description:
47.128.96.162 - - [18/Jun/2026:09:29:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6658244&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ftogolais-vivants-au-senegal%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781774976 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/togolais-vivants-au-senegal/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.162


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.131.96.227
country_id: 690791
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/10/Page-4-B-1.jpeg 735w, http:/togodailynews.tg/wp-content/uploads/2022/10/Page-4-B-1-300x163.jpeg 300w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - e.gbevon@davakconsulting.com [06/18/2026:09:31:56 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: e.gbevon@davakconsulting.com


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:09:32:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6525803&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781775122 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.171.122.34
country_id: 2363686
description:
[2026-06-18 09:31:27 +0000] info [cpaneld] 196.171.122.34 NEW mvfxewjz:bKtbTlz2EOaZiv7A address=196.171.122.34,app=cpaneld,creator=mvfxewjz,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.136
country_id: 3469034
description:
Jun 18 09:31:43 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.136 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.187.56.0
country_id: 1210997
description:
[2026-06-18 09:36:06 +0000] info [cpaneld] 160.187.56.0 - wifizoneuser "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wifizoneuser (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 148.135.254.246
country_id: 3017382
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:148.135.254.246||TA:148.135.254.246||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.105.198
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:104.239.105.198||TA:104.239.105.198||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:09:38:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7326367&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781775510 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.149.103
country_id: 2363686
description:
[2026-06-18 09:40:57 +0000] info [webmaild] 196.168.149.103 - odoo2@dagl.tg "POST /cpsess2983208374/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.169.16.242] != Current IP Address [196.168.149.103]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.187.56.0
country_id: 1210997
description:
[2026-06-18 09:41:11 +0000] info [cpaneld] 160.187.56.0 - whmcsadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user whmcsadmin (has_cpuser_file failed)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 114.119.141.2
country_id: 1880251
domain: tdn.tg
description:
IM360 WAF: Bad file extension||RSV:8.18||T:APACHE||MVN:REQUEST_FILENAME||MV:/agribusiness-fondation-sea-sheyi-adebayor-formation-jeunes-conditions/fondationsea.com||User:elmkvzcm||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.187.56.0
country_id: 1210997
description:
[2026-06-18 09:42:37 +0000] info [cpaneld] 160.187.56.0 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 114.237.40.30
country_id: 1814991
domain: sia-togo.tg
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/categories?search=public&per_page=5||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 188.251.39.192
country_id: 2264397
domain: sia-togo.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:Turbolte.sia-togo.tg||ServerName:sia-togo.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5749eaf81b00cabee5fa95b0a86953c48969e420||Title:Coronavirus disease 2019||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 94.41.140.82
country_id: 2017370
domain: sia-togo.tg
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/posts||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 223.150.63.196
country_id: 1814991
domain: sia-togo.tg
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/132.0.0.0||MV:/wp-json/wp/v2/posts||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 139.47.23.58
country_id: 2510769
domain: sia-togo.tg
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/posts||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.55.60
country_id: 1880251
domain: chuso.tg
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.0.0 Safari/537.36||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 105.109.120.170
country_id: 2589581
domain: sia-togo.tg
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/posts||RSV:8.18||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.73.206
country_id: 3865483
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:104.239.73.206||TA:104.239.73.206||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.0.19.242
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-25-at-09.54.36-1-1024x740.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-25-at-09.54.36-1-300x217.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-25-at-09.54.36-1-768x555.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-25-at-09.54.36-1-510x369.jpeg 510w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-25-at-09.54.36-1.jpeg 1417w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:09:45:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6646683&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781775926 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.201
country_id: 1880251
description:
47.128.96.201 - - [18/Jun/2026:09:46:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9803887&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Femmanuel-adebayor-et-santrinos-raphael%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781775964 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/emmanuel-adebayor-et-santrinos-raphael/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.201


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.136.224.173
country_id: 3996063
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/event/kick-off-meeting-2021 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.0.186.139
country_id: 3865483
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/album/lancement-officiel-djama-lager HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 38.154.203.183
country_id: 6252001
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:38.154.203.183||TA:38.154.203.183||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.202
country_id: 1880251
description:
47.128.96.202 - - [18/Jun/2026:09:47:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10118253&pdata=https%253A%252F%252Ftdn.tg%252Ftogoexplosion-port-lome%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781776023 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togoexplosion-port-lome/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.202


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 173.191.65.97
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/wp-content/uploads/2023/10/Arr.-Resultats-Lyc\xc3\xa9e-Scientifique.pdf HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.197.86.8
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/cfa382 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:09:52:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10339945&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781776375 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.10.91
country_id: 3469034
description:
Jun 18 09:54:07 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.10.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.175
country_id: 3469034
description:
Jun 18 09:54:29 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.187.56.0
country_id: 1210997
description:
[2026-06-18 09:54:51 +0000] info [cpaneld] 160.187.56.0 - einguval "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user einguval (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.187.56.0
country_id: 1210997
description:
[2026-06-18 09:57:04 +0000] info [cpaneld] 160.187.56.0 - websitecpanel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.187.56.0
country_id: 1210997
description:
[2026-06-18 09:57:31 +0000] info [cpaneld] 160.187.56.0 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-18 09:59:48 +0000] info [webmaild] 196.171.46.177 - kekeli.alemawo@togointerim.net "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:10:02:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13147083&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781776930 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.96.52.79
country_id: 6252001
domain: misstogo.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/149.0.0.0 Safari/537.36||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.152.39.28
country_id: 2635167
description:
185.152.39.28 - - [18/Jun/2026:10:02:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923275&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%25255C%253Dy3j1zguub3blcmf0aw9uc0byawwuy29t&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781776959 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker%5C=y3j1zguub3blcmf0aw9uc0byawwuy29t" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.152.39.28


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.181.102.226
country_id: 1269750
domain: lasnb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:93167.lasnb.com||ServerName:lasnb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5ab377b05ddb06a9aae6e619396a0b42194b3314||Title:0x5552069f||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.19.151
country_id: 2363686
description:
[2026-06-18 10:04:19 +0000] info [webmaild] 196.171.19.151 - cat@ca-togo.org "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.181.102.226
country_id: 1269750
domain: lasnb.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:87516.lasnb.tg||ServerName:lasnb.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:827a6309394d83a825b24789b6e610b65e41b1c9||Title:0x69b4add9||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 85.203.46.191
country_id: 2635167
description:
85.203.46.191 - - [18/Jun/2026:10:04:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6658974&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DY3J1ZGUub3BlcmF0aW9uc0ByaWwuY29t&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781777093 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=Y3J1ZGUub3BlcmF0aW9uc0ByaWwuY29t" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:85.203.46.191


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.234.229.4
country_id: 3658394
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1143306905 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 158.41.147.81
country_id: 6252001
domain: sia-togo.tg
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/categories?search=public&per_page=5||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.19.151
country_id: 2363686
description:
[2026-06-18 10:05:47 +0000] info [webmaild] 196.171.19.151 - cat@ca-togo.org "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:10:06:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13211754&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781777158 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.171.19.151
country_id: 2363686
description:
[2026-06-18 10:05:29 +0000] info [webmaild] 196.171.19.151 - catsecretariat@ca-togo.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 46.158.158.35
country_id: 2017370
domain: sia-togo.tg
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Macintosh; Intel Mac OS X 15_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15||MV:/wp-json/wp/v2/posts||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 113.242.117.228
country_id: 1814991
domain: sia-togo.tg
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Linux; Android 14; SM-A546B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6834.163 Mobile Safari/537.36 SamsungBrowser/26.0||MV:/wp-json/wp/v2/posts||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 68.224.161.54
country_id: 6252001
domain: sia-togo.tg
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Linux; Android 13; Infinix X6816D) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.86 Mobile Safari/537.36||MV:/wp-json/wp/v2/posts||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.18.80
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/878386 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.194.218.134
country_id: 3017382
description:
[2026-06-18 10:09:00 +0000] info [cpaneld] 185.194.218.134 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 86.127.226.172
country_id: 2510769
description:
86.127.226.172 - - [18/Jun/2026:10:09:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9936026&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DY2Zlcm5hbmRlekBhbS1scy5lcw%253D%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781777349 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=Y2Zlcm5hbmRlekBhbS1scy5lcw==" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:86.127.226.172


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.194.218.134
country_id: 3017382
description:
[2026-06-18 10:09:53 +0000] info [cpaneld] 185.194.218.134 - conseiller "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user conseiller (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.95.212.63
country_id: 6252001
description:
[2026-06-18 10:11:43 +0000] info [cpaneld] 143.95.212.63 - cafe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.119.124
country_id: 1880251
description:
47.128.119.124 - - [18/Jun/2026:10:14:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184340&pdata=https%253A%252F%252Fmediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781777651 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.119.124


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.194.218.134
country_id: 3017382
description:
[2026-06-18 10:14:01 +0000] info [cpaneld] 185.194.218.134 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 162.251.172.237
country_id: 6252001
domain: letabloid.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/letabloid.tg/wp-content/uploads/2020/10/Ere-nouvelle-9-octobre-2020.pdf HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 75.64.253.74
country_id: 6252001
domain: www.letabloid.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.letabloid.tg/wp-content/uploads/2020/10/Ere-nouvelle-9-octobre-2020.pdf HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.141.152.16
country_id: 2750405
domain: 24heureinfo.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/145.0.0.0 Safari/537.36||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 87.109.159.37
country_id: 102358
domain: caissederetraites.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/caissederetraites.tg/sitemap.xml HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:10:18:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12805526&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781777923 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.73.83.29
country_id: 290557
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1416576171 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.111.136.67
country_id: 1643084
description:
103.111.136.67 - - [18/Jun/2026:10:19:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6933353&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fprobleme-de-sante-publique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781777985 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/probleme-de-sante-publique/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.7921.1977 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.111.136.67


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:10:20:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9725847&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781778046 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.39.140.167
country_id: 3469034
description:
Jun 18 10:21:41 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.39.140.167 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.82.52
country_id: 6252001
description:
[2026-06-18 10:22:53 +0000] info [cpaneld] 134.195.82.52 NEW qfaclpeg:nzmTJHfo4O_abFeT address=134.195.82.52,app=cpaneld,creator=qfaclpeg,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.121.159.127
country_id: 6252001
domain: www.arse.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:172.121.159.127||TA:172.121.159.127||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.122.252.45
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/817877 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.40.31.154
country_id: 3865483
description:
Jun 18 10:25:16 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.40.31.154 has been locked due to Imunify RBL


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 112.10.188.239
country_id: 1814991
domain: sia-togo.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.18||T:APACHE||MV:/wp-json/wp/v2/users/me||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 112.10.188.239
country_id: 1814991
domain: sia-togo.tg
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Linux; Android 13; Infinix X6816D) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.86 Mobile Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 109.177.219.76
country_id: 290557
description:
109.177.219.76 - - [18/Jun/2026:10:31:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723688&pdata=https%253A%252F%252F24heureinfo.tg%252Fdiplomatie%252Ftogo-nouvelle-conference-du-cdl-consacree-au-moyen-orient%252Ffeed&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781778677 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/diplomatie/togo-nouvelle-conference-du-cdl-consacree-au-moyen-orient/feed" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:109.177.219.76


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:10:33:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6973543&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781778808 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.0.142
country_id: 2300660
description:
Jun 18 10:35:52 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.0.142 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:10:36:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9989019&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781778982 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.136.228.101
country_id: 3469034
description:
2026-06-18 10:36:50 dovecot_login authenticator failed for H=(debian) [177.136.228.101]:48970: 535 Incorrect authentication data (set_id=hilaire.mensah@mesyscom.com)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:10:40:16 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:10:40:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.106.231.24
country_id: 6252001
domain: letabloid.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/letabloid.tg/wp-content/uploads/2021/12/Courrier-NU.pdf HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.132.137.175
country_id: 298795
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/ada198 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-18 10:44:12 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:55954: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:10:46:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10197609&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781779615 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.104.251
country_id: 3175395
description:
Jun 18 10:47:23 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.104.251 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.119.17
country_id: 1880251
description:
47.128.119.17 - - [18/Jun/2026:10:46:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7194472&pdata=https%253A%252F%252Fmediatopnews.tg%252F%253Fp%253D12518&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781779591 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/?p=12518" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.119.17


