# incident

plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.125.240.8
country_id: 1733045
description:
[2026-06-16 09:06:09 +0000] info [cpaneld] 27.125.240.8 - audi "GET /login/?login_only=1&user=audi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user audi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.6.3.222
country_id: 3932488
description:
[2026-06-16 09:05:34 +0000] info [cpaneld] 179.6.3.222 - auditeccand "GET /login/?login_only=1&user=auditeccand&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user auditeccand (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.4.129.31
country_id: 3865483
description:
[2026-06-16 09:05:59 +0000] info [cpaneld] 181.4.129.31 - audite "GET /login/?login_only=1&user=audite&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user audite (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.53.211.82
country_id: 6252001
description:
[2026-06-16 09:06:03 +0000] info [cpaneld] 50.53.211.82 - audit "GET /login/?login_only=1&user=audit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user audit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.125.240.180
country_id: 1733045
description:
[2026-06-16 09:05:23 +0000] info [cpaneld] 27.125.240.180 - auditeccandcocom "GET /login/?login_only=1&user=auditeccandcocom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user auditeccandcocom (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.163.72.87
country_id: 690791
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2020/07/IMG_20200706_084820-1024x768.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2020/07/IMG_20200706_084820-300x225.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2020/07/IMG_20200706_084820-768x576.jpg 768w HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.209.175.178
country_id: 953987
description:
[2026-06-16 09:05:40 +0000] info [cpaneld] 105.209.175.178 - auditeccan "GET /login/?login_only=1&user=auditeccan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user auditeccan (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.102.210.3
country_id: 6254930
description:
[2026-06-16 09:05:44 +0000] info [cpaneld] 82.102.210.3 - auditecca "GET /login/?login_only=1&user=auditecca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user auditecca (has_cpuser_file failed)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 193.151.190.194
country_id: 6252001
domain: 24heureinfo.tg
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS_NAMES:gt;If you beloved this article so you would like to obtain more info regarding ||MV:gt;If you beloved this article so you would like to obtain more info regarding ||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.75.222.32
country_id: 3077311
description:
Jun 16 09:07:12 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.75.222.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.75.222.32
country_id: 3077311
description:
Jun 16 09:07:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.75.222.32 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.173.81.93
country_id: 2017370
description:
[2026-06-16 09:09:11 +0000] info [cpaneld] 31.173.81.93 - besteva1 "GET /login/?login_only=1&user=besteva1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user besteva1 (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.147.15.250
country_id: 2635167
description:
Jun 16 09:09:12 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.147.15.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.147.15.250
country_id: 2635167
description:
2026-06-16 09:09:14 dovecot_login authenticator failed for H=([125.143.209.68]) [95.147.15.250]:57635: 535 Incorrect authentication data (set_id=admin@cafe.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 125.167.153.130
country_id: 1643084
description:
[2026-06-16 09:09:18 +0000] info [cpaneld] 125.167.153.130 - besteva1com "GET /login/?login_only=1&user=besteva1com&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user besteva1com (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.25.18.203
country_id: 3932488
description:
[2026-06-16 09:09:28 +0000] info [cpaneld] 38.25.18.203 - beste "GET /login/?login_only=1&user=beste&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user beste (has_cpuser_file failed)