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 154.29.232.218
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:154.29.232.218||TA:154.29.232.218||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.104.251
country_id: 3175395
description:
Jun 18 10:47:29 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.104.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.24.147
country_id: 1269750
description:
Jun 18 10:49:33 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.24.147 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.119.142
country_id: 1880251
description:
47.128.119.142 - - [18/Jun/2026:10:50:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10249928&pdata=https%253A%252F%252Fmediatopnews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781779831 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.119.142


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:10:50:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6984907&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781779822 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.160.196.220
country_id: 1269750
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/61144615 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.61.130.187
country_id: 6252001
description:
[2026-06-18 10:53:39 +0000] info [cpaneld] 45.61.130.187 - pyllprbc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pyllprbc (has_cpuser_file failed)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:10:53:44 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.254.137.7
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/06/WhatsApp-Image-2023-06-07-at-16.57.28.jpeg 1008w, http:/togodailynews.tg/wp-content/uploads/2023/06/WhatsApp-Image-2023-06-07-at-16.57.28-300x225.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2023/06/WhatsApp-Image-2023-06-07-at-16.57.28-768x576.jpeg 768w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:10:53:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.12
country_id: 6252001
description:
205.169.39.12 - - [18/Jun/2026:10:59:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000538&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DYy5hb3VkZS5jQHJjdS5nb3Yuc2E%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781780377 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=Yy5hb3VkZS5jQHJjdS5nb3Yuc2E=" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.12


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.165.90.254
country_id: 1327865
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b50582094ad294b696f87dc469296dc8867a1628||Title:rsgs6esdeyxx7e||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.165.90.254
country_id: 1327865
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8dbb966be7c286a0902d3de98b53c5884bfbb852||Title:wjglf9asyvv4u77||RSV:8.18||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - kagbekoh@davakconsulting.com [06/18/2026:11:01:55 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: kagbekoh@davakconsulting.com


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.165.90.254
country_id: 1327865
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ce63eda1dc13bd3300a6e71b27f2513c4a5ac6a0||Title:cii75ylcrho22as||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [18/Jun/2026:11:02:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9685402&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DbXRmLmtoaTExQG1lZXphbmJhbmsuY29t&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781780574 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=bXRmLmtoaTExQG1lZXphbmJhbmsuY29t" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.165.90.254
country_id: 1327865
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:26cc46f899f90a3dae528c6128d3effbdfe4e756||Title:lxo5s92y11tg2dp4||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.87.47
country_id: 2750405
description:
[2026-06-18 11:03:17 +0000] info [whostmgrd] 217.181.87.47 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:11:02:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212781&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781780560 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.253.91.131
country_id: 3469034
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:104.253.91.131||TA:104.253.91.131||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.3
country_id: 6252001
description:
205.169.39.3 - - [18/Jun/2026:11:02:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9674139&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%255C%253Dy3j1zguub3blcmf0aw9uc0byawwuy29t&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781780567 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker\x5C=y3j1zguub3blcmf0aw9uc0byawwuy29t" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.3


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.214.210.205
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1853776714 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.165.90.254
country_id: 1327865
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1c9ea1c90630587457119216e0b95759678422bf||Title:32ymqkg6zevp862a||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.122
country_id: 3175395
description:
Jun 18 11:03:46 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.122 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 151.247.123.55
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:11-04.151.247.123.55||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.165.90.254
country_id: 1327865
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9edb0311c758976b1cca4aca977c292f17b0f62d||Title:o5h8o0ihdkmr4tzh||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:11:05:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10052972&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781780751 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.165.90.254
country_id: 1327865
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a9a11257d4938fa0e7569cb4533ac2a48eec93c7||Title:9oggddu1fh83l90lx4||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.165.90.254
country_id: 1327865
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3171fbf82e8c3c53785edd0a736230c1d1884a12||Title:sv0bbnptm5jvjis2z8||RSV:8.18||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 151.247.123.55
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:151.247.123.55||TA:151.247.123.55||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.121.139.79
country_id: 6252001
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:172.121.139.79||TA:172.121.139.79||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.165.90.254
country_id: 1327865
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d4e2dc5e72347b7ae534f277986c8f5ff3ba42fc||Title:7l8455plbzwcgr||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.12.117.176
country_id: 6251999
description:
[2026-06-18 11:09:20 +0000] info [cpaneld] 154.12.117.176 - libertepansel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.173.177.152
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:request_uri||MV:premier-seminaire-gouvernemental-lexecutif-en-conclave-pour-definir-ses-orientations/||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.165.90.254
country_id: 1327865
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:60a4052fc0736ea8728aa0ba40a43838d9fa9129||Title:g9dzpjkk7rgzqa0b||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.244.230.63
country_id: 3489940
description:
104.244.230.63 - - [18/Jun/2026:11:09:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000788&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DaHBsdW5rZXR0QG1lZ2FtYXJ0am0uY29t&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781780990 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=aHBsdW5rZXR0QG1lZ2FtYXJ0am0uY29t" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.244.230.63


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.165.90.254
country_id: 1327865
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:08533821f12c5d31f7768486e7365691854825fc||Title:8giombuz4sfmpuwxtx||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.194.218.134
country_id: 3017382
description:
[2026-06-18 11:09:34 +0000] info [cpaneld] 185.194.218.134 - sprocaadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:11:09:59 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:11:09:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.165.90.254
country_id: 1327865
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:907314ae9966436a1d23c7bfa0ae4dc8a0a5203d||Title:a5e50o4cmakzaho||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.165.90.254
country_id: 1327865
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b07caf05d50414159bb0e2c8765de9d4ea5cd96c||Title:78mvdbc8fal0f9m7||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.165.90.254
country_id: 1327865
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:399f7cb96724e22648c1d16ac27300143dcf8b4c||Title:0nj00h003s95j0q||RSV:8.18||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.143.245.165
country_id: 2510769
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:104.143.245.165||TA:104.143.245.165||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.165.90.254
country_id: 1327865
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ee8620b513cdc261e8971521cf89d613b30831c7||Title:4intunyx1ll3pr8||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.59.222.108
country_id: 690791
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2026-06-17-at-18.41.28-300x300.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2026-06-17-at-18.41.28-1024x1024.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2026-06-17-at-18.41.28-150x150.webp 150w, http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2026-06-17-at-18.41.28-768x768.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2026-06-17-at-18.41.28.webp 1254w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.165.90.254
country_id: 1327865
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0385989fc10235b177911f2994ce55670d27f3ea||Title:v2gjt82rq76qz94d55||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.165.90.254
country_id: 1327865
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d2ba515d5a1207361b388c3aad2e3533fb8453ad||Title:g7hwo5wqbnm0wv8d||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.74
country_id: 2635167
description:
[2026-06-18 11:16:24 +0000] info [cpaneld] 5.230.153.74 NEW ttfuehop:TXn3oUp9YcSNdTgt address=5.230.153.74,app=cpaneld,creator=ttfuehop,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 13.217.90.244
country_id: 6252001
domain: 24heureinfo.tg
description:
IM360 WAF: Possible XSS in arguments||MV:sig1=(\"@authority\" \"signature-agent\");created=1781781351;keyid=\"qdc6-vlwad4yd6yremqpjilim3bxffja_vhgl5qa71e\";alg=\"ed25519\";expires=1781781381;nonce=\"vvbev1wmewx4wj4fcbo rx2dfc8qtqg4fa5qrhq1vbyy/rq mojccowfxy/onpdb\";tag=\"web-bot-auth\"||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.165.90.254
country_id: 1327865
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e8dd4796b60fb87130090e7ecf061c251b57cc0f||Title:afw8j5v47f3n9nlyg4||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.133
country_id: 2635167
description:
[2026-06-18 11:16:26 +0000] info [cpaneld] 5.230.133.133 NEW mbyqtkiw:uK4dvlb2YPhfepVe address=5.230.133.133,app=cpaneld,creator=mbyqtkiw,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 107.174.169.209
country_id: 6252001
domain: mftogo.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ttfuehop/public_html/.948419776064651.php||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.71.186.98
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/11/Haytham-608x270-1.png 608w, http:/togodailynews.tg/wp-content/uploads/2023/11/Haytham-608x270-1-300x133.png 300w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.165.90.254
country_id: 1327865
domain: ekeasarl.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.ekeasarl.com||ServerName:ekeasarl.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:28a9bd26d91abbd62b209f4ef4b1b3ecbc59915c||Title:l7z79tp9hlkwr4t2nb||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-18 11:17:53 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:53418: 535 Incorrect authentication data (set_id=student)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.175.154.108
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/07/Disponibilite-de-creales-ANSAT-repond-aux-besoins-des-populations.png 800w, http:/togodailynews.tg/wp-content/uploads/2021/07/Disponibilite-de-creales-ANSAT-repond-aux-besoins-des-populations-300x167.png 300w, http:/togodailynews.tg/wp-content/uploads/2021/07/Disponibilite-de-creales-ANSAT-repond-aux-besoins-des-populations-768x427.png 768w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.194.218.134
country_id: 3017382
description:
[2026-06-18 11:18:45 +0000] info [cpaneld] 185.194.218.134 - rolle "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rolle (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.253.208.57
country_id: 6252001
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:104.253.208.57||TA:104.253.208.57||


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 196.171.23.59
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.18||T:APACHE||MVN:ARGS:dimClass||MV:unapproved||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:11:20:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10315876&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781781635 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.165.143
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>c\xe2\x80\x99est une nouvelle \xc3\xa9tape franchie dans les relations diplomatiques entre le togo et la tunisie. lundi 15 juin dernier, les deux pays ont sign\xc3\xa9 un m\xc3\xa9morandum d\xe2\x80\x99entente relatif \xc3\xa0 la mise en place de consultations politiques et diplomatiques r\xc3\xa9guli\xc3\xa8res.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>r\xc3\xa9unis pour consolider l\xe2\x80\x99axe lom\xc3\xa9-tunis, les chefs de la diplomatie des deux pays ont, lundi 15 juin dernier, pos\xc3\xa9 les bases d\xe2\x80\x99un partenariat strat\xc3\xa9gique et durable.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>en effet, les ministres des affaires \xc3\xa9trang\xc3\xa8res des deux pays, robert dussey et mohamed ali nafti, ont sign\xc3\xa9 un m\xc3\xa9morandum d\xe2\x80\x99entente crucial. il formalise la mise en place de consultations politiques et diplomatiques r\xc3\xa9guli\xc3\xa8res entre les deux pays. l\xe2\x80\x99objectif affich\xc3\xa9 est de favoriser un partenariat plus \xc3\xa9quilibr\xc3\xa9 et mutuellement avantageux.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31006,\"sizeslug\":\"full\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-full\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/otr_ferer-pour-batir-1.jpg\" alt=\"\" class=\"wp-image-31006\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>dans cette perspective, un plan d\xe2\x80\x99actions conjoint couvrant la p\xc3\xa9riode 2026-2027, a \xc3\xa9t\xc3\xa9 convenu. ce document traduit les engagements pris en initiatives concr\xc3\xa8tes et de suivre leur mise en \xc5\x93uvre de mani\xc3\xa8re concert\xc3\xa9e. il s\xe2\x80\x99agit notamment de renforcer le dialogue direct entre lom\xc3\xa9 et tunis&nbsp;; donner un contenu op\xc3\xa9rationnel et pragmatique \xc3\xa0 la coop\xc3\xa9ration bilat\xc3\xa9rale, et de structurer durablement les \xc3\xa9changes pour passer des intentions aux actes.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>au-del\xc3\xa0 de l'aspect purement diplomatique, l'\xc3\xa9conomie demeure le socle de ce rapprochement entre lom\xc3\xa9 et tunis. les deux parties partagent, en effet, une ambition forte, celle d\xe2\x80\x99intensifier leur int\xc3\xa9gration \xc3\xa9conomique en s'appuyant sur les m\xc3\xa9canismes continentaux, au premier rang desquels figure la zone de libre-\xc3\xa9change continentale africaine (zlecaf).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ce cadre multilat\xc3\xa9ral offre de nouvelles opportunit\xc3\xa9s majeures pour les deux pays, notamment \xc3\xa0 travers la facilitation des \xc3\xa9changes commerciaux interafricains, la r\xc3\xa9duction progressive des barri\xc3\xa8res tarifaires et douani\xc3\xa8res, et le d\xc3\xa9veloppement de cha\xc3\xaenes de valeur r\xc3\xa9gionales comp\xc3\xa9titives.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31146,\"width\":\"660px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/image-30-724x1024.png\" alt=\"\" class=\"wp-image-31146\" style=\"width:660px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>notons qu\xe2\x80\x99en mettant en commun leurs forces, lom\xc3\xa9 et tunis d\xc3\xa9montrent que la coop\xc3\xa9ration sud-sud et l'int\xc3\xa9gration continentale sont des leviers incontournables pour la prosp\xc3\xa9rit\xc3\xa9 de l'afrique de demain.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>jpb</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 154.201.74.3
country_id: 241170
domain: lepoint-actu.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:11-22.154.201.74.3||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.43
country_id: 6252001
description:
205.169.39.43 - - [18/Jun/2026:11:23:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9737832&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%255C%253DbWFqZWQuYWxzdWJpZUBhcmFtY28uY29t&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781781791 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker\x5C=bWFqZWQuYWxzdWJpZUBhcmFtY28uY29t" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_1 like Mac OS X) AppleWebKit/603.1.30 (KHTML, like Gecko) Version/10.0 Mobile/14E304 Safari/602.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.43


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.38
country_id: 6252001
description:
205.169.39.38 - - [18/Jun/2026:11:23:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804906&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%255C%253DbWFqZWQuYWxzdWJpZUBhcmFtY28uY29t&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781781792 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker\x5C=bWFqZWQuYWxzdWJpZUBhcmFtY28uY29t" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.38


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.82.120.244
country_id: 1269750
description:
Jun 18 11:23:12 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.82.120.244 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [18/Jun/2026:11:23:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6841499&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%255C%253DbWFqZWQuYWxzdWJpZUBhcmFtY28uY29t&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781781792 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker\x5C=bWFqZWQuYWxzdWJpZUBhcmFtY28uY29t" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:11:24:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:11:24:37 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.176.182.12
country_id: 3469034
description:
Jun 18 11:26:03 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.176.182.12 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.175.135.166
country_id: 6252001
domain: 24heureinfo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:107.175.135.166||TA:107.175.135.166||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.205
country_id: 1880251
description:
47.128.96.205 - - [18/Jun/2026:11:31:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724248&pdata=https%253A%252F%252Ftdn.tg%252Fsuspension-visa-etudiants-etrangers-etats-unis%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781782294 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/suspension-visa-etudiants-etrangers-etats-unis/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.205


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:11:32:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6711962&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781782352 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 41.207.188.29
country_id: 2363686
description:
41.207.188.29 - - [18/Jun/2026:11:32:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6645350&pdata=https%253A%252F%252Ftogodailynews.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781782360 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:41.207.188.29


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.137
country_id: 1880251
description:
47.128.96.137 - - [18/Jun/2026:11:32:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10120860&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffemmes-sorcieres%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781782347 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/femmes-sorcieres/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.137


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.60.16.26
country_id: 3996063
description:
[2026-06-18 11:34:01 +0000] info [webmaild] 190.60.16.26 - emmanuel.megbenu@mesyscom.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 140.213.6.54
country_id: 1643084
description:
140.213.6.54 - - [18/Jun/2026:11:35:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13263763&pdata=https%253A%252F%252Fekeasarl.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781782519 HTTP/2.0" 302 0 ekeasarl.com "https://ekeasarl.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:140.213.6.54


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.110.8.143
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/01/Le-chef-de-lEtat-preside-le-deuxieme-Conseil-des-ministres-de-lannee.jpg 1600w, http:/togodailynews.tg/wp-content/uploads/2024/01/Le-chef-de-lEtat-preside-le-deuxieme-Conseil-des-ministres-de-lannee-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2024/01/Le-chef-de-lEtat-preside-le-deuxieme-Conseil-des-ministres-de-lannee-1024x682.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/01/Le-chef-de-lEtat-preside-le-deuxieme-Conseil-des-ministres-de-lannee-768x512.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2024/01/Le-chef-de-lEtat-preside-le-deuxieme-Conseil-des-ministres-de-lannee-1536x1023.jpg 1536w, http:/togodailynews.tg/wp-content/uploads/2024/01/Le-chef-de-lEtat-preside-le-deuxieme-Conseil-des-ministres-de-lannee-272x182.jpg 272w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:11:37:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7300767&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781782660 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 112.215.152.213
country_id: 1643084
description:
112.215.152.213 - - [18/Jun/2026:11:38:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869977&pdata=https%253A%252F%252Ftogosem.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781782709 HTTP/2.0" 302 0 togosem.com "https://togosem.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:112.215.152.213


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:11:40:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 41.78.136.125
country_id: 2363686
description:
[2026-06-18 11:39:33 +0000] info [webmaild] 41.78.136.125 - dev@dgdn-togo.tg "POST /cpsess3195868098/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [41.78.136.107] != Current IP Address [41.78.136.125]


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:11:40:06 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.113.16.111
country_id: 174982
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/25-907-eleves-proteges-contre-la-faim-dans-la-region-de-la-kara/ HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.113.16.111
country_id: 174982
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/25-907-eleves-proteges-contre-la-faim-dans-la-region-de-la-kara/ HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.78.21.45
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/c3bfb8 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.92.22.1
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/09/Page-4-B-2.jpg 800w, http:/togodailynews.tg/wp-content/uploads/2022/09/Page-4-B-2-300x188.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2022/09/Page-4-B-2-768x480.jpg 768w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 83.229.26.249
country_id: 6252001
description:
[2026-06-18 11:43:27 +0000] info [whostmgrd] 83.229.26.249 - root "GET /json-api/loadavg HTTP/1.1" FAILED LOGIN whostmgrd: login attempt to WHM with bad accesshash or API token


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 140.141.220.54
country_id: 6252001
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/qualite-des-prestations-de-la-ceet-larse-prete-une-oreille-attentive-a-latc/ HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 83.229.26.249
country_id: 6252001
description:
[2026-06-18 11:45:32 +0000] info [whostmgrd] 83.229.26.249 - root "POST /json-api/create_user_session?api.version=1&user=root HTTP/1.1" FAILED LOGIN whostmgrd: login attempt to WHM with bad accesshash or API token


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.45.202.83
country_id: 2017370
description:
2026-06-18 11:46:15 dovecot_plain authenticator failed for H=([69.172.210.47]) [46.45.202.83]:42098: 535 Incorrect authentication data (set_id=info@ucao-uut.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.211.7.162
country_id: 2215636
description:
2026-06-18 11:46:40 dovecot_login authenticator failed for H=([221.235.182.76]) [102.211.7.162]:45290: 535 Incorrect authentication data (set_id=dbamaze@otr.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:11:46:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9922202&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781783205 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-18 11:48:15 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:40076: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:11:48:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050595&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781783335 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-18 11:54:40 +0000] info [whostmgrd] 80.248.64.198 - root "POST /cpsess4179796351/scripts2/dogencrt HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [104.28.154.50] != Current IP Address [80.248.64.198]


plugin: ossec
rule: 11009
name: WHM login success
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-18 11:54:45 +0000] info [whostmgrd] 80.248.64.198 NEW root:ai8KcpD91pbfRLsG address=80.248.64.198,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 193.239.176.49
country_id: 798549
domain: cfpj.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:193.239.176.49||TA:193.239.176.49||


plugin: ossec
rule: 11011
name: WHM SSO login failed
abuser: 80.248.64.198
country_id: 2363686
description:
[2026-06-18 11:54:40 +0000] info [whostmgrd] 80.248.64.198 PURGE root:Fib_EytJYaAQ9DCO badpass [cookie ip check: IP address has changed: IP Address [104.28.154.50] != Current IP Address [80.248.64.198]]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.165.221
country_id: 3469034
description:
Jun 18 11:55:28 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.165.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-18 11:55:45 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:49592: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:11:56:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:11:56:04 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - faustinhoinso@flp-tg.com [06/18/2026:11:57:29 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: faustinhoinso@flp-tg.com


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - elisagou@flp-tg.com [06/18/2026:11:58:35 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: elisagou@flp-tg.com


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:12:02:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999258&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781784117 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 102.64.223.120
country_id: 2363686
description:
[2026-06-18 12:02:12 +0000] info [cpaneld] 102.64.223.120 NEW mgvybwur:vvPOUAb_4qZvvvpU address=102.64.223.120,app=cpaneld,creator=root,method=handle_form_login,path=loadsession:mgvybwur:WH3iUky4i8GaDkoM:create_user_session,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.144.47
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/716e56 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:12:04:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13014421&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781784260 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.28.241.204
country_id: 3865483
domain: www.derou.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.derou.tg/Concours HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.175.229.192
country_id: 2921044
description:
[2026-06-18 12:04:03 +0000] info [cpaneld] 5.175.229.192 NEW cietg:Qv9Lok0oYCkJovfd address=5.175.229.192,app=cpaneld,creator=cietg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.59.161.65
country_id: 1643084
description:
[2026-06-18 12:07:23 +0000] info [cpaneld] 103.59.161.65 - cvajhehu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cvajhehu (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.199.70
country_id: 2363686
description:
[2026-06-18 12:07:43 +0000] info [webmaild] 160.242.199.70 - yadjor@caissederetraites.tg "POST /cpsess9434851994/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [160.242.195.10] != Current IP Address [160.242.199.70]


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:12:08:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:12:08:15 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.16
country_id: 6252001
description:
205.169.39.16 - - [18/Jun/2026:12:09:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13354909&pdata=https%253A%252F%252Fits.tg%252Fdata.js&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781784542 HTTP/2.0" 302 0 its.tg "https://its.tg/data.js" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.16