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 64.44.62.169
country_id: 6252001
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.666046144740284.php||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 93.198.56.123
country_id: 2921044
description:
[2026-06-16 09:10:28 +0000] info [cpaneld] 93.198.56.123 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.25.28.89
country_id: 3932488
description:
[2026-06-16 09:10:31 +0000] info [cpaneld] 38.25.28.89 - kfauto "GET /login/?login_only=1&user=kfauto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kfauto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.253.218.163
country_id: 102358
description:
[2026-06-16 09:10:34 +0000] info [cpaneld] 51.253.218.163 - kfautotg "GET /login/?login_only=1&user=kfautotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kfautotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.192.212.236
country_id: 1733045
description:
[2026-06-16 09:10:41 +0000] info [cpaneld] 14.192.212.236 - kfau "GET /login/?login_only=1&user=kfau&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kfau (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.191.218.35
country_id: 3624060
description:
[2026-06-16 09:10:48 +0000] info [cpaneld] 201.191.218.35 - kf "GET /login/?login_only=1&user=kf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.222.108.184
country_id: 2017370
description:
[2026-06-16 09:10:44 +0000] info [cpaneld] 77.222.108.184 - kfa "GET /login/?login_only=1&user=kfa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kfa (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.208
country_id: 2635167
description:
[2026-06-16 09:11:09 +0000] info [cpaneld] 5.230.153.208 NEW ifxmoxbf:rTlOjktHUuso2v_I address=5.230.153.208,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.175.5.35
country_id: 6252001
description:
[2026-06-16 09:11:12 +0000] info [cpaneld] 107.175.5.35 NEW ifxmoxbf:AKCSROHWCVICMtji address=107.175.5.35,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 84.233.216.247
country_id: 2921044
description:
84.233.216.247 - - [16/Jun/2026:09:12:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7326356&pdata=https%253A%252F%252Fwww.snbt-togo.snb.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781601137 HTTP/2.0" 302 0 www.snbt-togo.snb.tg "https://www.snbt-togo.snb.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:84.233.216.247


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 83.45.156.122
country_id: 2510769
description:
83.45.156.122 - - [16/Jun/2026:09:13:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9793990&pdata=https%253A%252F%252F24heureinfo.tg%252Fafrique%252Fcote-divoire-alassane-ouattara-preside-le-premier-conseil-des-ministres-du-gouvernement-2026%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781601185 HTTP/2.0" 302 0 24heureinfo.tg "https://24heureinfo.tg/afrique/cote-divoire-alassane-ouattara-preside-le-premier-conseil-des-ministres-du-gouvernement-2026/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.1827.1691 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:83.45.156.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.122.162
country_id: 2363686
description:
2026-06-16 09:12:28 dovecot_plain authenticator failed for H=([10.10.30.98]) [196.170.122.162]:44676: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.241
country_id: 130758
description:
Jun 16 09:13:41 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.241
country_id: 130758
description:
2026-06-16 09:13:43 dovecot_login authenticator failed for H=(localhost) [62.60.130.241]:60159: 535 Incorrect authentication data (set_id=test1)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.221.172.61
country_id: 3686110
description:
[2026-06-16 09:16:20 +0000] info [cpaneld] 201.221.172.61 - lesnidsurb "GET /login/?login_only=1&user=lesnidsurb&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lesnidsurb (has_cpuser_file failed)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:09:16:15 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.90
country_id: 2077456
description:
103.108.92.90 - - [16/Jun/2026:09:16:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.90


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.183.214.168
country_id: 3625428
description:
[2026-06-16 09:15:53 +0000] info [cpaneld] 38.183.214.168 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.230.65.143
country_id: 1562822
description:
[2026-06-16 09:16:09 +0000] info [cpaneld] 14.230.65.143 - lesnidsurbain "GET /login/?login_only=1&user=lesnidsurbain&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lesnidsurbain (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:09:16:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.90
country_id: 2077456
description:
103.108.92.90 - - [16/Jun/2026:09:16:18 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.90