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.165.143
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>la 11<sup>\xc3\xa8me</sup> conf\xc3\xa9rence des nations unies sur les oc\xc3\xa9ans s\xe2\x80\x99est tenue du 16 au jeudi 18 juin dernier, dans la capitale k\xc3\xa9nyane. plac\xc3\xa9e sous le th\xc3\xa8me\xc2\xa0: \xc2\xab\xc2\xa0notre oc\xc3\xa9an, notre patrimoine, notre avenir\xc2\xa0\xc2\xbb, cette rencontre internationale majeure a r\xc3\xa9uni les d\xc3\xa9cideurs mondiaux, dont une d\xc3\xa9l\xc3\xa9gation togolaise, autour de l'urgence climatique et de la sauvegarde des \xc3\xa9cosyst\xc3\xa8mes marins.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>au c\xc5\x93ur des d\xc3\xa9bats \xc3\xa0 nairobi, la d\xc3\xa9l\xc3\xa9gation togolaise a tenu \xc3\xa0 valoriser les r\xc3\xa9formes et les efforts entrepris \xc3\xa0 l'\xc3\xa9chelle nationale. le togo s'illustre particuli\xc3\xa8rement par l'int\xc3\xa9gration syst\xc3\xa9matique de la pr\xc3\xa9servation des \xc3\xa9cosyst\xc3\xa8mes marins dans ses politiques publiques.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>l'approche togolaise repose sur un \xc3\xa9quilibre crucial : allier la protection de la biodiversit\xc3\xa9 et le soutien aux populations c\xc3\xb4ti\xc3\xa8res, dont la survie \xc3\xa9conomique d\xc3\xa9pend directement des ressources de la mer.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31146,\"width\":\"676px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/image-30-724x1024.png\" alt=\"\" class=\"wp-image-31146\" style=\"width:676px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>l\xe2\x80\x99un des grands chantiers actuels du pays reste la mise en place de zones strat\xc3\xa9giques de conservation. <em>\xc2\xab l\xe2\x80\x99un des buts de la participation du togo \xc3\xa0 cette rencontre est de mieux cerner les enjeux internationaux li\xc3\xa9s \xc3\xa0 la protection des oc\xc3\xa9ans, afin d\xe2\x80\x99int\xc3\xa9grer les pr\xc3\xa9occupations des communaut\xc3\xa9s riveraines dans la cr\xc3\xa9ation d\xe2\x80\x99aires marines prot\xc3\xa9g\xc3\xa9es au togo. \xc2\xbb, </em>a expliqu\xc3\xa9anthe komi, directeur g\xc3\xa9n\xc3\xa9ral de l\xe2\x80\x99office de d\xc3\xa9veloppement et d\xe2\x80\x99exploitation des for\xc3\xaats (odef) et membre de la d\xc3\xa9l\xc3\xa9gation togolaise.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>notons que ces derni\xc3\xa8res ann\xc3\xa9es, lom\xc3\xa9 a intensifi\xc3\xa9 ses actions pour encadrer les activit\xc3\xa9s c\xc3\xb4ti\xc3\xa8res et freiner la d\xc3\xa9gradation de son littoral. face aux nouveaux d\xc3\xa9fis, l\xe2\x80\x99ex\xc3\xa9cutif togolais multiplie les initiatives r\xc3\xa9glementaires et concr\xc3\xa8tes pour garantir une gestion durable de ses ressources halieutiques.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>une dynamique qui s\xe2\x80\x99inscrit dans la lign\xc3\xa9e des r\xc3\xa9centes d\xc3\xa9clarations du ministre en charge de l\xe2\x80\x99\xc3\x89conomie maritime, edem tengue, qui rappelait notre responsabilit\xc3\xa9 collective lors de la c\xc3\xa9l\xc3\xa9bration de la journ\xc3\xa9e mondiale de l\xe2\x80\x99oc\xc3\xa9an, le 8 juin dernier.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31156,\"sizeslug\":\"large\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/cf280d22-5566-4950-b6b8-986b4a8db8fc-724x1024.jpg\" alt=\"\" class=\"wp-image-31156\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><em>\xc2\xab r\xc3\xa9imaginer l\xe2\x80\x99oc\xc3\xa9an, ce n\xe2\x80\x99est pas le contempler, c\xe2\x80\x99est le sauver. ce n\xe2\x80\x99est pas en parler, c\xe2\x80\x99est l\xe2\x80\x99habiter autrement. c\xe2\x80\x99est cesser de le consid\xc3\xa9rer comme un h\xc3\xa9ritage in\xc3\xa9puisable et commencer \xc3\xa0 le traiter comme ce qu\xe2\x80\x99il est : un bien commun de l\xe2\x80\x99humanit\xc3\xa9, fragile, dont nous sommes les d\xc3\xa9positaires devant les g\xc3\xa9n\xc3\xa9rations \xc3\xa0 venir. \xc2\xbb,</em> avait-il soutenu.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>notons qu\xe2\x80\x99en portant cette voix \xc3\xa0 nairobi, le togo r\xc3\xa9affirme qu'il ne se contente plus de subir les effets du d\xc3\xa9r\xc3\xa8glement climatique, mais s'impose comme un acteur proactif pour l\xc3\xa9guer un patrimoine maritime viable aux g\xc3\xa9n\xc3\xa9rations futures.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>mab\xc3\xa9 b.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.59.161.65
country_id: 1643084
description:
[2026-06-18 12:12:20 +0000] info [cpaneld] 103.59.161.65 - Benito "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Benito (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 130.12.182.188
country_id: 3190538
description:
Jun 18 12:13:41 ns5 pure-ftpd[2879380]: (?@130.12.182.188) [INFO] New connection from 130.12.182.188


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.53
country_id: 6252001
description:
205.169.39.53 - - [18/Jun/2026:12:15:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7117510&pdata=https%253A%252F%252Fits.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781784914 HTTP/2.0" 302 0 its.tg "https://its.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.53


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:12:16:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9987437&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781784966 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.29.217.15
country_id: 1168579
domain: cfpj.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:69252.cfpj.tg||ServerName:cfpj.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cb466a9f700eee5d5999db693649df5df3551e18||Title:0x35140956||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.24
country_id: 6252001
description:
[2026-06-18 12:18:59 +0000] info [cpaneld] 64.44.62.24 NEW dvhzmira:E4vAtwNSTKwcvj2S address=64.44.62.24,app=cpaneld,creator=dvhzmira,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.84.190.213
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/780498331 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.29.217.15
country_id: 1168579
domain: cfpj.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ar.cfpj.tg||ServerName:cfpj.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bc2b6987558f8d7a1001cd3dc1c9669db328417d||Title:0x5f2ec6f8||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.125.248.195
country_id: 1733045
description:
27.125.248.195 - - [18/Jun/2026:12:18:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9871048&pdata=https%253A%252F%252F24heureinfo.tg%252F%253Fp%253D10085&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781785103 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/?p=10085" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.125.248.195


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.29.217.15
country_id: 1168579
domain: cfpj.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ar.cfpj.tg||ServerName:cfpj.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5037b3e4fb880fecf3d5c9e3649cdcd27c9b287c||Title:0x0903855d||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.5.230
country_id: 690791
description:
Jun 18 12:20:30 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.5.230 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:12:20:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6461802&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781785239 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.29.217.15
country_id: 1168579
domain: cfpj.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ar.cfpj.tg||ServerName:cfpj.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:52952ef55cf8802ffec133fe1e79d919d60874ef||Title:0x2fb884ef||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.29.217.15
country_id: 1168579
domain: cfpj.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ar.cfpj.tg||ServerName:cfpj.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:403f64538b72c13919eabcc8c6b4b3863eb60795||Title:0x1cd6123c||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:12:23:12 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:12:23:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:12:23:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:12:23:15 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 134.195.83.109
country_id: 6252001
domain: sahamtg.com
description:
IM360 WAF: Possible phishing page detected||SC:/home/sahamtg/public_html/.808654861395151.php||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.29.217.15
country_id: 1168579
domain: cfpj.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ar.cfpj.tg||ServerName:cfpj.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:813d3b7e01e17c8ce45f81ad0fa1937eb9dcff65||Title:0x5b4d0d4c||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.231.255.50
country_id: 3017382
description:
[2026-06-18 12:23:49 +0000] info [cpaneld] 5.231.255.50 NEW sahamtg:OcT9OA3tVpCLVmUp address=5.231.255.50,app=cpaneld,creator=sahamtg,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.29.217.15
country_id: 1168579
domain: cfpj.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ar.cfpj.tg||ServerName:cfpj.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d30c0b2b2f9f535e630c549f15ef895a400cae88||Title:0xa4c28b6d||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.29.217.15
country_id: 1168579
domain: cfpj.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ar.cfpj.tg||ServerName:cfpj.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d5b9a4cb963c2b279bcd3f53460a5571389b909c||Title:0xf81558eb||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.29.217.15
country_id: 1168579
domain: cfpj.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ar.cfpj.tg||ServerName:cfpj.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c8740185f78ed1973fe12f3276f037fe9af9f938||Title:0xec89c148||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 41.138.89.226
country_id: 2395170
description:
41.138.89.226 - - [18/Jun/2026:12:28:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10078099&pdata=https%253A%252F%252Fwww.snb.tg%252Fcareer&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781785682 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/career" "Mozilla/5.0 (Linux; Android 15; Infinix X6725 Build/AP3A.240905.015.A2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.7778.217 Mobile Safari/537.36" WL:"0" "com.google.android.apps.searchlite" XFF:"-" CAPTCHA:"0" PEER:41.138.89.226


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.29.217.15
country_id: 1168579
domain: cfpj.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ksoaadmin.cfpj.tg||ServerName:cfpj.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:af658214d044379b58c0c7b255044656cb25d792||Title:0x168528f3||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.29.217.15
country_id: 1168579
domain: cfpj.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ksoaadmin.cfpj.tg||ServerName:cfpj.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7bfd3392b19feeef8c7f4a3d3e11d22b4e58bf7a||Title:0x24ab8998||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:12:29:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9594006&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781785744 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:12:29:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7129237&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781785751 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.29.217.15
country_id: 1168579
domain: cfpj.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ksoaadmin.cfpj.tg||ServerName:cfpj.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cee18ec9bfe46863afcc60c3cb422d574f067c77||Title:0x2d86651f||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.29.217.15
country_id: 1168579
domain: cfpj.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:ksoaadmin.cfpj.tg||ServerName:cfpj.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4250c0298f4c9a2438e12b9f55be850d09bc1c5f||Title:0xdf4c4a01||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:12:34:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053269&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781786052 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.179
country_id: 2635167
description:
[2026-06-18 12:34:33 +0000] info [cpaneld] 5.230.133.179 NEW qfaclpeg:e2OygKjWa36Oms93 address=5.230.133.179,app=cpaneld,creator=qfaclpeg,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.202.21.88
country_id: 6252001
description:
54.202.21.88 - - [18/Jun/2026:12:34:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6592919&pdata=https%253A%252F%252Fkpmg.tg%252Ff3fcede3ceb48531317d565cce982d2b%252Facf2d8c858075b0500387330fbe3e107%252Fea425e05eea2788cc063ebda30164563%252F6ceb254a8cb5490cf313a3dfacf56698%252F20b8a46017f76205f06cbecfe393b213%252Findex.php%253Fcmd%253Dlogin%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781786075 HTTP/2.0" 302 0 kpmg.tg "https://kpmg.tg/f3fcede3ceb48531317d565cce982d2b/acf2d8c858075b0500387330fbe3e107/ea425e05eea2788cc063ebda30164563/6ceb254a8cb5490cf313a3dfacf56698/20b8a46017f76205f06cbecfe393b213/index.php?cmd=login/" "Mozilla/5.0 (Linux; Android 8.0.0; SM-G965U Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.155 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.202.21.88


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-18 12:35:01 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:63995: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.223
country_id: 6252001
description:
[2026-06-18 12:35:41 +0000] info [cpaneld] 64.44.62.223 NEW frtwilql:KF52605iqUOGI46U address=64.44.62.223,app=cpaneld,creator=frtwilql,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.208
country_id: 1880251
description:
47.128.96.208 - - [18/Jun/2026:12:36:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724761&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fgerry-taama%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781786210 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/gerry-taama/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.208


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:12:38:14 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:12:38:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:12:38:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:12:38:18 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.145.207.7
country_id: 3469034
description:
2026-06-18 12:39:17 dovecot_login authenticator failed for H=(192.145.207.7) [192.145.207.7]:46820: 535 Incorrect authentication data (set_id=test@arse.tg)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.245.240.81
country_id: 2921044
description:
Jun 18 12:40:01 ns5 pure-ftpd[2899951]: (?@165.245.240.81) [INFO] New connection from 165.245.240.81


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
description:
[2026-06-18 12:40:31 +0000] info [whostmgrd] 185.194.218.134 -  netmast  "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 196.171.23.59
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36||MV:/wp-json/wp-site-health/v1/tests/authorization-header?_locale=user||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.25.229
country_id: 690791
description:
Jun 18 12:42:45 ns5 auth[2195898]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.25.229 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:12:45:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10446744&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781786706 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.165.143
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>le prestigieux sommet fii priority europe s\xe2\x80\x99est ouvert \xc3\xa0 rome, en italie, en pr\xc3\xa9sence du pr\xc3\xa9sident du conseil, faure essozimna gnassingb\xc3\xa9. ce rendez-vous strat\xc3\xa9gique, qui s'impose comme le point de ralliement des leaders mondiaux, des investisseurs de premier plan et des d\xc3\xa9cideurs \xc3\xa9conomiques internationaux, se veut une plateforme unique pour repenser les mod\xc3\xa8les de croissance et anticiper les grandes transitions dans un contexte macro\xc3\xa9conomique en pleine mutation.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>le rendez-vous de cette ann\xc3\xa9e porte sur des th\xc3\xa9matiques cruciales pour la stabilit\xc3\xa9 et la croissance globale. face aux crises g\xc3\xa9opolitiques et \xc3\xa9nerg\xc3\xa9tiques r\xc3\xa9centes, la souverainet\xc3\xa9 \xc3\xa9conomique est devenue la priorit\xc3\xa9 absolue des nations et des blocs r\xc3\xa9gionaux.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31146,\"width\":\"608px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/image-30-724x1024.png\" alt=\"\" class=\"wp-image-31146\" style=\"width:608px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>ce sommet va s\xe2\x80\x99articuler autour de trois axes fondamentaux, \xc3\xa0 savoir&nbsp;: la comp\xc3\xa9titivit\xc3\xa9 globale, notamment comment stimuler l'innovation et l'attractivit\xc3\xa9 des march\xc3\xa9s dans un environnement hyper-comp\xc3\xa9titif ? ; la souverainet\xc3\xa9 \xc3\xa9conomique, qui passe par la r\xc3\xa9duction des d\xc3\xa9pendances strat\xc3\xa9giques tout en maintenant des partenariats internationaux solides&nbsp;; et la transformation technologique par l\xe2\x80\x99int\xc3\xa9gration de l'intelligence artificielle et les technologies propres pour garantir une croissance durable.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>les participants devront profiter de ce rendez-vous pour concevoir de nouvelles strat\xc3\xa9gies de relocalisation, de r\xc3\xa9gionalisation et de diversification des sources d'approvisionnement, ceci dans l\xe2\x80\x99optique de <em>\xc2\xab passer d'une logique de flux tendus \xc3\xa0 une logique de r\xc3\xa9silience \xc3\xa9conomique \xc2\xbb.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>a rome, le leader togolais va intervenir sur <em>\xc2\xab&nbsp;les perspectives du partenariat \xc3\xa9conomique entre l\xe2\x80\x99afrique et l\xe2\x80\x99europe, dans un contexte o\xc3\xb9 notre continent en se hissant progressivement parmi les \xc3\xa9conomies \xc3\xa0 croissance les plus rapides au monde, offre un espace strat\xc3\xa9gique pour les investissements, la connectivit\xc3\xa9, la logistique et l\xe2\x80\x99int\xc3\xa9gration r\xc3\xa9gionale&nbsp;\xc2\xbb.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31157,\"width\":\"558px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/18d98b1d-0295-41c7-afab-fc9c13606bd0-724x1024.jpg\" alt=\"\" class=\"wp-image-31157\" style=\"width:558px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>notons que le togo entend pleinement contribuer \xc3\xa0 cette dynamique en valorisant son r\xc3\xb4le de hub logistique et de porte d\xe2\x80\x99entr\xc3\xa9e naturelle vers l\xe2\x80\x99hinterland ouest-africain, au service d\xe2\x80\x99une croissance partag\xc3\xa9e, de corridors plus performants et d\xe2\x80\x99opportunit\xc3\xa9s accrues pour nos populations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>nous y reviendrons&nbsp;!!!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:12:45:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6932629&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781786711 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.95.200.219
country_id: 798544
description:
Jun 18 12:45:19 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.95.200.219 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.194.218.134
country_id: 3017382
description:
[2026-06-18 12:46:14 +0000] info [whostmgrd] 185.194.218.134 - anadebfreenetmas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.95.200.219
country_id: 798544
description:
Jun 18 12:45:27 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.95.200.219 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 173.211.88.153
country_id: 6252001
description:
[2026-06-18 12:46:12 +0000] info [cpaneld] 173.211.88.153 NEW doufelg:xHKyPqe8ZhJtc5FR address=173.211.88.153,app=cpaneld,creator=doufelg,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 34.178.196.15
country_id: 2750405
domain: direct7.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Votre IP (34.178.196.15) a \xc3\xa9t\xc3\xa9 signal\xc3\xa9e pour de potentielles violations de s\xc3\xa9curit\xc3\xa9.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.208.49.109
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-24-at-01.03.23-1-1024x682.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-24-at-01.03.23-1-300x200.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-24-at-01.03.23-1-768x512.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-24-at-01.03.23-1-1536x1024.jpeg 1536w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-24-at-01.03.23-1-2048x1365.jpeg 2048w, http:/togodailynews.tg/wp-content/uploads/2024/04/WhatsApp-Image-2024-04-24-at-01.03.23-1-272x182.jpeg 272w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.153.66.113
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/776627109 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.107.14
country_id: 3469034
description:
Jun 18 12:49:00 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.107.14 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:12:51:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6973381&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781787060 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.11.43.186
country_id: 2562770
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/626a67 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.41.245.139
country_id: 3865483
description:
Jun 18 12:52:11 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.41.245.139 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.230.247.184
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tg/contact/ HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:12:53:57 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:12:53:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:12:54:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:12:54:01 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.194.218.134
country_id: 3017382
description:
[2026-06-18 12:59:12 +0000] info [cpaneld] 185.194.218.134 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:12:59:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13211795&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781787585 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:12:59:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6998679&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781787586 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.160.45.26
country_id: 1814991
description:
Jun 18 13:02:17 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.160.45.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.160.45.26
country_id: 1814991
description:
2026-06-18 13:02:19 dovecot_login authenticator failed for H=(116-59-11-115.emome-ip.hinet.net) [124.160.45.26]:60258: 535 Incorrect authentication data (set_id=dbamaze@otr.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.230.78.188
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/6d7779 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 173.73.150.5
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tdn.tg/togo-covid-19-reception-de-200-000-doses-du-vaccin-chinois-coronavac-ce-vendredi/ HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.95.134.167
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/439881706 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.124
country_id: 1880251
description:
47.128.96.124 - - [18/Jun/2026:13:06:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9659503&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffc-barca%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781787978 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/fc-barca/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.124


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.175.119.134
country_id: 6252001
domain: vitrinenews.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:107.175.119.134||TA:107.175.119.134||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:13:06:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6658199&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781788003 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:13:08:42 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:13:08:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:13:08:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:13:08:45 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.194.218.134
country_id: 3017382
description:
[2026-06-18 13:08:59 +0000] info [cpaneld] 185.194.218.134 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.212.90
country_id: 933860
description:
Jun 18 13:11:05 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.212.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.213.150
country_id: 933860
description:
Jun 18 13:11:44 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.213.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.165.143
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>le prestigieux sommet fii priority europe s\xe2\x80\x99est ouvert, le mercredi 17 juin 2026, \xc3\xa0 rome, en italie, en pr\xc3\xa9sence du pr\xc3\xa9sident du conseil, faure essozimna gnassingb\xc3\xa9. ce rendez-vous strat\xc3\xa9gique, qui s'impose comme le point de ralliement des leaders mondiaux, des investisseurs de premier plan et des d\xc3\xa9cideurs \xc3\xa9conomiques internationaux, se veut une plateforme unique pour repenser les mod\xc3\xa8les de croissance et anticiper les grandes transitions dans un contexte macro\xc3\xa9conomique en pleine mutation.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>le rendez-vous de cette ann\xc3\xa9e porte sur des th\xc3\xa9matiques cruciales pour la stabilit\xc3\xa9 et la croissance globale. face aux crises g\xc3\xa9opolitiques et \xc3\xa9nerg\xc3\xa9tiques r\xc3\xa9centes, la souverainet\xc3\xa9 \xc3\xa9conomique est devenue la priorit\xc3\xa9 absolue des nations et des blocs r\xc3\xa9gionaux.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31146,\"width\":\"608px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/image-30-724x1024.png\" alt=\"\" class=\"wp-image-31146\" style=\"width:608px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>ce sommet va s\xe2\x80\x99articuler autour de trois axes fondamentaux, \xc3\xa0 savoir&nbsp;: la comp\xc3\xa9titivit\xc3\xa9 globale, notamment comment stimuler l'innovation et l'attractivit\xc3\xa9 des march\xc3\xa9s dans un environnement hyper-comp\xc3\xa9titif ? ; la souverainet\xc3\xa9 \xc3\xa9conomique, qui passe par la r\xc3\xa9duction des d\xc3\xa9pendances strat\xc3\xa9giques tout en maintenant des partenariats internationaux solides&nbsp;; et la transformation technologique par l\xe2\x80\x99int\xc3\xa9gration de l'intelligence artificielle et les technologies propres pour garantir une croissance durable.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>les participants devront profiter de ce rendez-vous pour concevoir de nouvelles strat\xc3\xa9gies de relocalisation, de r\xc3\xa9gionalisation et de diversification des sources d'approvisionnement, ceci dans l\xe2\x80\x99optique de <em>\xc2\xab passer d'une logique de flux tendus \xc3\xa0 une logique de r\xc3\xa9silience \xc3\xa9conomique \xc2\xbb.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>a rome, le leader togolais va intervenir sur <em>\xc2\xab&nbsp;les perspectives du partenariat \xc3\xa9conomique entre l\xe2\x80\x99afrique et l\xe2\x80\x99europe, dans un contexte o\xc3\xb9 notre continent en se hissant progressivement parmi les \xc3\xa9conomies \xc3\xa0 croissance les plus rapides au monde, offre un espace strat\xc3\xa9gique pour les investissements, la connectivit\xc3\xa9, la logistique et l\xe2\x80\x99int\xc3\xa9gration r\xc3\xa9gionale&nbsp;\xc2\xbb.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31157,\"width\":\"558px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/18d98b1d-0295-41c7-afab-fc9c13606bd0-724x1024.jpg\" alt=\"\" class=\"wp-image-31157\" style=\"width:558px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>notons que le togo entend pleinement contribuer \xc3\xa0 cette dynamique en valorisant son r\xc3\xb4le de hub logistique et de porte d\xe2\x80\x99entr\xc3\xa9e naturelle vers l\xe2\x80\x99hinterland ouest-africain, au service d\xe2\x80\x99une croissance partag\xc3\xa9e, de corridors plus performants et d\xe2\x80\x99opportunit\xc3\xa9s accrues pour nos populations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>nous y reviendrons&nbsp;!!!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.153.189.18
country_id: 6252001
domain: www.waverain.de
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.waverain.de/settings.json HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:13:13:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7367063&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781788405 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:13:13:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132889&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781788405 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.129.75.86
country_id: 2260494
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/05/Cabo_Verde_2023.jpg 800w, http:/togodailynews.tg/wp-content/uploads/2023/05/Cabo_Verde_2023-300x188.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2023/05/Cabo_Verde_2023-768x480.jpg 768w HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77674285
name: IM360 WAF: Track upload attempt
abuser: 43.173.179.26
country_id: 1880251
domain: togodailynews.tg
description:
IM360 WAF: Track upload attempt||MVN:ARGS:page_title||MV:LES AGENCES DU SYSTEME DES NATIONS UNIES DU BENIN ET DU TOGO EN CONCLAVE A LOME||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.199.83.155
country_id: 6252001
description:
[2026-06-18 13:16:03 +0000] info [cpaneld] 134.199.83.155 - ayhhhyhk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayhhhyhk (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 143.244.52.49
country_id: 798549
description:
143.244.52.49 - - [18/Jun/2026:13:17:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10261351&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DbXRmLmtoaTExQG1lZXphbmJhbmsuY29t&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781788669 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=bXRmLmtoaTExQG1lZXphbmJhbmsuY29t" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:143.244.52.49


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.64.162.224
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1fdc9dce391baa99c2dd8e370212d35b8d7aac6e||Title:fiozdu769mqdo24a||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.64.162.224
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2873e404dadbac6908d85b11dd2b43c5e196299d||Title:tqve82w2x5tgn5||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.64.162.224
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d4226d6ab54812b6dd4c2cd6157c0435945a291b||Title:29vylll03vej7e88h||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.101.217
country_id: 3865483
description:
Jun 18 13:20:46 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.101.217 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.64.162.224
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3bd2357792a56c87159d3b0c0da98116b4b627df||Title:zl5m4f48y5i8l6||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 130.12.182.188
country_id: 3190538
description:
Jun 18 13:23:16 ns5 pure-ftpd[2929608]: (?@130.12.182.188) [INFO] New connection from 130.12.182.188