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 16 09:16:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 16 09:16:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 110.137.39.120
country_id: 1643084
description:
[2026-06-16 09:16:25 +0000] info [cpaneld] 110.137.39.120 - lesnidsur "GET /login/?login_only=1&user=lesnidsur&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lesnidsur (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 16 09:16:30 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-16 09:16:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:46672: 535 Incorrect authentication data (set_id=bac@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.85.12.184
country_id: 3865483
description:
[2026-06-16 09:16:38 +0000] info [cpaneld] 191.85.12.184 - lesni "GET /login/?login_only=1&user=lesni&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lesni (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-16 09:16:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:18998: 535 Incorrect authentication data (set_id=leys@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-16 09:16:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:49542: 535 Incorrect authentication data (set_id=mbs@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.107.197.172
country_id: 290557
description:
[2026-06-16 09:16:51 +0000] info [cpaneld] 5.107.197.172 - le "GET /login/?login_only=1&user=le&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user le (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 16 09:17:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-16 09:17:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:10612: 535 Incorrect authentication data (set_id=naiad@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-16 09:17:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:40964: 535 Incorrect authentication data (set_id=somebody'll@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.25.171.117
country_id: 6252001
description:
2026-06-16 09:17:27 dovecot_plain authenticator failed for H=(hfrdpmax5h3gab6exd1) [137.25.171.117]:43084: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 16 09:17:36 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-16 09:17:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:38146: 535 Incorrect authentication data (set_id=blackberry@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 16 09:17:56 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.91.38.132
country_id: 6252001
description:
[2026-06-16 09:18:14 +0000] info [whostmgrd] 168.91.38.132 - netmastersarl "POST /login?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 16 09:18:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 16 09:18:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-16 09:18:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:14788: 535 Incorrect authentication data (set_id=faxin@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-16 09:18:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:62444: 535 Incorrect authentication data (set_id=c12@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-16 09:18:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:1034: 535 Incorrect authentication data (set_id=prospero@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.90
country_id: 2077456
description:
103.108.92.90 - - [16/Jun/2026:09:18:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10012563&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781601528 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.90


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [16/Jun/2026:09:18:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9947038&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781601530 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 16 09:18:29 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-16 09:18:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:2268: 535 Incorrect authentication data (set_id=prospero@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:09:18:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6527893&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781601527 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.36.62
country_id: 1269750
description:
Jun 16 09:18:50 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.36.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6070
name: Attempt to upload malware through cPanel file manager
description:
Jun 16 09:20:17 ns5.netmaster.tg cpanel_fileman_hook[816368]: 0 BAILOUT malware detected when save 'index.html' in /home/glfmqhlj/public_html/1323-2 for user glfmqhlj


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 16 09:19:28 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-16 09:19:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:12158: 535 Incorrect authentication data (set_id=vaio@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-16 09:19:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:49094: 535 Incorrect authentication data (set_id=eagle@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-16 09:19:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:58468: 535 Incorrect authentication data (set_id=temporaire@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 16 09:19:20 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 16 09:19:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.247.75.12
country_id: 6252001
description:
[2026-06-16 09:20:08 +0000] info [whostmgrd] 104.247.75.12 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 16 09:20:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 16 09:20:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-16 09:20:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:3718: 535 Incorrect authentication data (set_id=artola@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 16 09:20:34 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-16 09:20:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:50096: 535 Incorrect authentication data (set_id=secure@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-16 09:20:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:40544: 535 Incorrect authentication data (set_id=spare@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-16 09:20:55 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:64064: 535 Incorrect authentication data (set_id=leveraged@ns5.netmaster.tg)


plugin: ossec
rule: 6070
name: Attempt to upload malware through cPanel file manager
description:
Jun 16 09:21:22 ns5.netmaster.tg cpanel_fileman_hook[817126]: 0 BAILOUT malware detected when save 'index.html' in /home/glfmqhlj/public_html/1323-2 for user glfmqhlj


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 16 09:21:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-16 09:21:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:59796: 535 Incorrect authentication data (set_id=impact@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-16 09:21:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:31984: 535 Incorrect authentication data (set_id=iran@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 16 09:21:38 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.175.5.140
country_id: 6252001
description:
[2026-06-16 09:22:18 +0000] info [cpaneld] 107.175.5.140 NEW wcnyaruu:tOXpFCWWOnPve8N9 address=107.175.5.140,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 16 09:21:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-16 09:21:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:41794: 535 Incorrect authentication data (set_id=ltx@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-16 09:23:10 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:24544: 535 Incorrect authentication data (set_id=hudson@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 16 09:22:30 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-16 09:22:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:23496: 535 Incorrect authentication data (set_id=prestige@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-16 09:22:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:51334: 535 Incorrect authentication data (set_id=khan@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-16 09:22:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:33486: 535 Incorrect authentication data (set_id=bliss@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 16 09:22:29 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 16 09:22:41 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 16 09:23:29 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-16 09:23:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:14958: 535 Incorrect authentication data (set_id=mp3@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 16 09:23:41 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-16 09:23:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:63358: 535 Incorrect authentication data (set_id=about@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 16 09:23:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-16 09:23:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:55994: 535 Incorrect authentication data (set_id=mailbox2@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 16 09:24:21 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 16 09:24:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-16 09:24:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:55060: 535 Incorrect authentication data (set_id=host@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-16 09:24:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:47462: 535 Incorrect authentication data (set_id=sa2@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-16 09:25:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:11458: 535 Incorrect authentication data (set_id=hunk@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-16 09:24:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:33596: 535 Incorrect authentication data (set_id=wuxianfu@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 16 09:24:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 187.251.249.145
country_id: 3996063
description:
187.251.249.145 - - [16/Jun/2026:09:26:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988763&pdata=https%253A%252F%252Ftogodailynews.tg%252Fdanyi-pour-danyi-officiellement-lancee%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781601965 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/danyi-pour-danyi-officiellement-lancee/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.3194.1058 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:187.251.249.145