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.64.162.224
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b831f366c262a4fa1516bbc3b9e6e09e9dbee36b||Title:laensptgrb2tow||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.64.162.224
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:59aa833b228ec578a4d8a6e726faa8b9c61f90fa||Title:kih6dia8wrq9khw2||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:13:24:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9620119&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781789044 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.64.162.224
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0dda218532cd8ee3c823b05d534fec75f66955ba||Title:j4dhg4nwto1fdco||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:13:26:05 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:13:26:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:13:26:09 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:13:26:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.64.162.224
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e6d7d0edde269d04675398d3745e7cef117e30e3||Title:flbz2fby7l96w6l||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.64.162.224
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d0011af606a55d33a27238c4a2e03ec6964c48ce||Title:nvohof66sy3j5atq||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.185.76.213
country_id: 2264397
description:
[2026-06-18 13:27:12 +0000] info [whostmgrd] 89.185.76.213 - ayhhhyhk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.64.162.224
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:450d2a4bf68705991d0836bc76cf90ea742e1a3b||Title:iif7ejqjkaf18kn||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.64.162.224
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fe7a31c7df7c80b5fe9ec3916f635f9390a7c635||Title:gskr32mm75t0n6||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:13:29:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9987221&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781789363 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:13:29:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7392149&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781789363 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.64.162.224
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:03ad5dc3bbdf054ce532925f6bc633ce7d9adcae||Title:poyae1wcy9e4v1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.253.27.219
country_id: 1880251
description:
[2026-06-18 13:30:02 +0000] info [cpaneld] 103.253.27.219 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.64.162.224
country_id: 1269750
domain: c2ie.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:c2ie.c2ie.tg||ServerName:c2ie.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c3b9be89295b3f2cbaa47242abde66b5845fde57||Title:swfyd7jo9cd4kxt||RSV:8.18||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.143.245.114
country_id: 2510769
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:104.143.245.114||TA:104.143.245.114||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.153.189.18
country_id: 6252001
domain: impactfireservices.co
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/impactfireservices.co/.env.example HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 149.102.227.104
country_id: 6252001
domain: dany2.mairie.tg
description:
IM360 WAF: Request body parsing error||err_msg:XML parser error: XML: Failed to parse document.||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.253.27.219
country_id: 1880251
description:
[2026-06-18 13:34:01 +0000] info [cpaneld] 103.253.27.219 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.171.7.207
country_id: 2363686
description:
2026-06-18 13:35:05 dovecot_login authenticator failed for H=(SHESAME) [196.171.7.207]:53052: 535 Incorrect authentication data (set_id=s.mensah@cndh-togo.org)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.153.189.18
country_id: 6252001
domain: www.readmore.id
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.readmore.id/.config.json HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-18 13:36:21 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:42142: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.179.188.22
country_id: 1643084
description:
[2026-06-18 13:36:30 +0000] info [cpaneld] 202.179.188.22 - elmkvzcm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [18/Jun/2026:13:37:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7249099&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781789856 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 202.179.188.22
country_id: 1643084
domain: tdn.tg
description:
IM360 WAF: Track file upload for Infectors||RSV:8.18||T:APACHE||SC:/home/elmkvzcm/public_html/wp-content/td_cache/td_analyze/css/normal.php||User:elmkvzcm||WPU:||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.95.212.63
country_id: 6252001
description:
[2026-06-18 13:39:20 +0000] info [cpaneld] 143.95.212.63 - mesyscom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.153.189.18
country_id: 6252001
domain: agricolservices.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/agricolservices.com/.env.example HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.179.188.22
country_id: 1643084
description:
[2026-06-18 13:40:44 +0000] info [cpaneld] 202.179.188.22 - elmkvzcm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:13:40:51 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:13:40:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:13:40:54 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:13:40:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 44.227.127.2
country_id: 6252001
domain: matosshop.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/142.0.0.0 Safari/537.36||RSV:8.18||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 166.88.110.223
country_id: 298795
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:166.88.110.223||TA:166.88.110.223||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.17.216
country_id: 3175395
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:104.239.17.216||TA:104.239.17.216||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.153.189.18
country_id: 6252001
domain: woo3web.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/woo3web.com/php.php HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:13:42:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13409683&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781790161 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 202.179.188.22
country_id: 1643084
domain: tdn.tg
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:msg||MV:Uncaught SyntaxError: Unexpected token '<'||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.253.27.219
country_id: 1880251
description:
[2026-06-18 13:42:54 +0000] info [cpaneld] 103.253.27.219 - a.kesso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.kesso (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.107.227.141
country_id: 290557
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/aa9c7d HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.93.165
country_id: 6252001
description:
2026-06-18 13:45:06 dovecot_login authenticator failed for H=(IEJBYlx7O) [38.248.93.165]:36102: 535 Incorrect authentication data (set_id=supporthosting@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.93.165
country_id: 6252001
description:
2026-06-18 13:45:28 dovecot_login authenticator failed for H=(NbU7xtvke) [38.248.93.165]:36407: 535 Incorrect authentication data (set_id=supporthosting)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 74.0.103.247
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:13-46.74.0.103.247||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.122
country_id: 1880251
description:
47.128.96.122 - - [18/Jun/2026:13:47:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999254&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffc-barca%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781790472 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/fc-barca/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.122


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.145.229.230
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/8c7e7b HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.199
country_id: 1880251
description:
47.128.96.199 - - [18/Jun/2026:13:48:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6985877&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffemmes-sorcieres%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781790501 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/femmes-sorcieres/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.199


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.255.104.11
country_id: 2589581
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/efedf0 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 164.90.238.217
country_id: 2921044
description:
Jun 18 13:50:32 ns5 pure-ftpd[2949143]: (?@164.90.238.217) [INFO] New connection from 164.90.238.217


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:13:55:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:13:55:20 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:13:55:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:13:55:23 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.140.23.61
country_id: 3703430
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/9b8f86 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:13:58:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999301&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781791127 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.112.199.54
country_id: 2328926
description:
[2026-06-18 13:58:59 +0000] info [cpaneld] 105.112.199.54 - yydrdvav "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:13:58:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9739411&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781791128 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.21.70
country_id: 1562822
description:
2026-06-18 13:58:53 dovecot_login authenticator failed for H=([146.56.225.248]) [27.71.21.70]:6990: 535 Incorrect authentication data (set_id=simtaya@cfpj.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.60.186
country_id: 1819730
description:
2026-06-18 13:59:29 dovecot_login authenticator failed for H=42-200-60-186.static.imsbiz.com ([210.22.149.155]) [42.200.60.186]:54720: 535 Incorrect authentication data (set_id=evendeur@soena.tg)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.124.113.56
country_id: 2750405
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:14-00.89.124.113.56||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.132.150.147
country_id: 298795
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/2066411116 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.129.61.4
country_id: 2623032
description:
2026-06-18 14:02:28 dovecot_plain authenticator failed for H=tor-project-exit4.dotsrc.org (izoz2svehe3q8qlm) [185.129.61.4]:65258: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.177
country_id: 1880251
description:
47.128.96.177 - - [18/Jun/2026:14:02:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723227&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fnovelas-tv%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781791355 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/novelas-tv/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.177


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.194.218.134
country_id: 3017382
description:
[2026-06-18 14:04:24 +0000] info [cpaneld] 185.194.218.134 - whmcsadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user whmcsadmin (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 49.144.67.29
country_id: 1694008
description:
49.144.67.29 - - [18/Jun/2026:14:04:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10054598&pdata=https%253A%252F%252Fwebmail.florian.free.netmaster.tg%252F%253Flocale%253Dpl&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781791447 HTTP/2.0" 302 0 webmail.florian.free.netmaster.tg "https://webmail.florian.free.netmaster.tg/?locale=pl" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:49.144.67.29


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 192.42.116.143
country_id: 2750405
description:
192.42.116.143 - doufelg [18/Jun/2026:14:05:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13277844&pdata=https%253A%252F%252Fsp-eau.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781791553 HTTP/2.0" 302 0 sp-eau.tg "https://sp-eau.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:192.42.116.143


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 38.156.230.125
country_id: 3686110
description:
38.156.230.125 - - [18/Jun/2026:14:06:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9662311&pdata=https%253A%252F%252Ftdn.tg%252Fuemoa-candidatures-bourses-financement-etudes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781791564 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/uemoa-candidatures-bourses-financement-etudes/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.4290.1805 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:38.156.230.125


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.241.64.237
country_id: 1835841
description:
2026-06-18 14:06:24 dovecot_login authenticator failed for H=([112.165.212.135]) [1.241.64.237]:53946: 535 Incorrect authentication data (set_id=dbabima@otr.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 192.42.116.14
country_id: 2750405
description:
192.42.116.14 - doufelg [18/Jun/2026:14:05:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6973334&pdata=https%253A%252F%252Fsp-eau.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781791544 HTTP/2.0" 302 0 sp-eau.tg "https://sp-eau.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:192.42.116.14


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.89.137.55
country_id: 3469034
description:
2026-06-18 14:06:30 dovecot_login authenticator failed for H=(190.89.137.55) [190.89.137.55]:33453: 535 Incorrect authentication data (set_id=basile.dzadu@ekeasarl.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.192.88
country_id: 2363686
description:
[2026-06-18 14:06:31 +0000] info [webmaild] 160.242.192.88 - perception@butodra.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.157.113
country_id: 690791
description:
Jun 18 14:07:18 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.157.113 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.215.127.29
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tag/1555245825 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.92.76.210
country_id: 1694008
description:
Jun 18 14:08:19 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.92.76.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-06-18 14:08:21 dovecot_login authenticator failed for H=([178.178.194.151]) [119.92.76.210]:32922: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.157.113
country_id: 690791
description:
Jun 18 14:07:25 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.157.113 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 171.25.193.37
country_id: 2661886
description:
171.25.193.37 - qfaclpeg [18/Jun/2026:14:07:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13328742&pdata=https%253A%252F%252Fsia-togo.tg%253A2083%252Fexecute%252FDomainInfo%252Fdomains_data&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781791651 HTTP/2.0" 302 0 sia-togo.tg "https://sia-togo.tg:2083/execute/DomainInfo/domains_data" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:171.25.193.37


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.24.141.156
country_id: 1814991
description:
Jun 18 14:08:39 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.24.141.156 has been locked due to Imunify RBL


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 194.61.41.241
country_id: 1694008
domain: jcdconsult.net
description:
IM360 WAF: Block interaction with malicious plugin||RSV:8.18||T:APACHE||SC:/home/tubnyxbt/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/up.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.156
country_id: 1814991
description:
2026-06-18 14:08:41 dovecot_login authenticator failed for H=(bl10-203-209.dsl.telepac.pt) [27.24.141.156]:42216: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: modsec
rule: 77350392
name: IM360 WAF: Interaction with fake plugin
abuser: 194.61.41.241
country_id: 1694008
domain: jcdconsult.net
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/seoplugins/db.php?u||WPU:||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 194.61.41.241
country_id: 1694008
domain: jcdconsult.net
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.18||T:APACHE||MV:/wp-admin/images/bootstrap.php||SC:/home/tubnyxbt/public_html/wp-admin||


plugin: modsec
rule: 77350391
name: IM360 WAF: Interaction with fake plugin
abuser: 194.61.41.241
country_id: 1694008
domain: jcdconsult.net
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/pwnd.php||WPU:||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
description:
[2026-06-18 14:09:27 +0000] info [cpaneld] 185.194.218.134 -  einguval  "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 194.61.41.241
country_id: 1694008
domain: jcdconsult.net
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/tubnyxbt/public_html/wp-includes||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 194.61.41.241
country_id: 1694008
domain: jcdconsult.net
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.18||T:APACHE||MV:/wp-includes/images/smilies/about.php||SC:/home/tubnyxbt/public_html/wp-includes||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.236.172.31
country_id: 798544
description:
Jun 18 14:10:27 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.236.172.31 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.241.25.235
country_id: 798544
description:
Jun 18 14:10:55 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.241.25.235 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:14:12:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:14:12:55 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:14:12:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:14:12:47 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.120.153
country_id: 3865483
description:
Jun 18 14:13:25 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.120.153 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.63.180.197
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/31892612 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:14:15:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9790313&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781792122 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:14:15:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13002858&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781792123 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.95.212.63
country_id: 6252001
description:
[2026-06-18 14:16:56 +0000] info [cpaneld] 143.95.212.63 - mesyscom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscom (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:94416.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:787aabd1f1e78f47f4789f92f1ad1528dfff5d95||Title:0x85d487c9||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.225.195.99
country_id: 3865483
description:
Jun 18 14:17:28 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.225.195.99 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.105.232.125
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/718b40 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.105.2.16
country_id: 719819
description:
Jun 18 14:17:47 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.105.2.16 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:94e3d68e6518a7632fd0beec67654cd9c1147feb||Title:0x398ffb13||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cd25ebf0f64e79183388239e76aa2ca93887f936||Title:0x9e401c76||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:46927e93519508cc5e1d390e9b8b4c018564f211||Title:0x0717a3af||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8cfdd4b75521b9a458bb7ab83c2f8a7609a16b8d||Title:0xa9ebdbab||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c5fdcfce26926b6b36bd68eacf8430c1130fa081||Title:0xfdf2fc60||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6003821ed7c716755440f01623c14e328c8755a6||Title:0xfae75762||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.171.76
country_id: 298795
description:
Jun 18 14:25:20 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.171.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.171.76
country_id: 298795
description:
Jun 18 14:25:26 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.171.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.106.115
country_id: 1814991
description:
2026-06-18 14:25:32 dovecot_login authenticator failed for H=([91.86.88.24]) [111.26.106.115]:56064: 535 Incorrect authentication data (set_id=dbamaze@otr.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.95.212.63
country_id: 6252001
description:
[2026-06-18 14:25:45 +0000] info [cpaneld] 143.95.212.63 - mesyscomcom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesyscomcom (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8bbf375c412595dfaa9d3b1d69cfe49514ba4fed||Title:0x583885fb||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9fbc58dd2f5cb2832a4508d713f7251958cc3dcd||Title:0xbd5a39dc||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.223.88.171
country_id: 2960313
description:
[2026-06-18 14:27:16 +0000] info [webmaild] 92.223.88.171 - test@arcop.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid webmail user nobody (has_cpuser_file failed)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:684c89645838e5f4d8d6ddd75e0f169f4fc0288a||Title:0xe7090d40||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:14:28:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:14:28:47 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:14:28:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cb5305ba7d579a697fe9d2a04f00c6e57d96310f||Title:0xbfa722dc||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:14:28:44 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ac1de9c3cbf9acb7a214551a74fb6077d1b5ce4f||Title:0x38e175ac||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4843786eb7ac95aa638c34a90c60db4bc9da8820||Title:0x8b0535f5||RSV:8.18||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.122.170.10
country_id: 2750405
description:
[2026-06-18 14:32:08 +0000] info [webmaild] 185.122.170.10 - dossa.amoussou@arse.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e4468fc9633ece05e08373e93d7b419c23caf86e||Title:0x879bd0c0||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [18/Jun/2026:14:32:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6910100&pdata=http%253A%252F%252Fwww.centif.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781793167 HTTP/1.1" 302 0 www.centif.tg "http://www.centif.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:df35b4f5b89fceabfe466be55ac0dd61a5bee385||Title:0xfd38eef6||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 148.222.185.74
country_id: 2750405
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:14-34.148.222.185.74||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8e87423ac092bfff2c5a2494f9b5ed07312d498a||Title:0xd099c252||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:14:34:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738344&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781793290 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [18/Jun/2026:14:34:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10064229&pdata=https%253A%252F%252Fwww.centif.tg%252Fstorage%252Fupload%252F1737634221-200px-ECOWAS%25255flogo.svg.webp&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781793297 HTTP/2.0" 302 0 www.centif.tg "https://www.centif.tg/storage/upload/1737634221-200px-ECOWAS%5flogo.svg.webp" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fcf37d25df1c70b8a253ecb9a49000ce8ac899d8||Title:0x1ad7b7af||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:14:34:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10185157&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781793288 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:36:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:59422: 535 Incorrect authentication data (set_id=filetype)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:36:19 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:45390: 535 Incorrect authentication data (set_id=images4)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:36:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:62102: 535 Incorrect authentication data (set_id=antispam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:36:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:4940: 535 Incorrect authentication data (set_id=excellence)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1a226c4c686871f69f7fe36cbf633231437fd3e1||Title:0xbce87e72||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:36:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:48430: 535 Incorrect authentication data (set_id=atlasit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:36:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:14392: 535 Incorrect authentication data (set_id=104)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:36:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:8428: 535 Incorrect authentication data (set_id=images4)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:36:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:55352: 535 Incorrect authentication data (set_id=filetype)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:36:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:19746: 535 Incorrect authentication data (set_id=antispam)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5961b874044484d8772baa2c1ee474004e645210||Title:0x2b780a71||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:36:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:32282: 535 Incorrect authentication data (set_id=lamp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:36:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:61524: 535 Incorrect authentication data (set_id=excellence)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:37:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:2850: 535 Incorrect authentication data (set_id=ecole)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:37:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:14408: 535 Incorrect authentication data (set_id=cptest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:37:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:33910: 535 Incorrect authentication data (set_id=amateur)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:37:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:58486: 535 Incorrect authentication data (set_id=anand)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b750cbb5217be06f2a4ebfe8445ed04049b7410f||Title:0xd0e5130f||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:37:55 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:25242: 535 Incorrect authentication data (set_id=telefonia)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:37:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:60478: 535 Incorrect authentication data (set_id=admin01)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.94.104.249
country_id: 1269750
description:
[2026-06-18 14:38:10 +0000] info [webmaild] 172.94.104.249 - contact@cloud-et-racks.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:38:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:62948: 535 Incorrect authentication data (set_id=carlos)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:38:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:52558: 535 Incorrect authentication data (set_id=spamfilter2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:38:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:1396: 535 Incorrect authentication data (set_id=supplierid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:38:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:43508: 535 Incorrect authentication data (set_id=cindy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:38:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:50448: 535 Incorrect authentication data (set_id=vedono)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.177.53.225
country_id: 1282988
domain: www.derou.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.derou.tg/contact HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:38:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:34930: 535 Incorrect authentication data (set_id=realty)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f193dc34fb085dfa167e76168ee394f8db76c898||Title:0xb8e05666||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:39:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:2496: 535 Incorrect authentication data (set_id=bennett)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:39:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:47932: 535 Incorrect authentication data (set_id=photos6)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:39:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:14454: 535 Incorrect authentication data (set_id=2232)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:aa92e0df8d5f4799d45dbd79876d05b39e114a76||Title:0xacb51b66||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:39:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:30624: 535 Incorrect authentication data (set_id=vw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:39:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:31258: 535 Incorrect authentication data (set_id=ferrara)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:39:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:28816: 535 Incorrect authentication data (set_id=}stadkomma)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:39:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:52804: 535 Incorrect authentication data (set_id=vw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:40:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:3700: 535 Incorrect authentication data (set_id=hw)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.241.25.235
country_id: 798544
description:
Jun 18 14:40:42 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.241.25.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:40:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:43248: 535 Incorrect authentication data (set_id=offer)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:40:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:28814: 535 Incorrect authentication data (set_id=apisecret)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:40:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:65526: 535 Incorrect authentication data (set_id=vdi)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f456dbd2ca817f12231536a15b2019d5f2e73728||Title:0x88a67828||RSV:8.18||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 85.203.46.136
country_id: 2635167
description:
85.203.46.136 - - [18/Jun/2026:14:40:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13210723&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DY3J1ZGUub3BlcmF0aW9uc0ByaWwuY29t&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781793623 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=Y3J1ZGUub3BlcmF0aW9uc0ByaWwuY29t" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:85.203.46.136


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:40:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:24210: 535 Incorrect authentication data (set_id=ot)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:40:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:18058: 535 Incorrect authentication data (set_id=forti)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:41:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:34884: 535 Incorrect authentication data (set_id=aa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:41:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:32532: 535 Incorrect authentication data (set_id=limbo)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.170.20.141
country_id: 2363686
domain: portail.mesyscom.com
description:
IM360 WAF: Possible XSS in arguments||MV:<p><span style=\"color: rgb(0, 0, 0);\">bonjour m. gamal,</span></p><p><span style=\"color: rgb(0, 0, 0);\">veuillez trouver en pi\xc3\xa8ce jointe le devis pour le remplacement de l'alimentation du lecteur entr\xc3\xa9e personnel pour validation.</span></p><p><span style=\"color: rgb(0, 0, 0);\">en attente de votre retour...</span></p><p><span style=\"color: rgb(0, 0, 0);\">bien \xc3\xa0 vous!</span></p><p><br></p>||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:41:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:4604: 535 Incorrect authentication data (set_id=maxine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:41:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:19548: 535 Incorrect authentication data (set_id=other)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7ba5f842c7df0b8df8a39a9114959f5638649d85||Title:0x18ff01b1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:41:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:41034: 535 Incorrect authentication data (set_id=mapr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:41:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:21818: 535 Incorrect authentication data (set_id=*.us)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:42:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:42834: 535 Incorrect authentication data (set_id=cae)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:42:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:36236: 535 Incorrect authentication data (set_id=competitions)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 23.82.99.148
country_id: 6252001
description:
23.82.99.148 - - [18/Jun/2026:14:42:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920394&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DYy5hb3VkZS5jQHJjdS5nb3Yuc2E%253D&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781793762 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=Yy5hb3VkZS5jQHJjdS5nb3Yuc2E=" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:23.82.99.148


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6395aadef6736bc0674e0981e44a2ec7b5b24b3b||Title:0xdb628d7c||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:42:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:65368: 535 Incorrect authentication data (set_id=ucrm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:42:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:11030: 535 Incorrect authentication data (set_id=svt)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 37.63.19.119
country_id: 732800
domain: togomedia24.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:14-42.37.63.19.119||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:42:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:64088: 535 Incorrect authentication data (set_id=domainadmin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:42:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:62510: 535 Incorrect authentication data (set_id=combat)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:42:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:17274: 535 Incorrect authentication data (set_id=cae)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:43:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:61798: 535 Incorrect authentication data (set_id=httpd)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.238.122.158
country_id: 2921044
description:
[2026-06-18 14:43:27 +0000] info [webmaild] 195.238.122.158 - rappels@mesyscom.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:43:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:38726: 535 Incorrect authentication data (set_id=melina)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:43:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:51696: 535 Incorrect authentication data (set_id=u15)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:43:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:12472: 535 Incorrect authentication data (set_id=confluence)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:43:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:37866: 535 Incorrect authentication data (set_id=burn)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.61.130.187
country_id: 6252001
description:
[2026-06-18 14:43:34 +0000] info [cpaneld] 45.61.130.187 - aogodmm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:44:08 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:34188: 535 Incorrect authentication data (set_id=proftpd)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.104.127.134
country_id: 1269750
description:
Jun 18 14:44:18 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.104.127.134 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:830cbd46ccab9882f0baea60674f85b7c1e8cdc2||Title:0x7a97b44c||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:44:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:10522: 535 Incorrect authentication data (set_id=mazari)


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 196.75.130.10
country_id: 2542007
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\r\n  <fault>\r\n    <value>\r\n      <struct>\r\n        <member>\r\n          <name>faultCode</name>\r\n          <value><int>403</int></value>\r\n        </member>\r\n        <member>\r\n          <name>faultString</name>\r\n          <value><string>Identifiant ou mot de passe incorrect.</string></value>\r\n        </member>\r\n      </struct>\r\n    </value>\r\n  </fault>\r\n</methodResponse>\r\n||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:44:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:10812: 535 Incorrect authentication data (set_id=majka)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:44:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:49122: 535 Incorrect authentication data (set_id=ageorge)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:dcddc2f3d0325755d523532c7ea78e22c6583195||Title:0xd9b8a92b||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:44:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:38332: 535 Incorrect authentication data (set_id=aec)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:44:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:2388: 535 Incorrect authentication data (set_id=nakanishi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:44:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:55622: 535 Incorrect authentication data (set_id=whitelist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:45:57 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:44384: 535 Incorrect authentication data (set_id=office1)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:46:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:19500: 535 Incorrect authentication data (set_id=ical)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:45:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:35258: 535 Incorrect authentication data (set_id=projekty)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:45:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:53368: 535 Incorrect authentication data (set_id=aws)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:45:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:5436: 535 Incorrect authentication data (set_id=emeeting)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ebff613ee40234c5364176d3af1a33eb72cff15e||Title:0x328c1625||RSV:8.18||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.8.118.210
country_id: 1269750
description:
Jun 18 14:45:36 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.8.118.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:45:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:51382: 535 Incorrect authentication data (set_id=his)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:45:53 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:31616: 535 Incorrect authentication data (set_id=masco)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:46:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:7630: 535 Incorrect authentication data (set_id=db02)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:46:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:64156: 535 Incorrect authentication data (set_id=gracie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:46:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:31240: 535 Incorrect authentication data (set_id=aftermarket-robotech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:46:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:20520: 535 Incorrect authentication data (set_id=onlinetest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:46:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:7700: 535 Incorrect authentication data (set_id=cpanel)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2463145ea4b64d5710fcd1c639527f9fc4e66fda||Title:0x0486c267||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:46:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:29108: 535 Incorrect authentication data (set_id=earnest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:47:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:44426: 535 Incorrect authentication data (set_id=pc104)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:47:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:14504: 535 Incorrect authentication data (set_id=tata)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 81.65.162.158
country_id: 3017382
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/wp-content/uploads/2019/09/COMMUNIQUE-CCR-AGRI.pdf HTTP/1.1||RSV:8.18||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3ca7ef30fa0f3c750d961466dd7583cf632efd14||Title:0x64444752||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:47:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:45052: 535 Incorrect authentication data (set_id=administration)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:47:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:61210: 535 Incorrect authentication data (set_id=logger)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:47:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:36554: 535 Incorrect authentication data (set_id=ccla)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:47:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:19480: 535 Incorrect authentication data (set_id=milena)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.150.175.94
country_id: 2921044
description:
[2026-06-18 14:47:38 +0000] info [cpaneld] 45.150.175.94 - fgbegmfv "GET /execute/Email/list_pops?api.version=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:48:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:20586: 535 Incorrect authentication data (set_id=teszt123)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 193.34.225.19
country_id: 1527747
domain: snb.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:70166.snb.tg||ServerName:snb.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d2c67854a00dad527190492df5c197d2ddd84dce||Title:0x7116efc2||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:49:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:34702: 535 Incorrect authentication data (set_id=blog)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:48:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:64380: 535 Incorrect authentication data (set_id=asa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:48:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:39048: 535 Incorrect authentication data (set_id=shenyang)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:49:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:13408: 535 Incorrect authentication data (set_id=true)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:48:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:12874: 535 Incorrect authentication data (set_id=veeam)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8c87dfbfe5c8189029f1548b767361aaba3d66e3||Title:0x69601f12||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:48:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:21048: 535 Incorrect authentication data (set_id=agglutinative)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:14:50:05 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:14:50:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.105.122.27
country_id: 2635167
domain: haplucia-togo.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.18||T:APACHE||RA:198.105.122.27||TA:198.105.122.27||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:49:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:62190: 535 Incorrect authentication data (set_id=bil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:49:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:33802: 535 Incorrect authentication data (set_id=tosho)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:49:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:64886: 535 Incorrect authentication data (set_id=proba)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:14:50:07 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:49:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:41884: 535 Incorrect authentication data (set_id=test1234)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e766ee858182ddfaa1aefb8b358d59502749ca8a||Title:0x3a9e8dd8||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:49:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:41448: 535 Incorrect authentication data (set_id=freebsd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:49:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:26490: 535 Incorrect authentication data (set_id=blog)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:14:50:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:50:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:18092: 535 Incorrect authentication data (set_id=john2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:50:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:2514: 535 Incorrect authentication data (set_id=hola)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.76.154.7
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1270438500 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:50:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:63838: 535 Incorrect authentication data (set_id=admision)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:50:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:48308: 535 Incorrect authentication data (set_id=bab)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:50:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:17688: 535 Incorrect authentication data (set_id=telep)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.203.155
country_id: 1269750
domain: selithgroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:xfsmlkmfqxpu.selithgroup.com||ServerName:selithgroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:da61efc799614ce7e3a307feb9790d22355f866f||Title:0xc6a3dd41||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:50:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:52462: 535 Incorrect authentication data (set_id=student11)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.217.229.119
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1267097633 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:51:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:55354: 535 Incorrect authentication data (set_id=zzj)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:51:48 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:39116: 535 Incorrect authentication data (set_id=I've)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:52:18 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:30404: 535 Incorrect authentication data (set_id=duclair)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:51:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:6208: 535 Incorrect authentication data (set_id=s5)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:51:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:28648: 535 Incorrect authentication data (set_id=marek)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:14:51:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6787994&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781794300 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:51:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:8092: 535 Incorrect authentication data (set_id=asif)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.1.212.250
country_id: 2077456
description:
103.1.212.250 - - [18/Jun/2026:14:51:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6973032&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781794301 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.1.212.250


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-18 14:51:31 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:64935: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:51:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:37172: 535 Incorrect authentication data (set_id=koroleva)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.181.163.129
country_id: 6252001
description:
[2026-06-18 14:51:57 +0000] info [webmaild] 195.181.163.129 - sahondo@otr.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:52:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:31600: 535 Incorrect authentication data (set_id=toucan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:53:05 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:22954: 535 Incorrect authentication data (set_id=pannello)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:52:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:15468: 535 Incorrect authentication data (set_id=poopoo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:52:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:44446: 535 Incorrect authentication data (set_id=mktg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:52:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:48934: 535 Incorrect authentication data (set_id=nomura)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:52:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:30694: 535 Incorrect authentication data (set_id=sysopr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:53:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:56244: 535 Incorrect authentication data (set_id=bookworm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:53:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:17464: 535 Incorrect authentication data (set_id=casement)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:53:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:20710: 535 Incorrect authentication data (set_id=test01)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:53:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:63612: 535 Incorrect authentication data (set_id=scan1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:53:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:51632: 535 Incorrect authentication data (set_id=titans)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:54:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:20596: 535 Incorrect authentication data (set_id=quadra)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:54:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:24882: 535 Incorrect authentication data (set_id=pctest)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:14:54:30 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:54:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:41712: 535 Incorrect authentication data (set_id=testvm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:54:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:27722: 535 Incorrect authentication data (set_id=itm)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:14:54:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [18/Jun/2026:14:54:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:54:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:39724: 535 Incorrect authentication data (set_id=temp8)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 203.132.68.28
country_id: 2077456
description:
203.132.68.28 - - [18/Jun/2026:14:54:36 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:203.132.68.28


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:54:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:23286: 535 Incorrect authentication data (set_id=nagios)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:54:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:16862: 535 Incorrect authentication data (set_id=verizon)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:55:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:13780: 535 Incorrect authentication data (set_id=walter)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.24.105
country_id: 6252001
description:
47.251.24.105 - - [18/Jun/2026:14:55:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9673065&pdata=https%253A%252F%252Fcafe.tg%253A2096%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781794543 HTTP/2.0" 302 0 cafe.tg "https://cafe.tg:2096/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.24.105


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:55:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:2658: 535 Incorrect authentication data (set_id=racing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:55:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:65516: 535 Incorrect authentication data (set_id=cakes)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.79.205
country_id: 6252001
description:
47.251.79.205 - - [18/Jun/2026:14:55:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13134235&pdata=https%253A%252F%252Fcfmi.tg%253A2096%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781794544 HTTP/2.0" 302 0 cfmi.tg "https://cfmi.tg:2096/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.79.205


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:55:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:57666: 535 Incorrect authentication data (set_id=energia)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:55:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:4032: 535 Incorrect authentication data (set_id=pc4)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.216.189
country_id: 6252001
description:
47.77.216.189 - - [18/Jun/2026:14:55:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000485&pdata=https%253A%252F%252Fns5mail.netmaster.tg%253A2096%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781794550 HTTP/2.0" 302 0 ns5mail.netmaster.tg "https://ns5mail.netmaster.tg:2096/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.77.216.189


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.109.103.118
country_id: 1819730
description:
[2026-06-18 14:56:17 +0000] info [webmaild] 103.109.103.118 - support@mesyscom.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 91.210.248.232
country_id: 690791
domain: sotranetogo.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:34546.sotranetogo.com||ServerName:sotranetogo.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:729ec6728242d1b9ce56bdf925c306d9408c2859||Title:0xcbf355f0||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:55:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:15784: 535 Incorrect authentication data (set_id=shenyang)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:55:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:9914: 535 Incorrect authentication data (set_id=racing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:56:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:26262: 535 Incorrect authentication data (set_id=berenisthebest.qualitylearning.registry.dev)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.16.206.69
country_id: 953987
description:
[2026-06-18 14:56:59 +0000] info [webmaild] 154.16.206.69 - ptitrikou@mesyscom.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.216.189
country_id: 6252001
description:
47.77.216.189 - - [18/Jun/2026:14:56:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9924044&pdata=https%253A%252F%252Fns5.netmaster.tg%253A2096%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781794581 HTTP/2.0" 302 0 ns5.netmaster.tg "https://ns5.netmaster.tg:2096/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.77.216.189


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:56:48 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:34112: 535 Incorrect authentication data (set_id=roki)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:56:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:40790: 535 Incorrect authentication data (set_id=sandeep)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:56:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:58756: 535 Incorrect authentication data (set_id=servicos)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:56:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:17620: 535 Incorrect authentication data (set_id=chu-tin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:56:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:32460: 535 Incorrect authentication data (set_id=orion)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:57:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:63134: 535 Incorrect authentication data (set_id=name1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:57:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:58202: 535 Incorrect authentication data (set_id=dan2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:57:48 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:8484: 535 Incorrect authentication data (set_id=monica)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:57:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:10046: 535 Incorrect authentication data (set_id=1234567891)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:57:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:35144: 535 Incorrect authentication data (set_id=mailadmin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:57:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:61616: 535 Incorrect authentication data (set_id=allusers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-18 14:58:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:33544: 535 Incorrect authentication data (set_id=mg1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:58:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:34380: 535 Incorrect authentication data (set_id=vpn1)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.155
country_id: 1880251
description:
47.128.96.155 - - [18/Jun/2026:14:58:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050601&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsenegal%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781794713 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/senegal/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.155


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:58:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:27682: 535 Incorrect authentication data (set_id=fle)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:58:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:6254: 535 Incorrect authentication data (set_id=vpn1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-18 14:58:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:42902: 535 Incorrect authentication data (set_id=hebe)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:58:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:37822: 535 Incorrect authentication data (set_id=jaya)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:58:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:49110: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.147.41
country_id: 1819730
description:
Jun 18 14:58:41 ns5 auth[2902507]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.147.41 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.81.124.84
country_id: 6252001
description:
[2026-06-18 14:59:11 +0000] info [cpaneld] 185.81.124.84 - test "GET /execute/Email/list_pops?api.version=1 HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-18 14:59:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:36226: 535 Incorrect authentication data (set_id=rotor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-18 14:59:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:62182: 535 Incorrect authentication data (set_id=globalflash)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-18 14:59:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:60506: 535 Incorrect authentication data (set_id=arpwatch)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.137.228.169
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/887c77 HTTP/1.1||RSV:8.18||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-18 14:59:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:9904: 535 Incorrect authentication data (set_id=apt)