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.144
country_id: 130758
description:
Jun 16 09:25:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 16 09:25:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-16 09:25:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:24992: 535 Incorrect authentication data (set_id=telnet@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 16 09:25:27 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-16 09:25:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:46784: 535 Incorrect authentication data (set_id=cirrus@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-16 09:25:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:38968: 535 Incorrect authentication data (set_id=loans@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-16 09:26:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:3140: 535 Incorrect authentication data (set_id=printer2@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-16 09:26:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:16316: 535 Incorrect authentication data (set_id=1002@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 16 09:26:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.234.222.12
country_id: 3658394
description:
[2026-06-16 09:27:07 +0000] info [cpaneld] 177.234.222.12 - matosshop "GET /login/?login_only=1&user=matosshop&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matosshop (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.35.246.131
country_id: 3996063
description:
[2026-06-16 09:27:18 +0000] info [cpaneld] 38.35.246.131 - matossh "GET /login/?login_only=1&user=matossh&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matossh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.26.100.214
country_id: 3469034
description:
[2026-06-16 09:27:20 +0000] info [cpaneld] 186.26.100.214 - matossho "GET /login/?login_only=1&user=matossho&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matossho (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-16 09:26:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:30290: 535 Incorrect authentication data (set_id=adell@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 39.34.146.7
country_id: 1168579
description:
[2026-06-16 09:27:37 +0000] info [cpaneld] 39.34.146.7 - mato "GET /login/?login_only=1&user=mato&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mato (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.112.217.90
country_id: 3658394
description:
[2026-06-16 09:28:10 +0000] info [cpaneld] 200.112.217.90 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.47.132.71
country_id: 1643084
description:
[2026-06-16 09:28:14 +0000] info [cpaneld] 103.47.132.71 - festics "GET /login/?login_only=1&user=festics&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user festics (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.190.105.139
country_id: 2017370
description:
[2026-06-16 09:28:20 +0000] info [cpaneld] 95.190.105.139 - festic "GET /login/?login_only=1&user=festic&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user festic (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.8.32.177
country_id: 3895114
description:
[2026-06-16 09:27:30 +0000] info [cpaneld] 179.8.32.177 - mato "GET /login/?login_only=1&user=mato&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mato (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.153.9.57
country_id: 3017382
description:
[2026-06-16 09:27:38 +0000] info [cpaneld] 77.153.9.57 - ma "GET /login/?login_only=1&user=ma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ma (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 16 09:27:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-16 09:27:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:60438: 535 Incorrect authentication data (set_id=desarrollo@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-16 09:27:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:54674: 535 Incorrect authentication data (set_id=dx@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.239.151.94
country_id: 3996063
description:
[2026-06-16 09:27:28 +0000] info [cpaneld] 170.239.151.94 - matoss "GET /login/?login_only=1&user=matoss&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matoss (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.54.80.226
country_id: 1512440
description:
[2026-06-16 09:27:42 +0000] info [cpaneld] 84.54.80.226 - mat "GET /login/?login_only=1&user=mat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mat (has_cpuser_file failed)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-16 09:27:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:8602: 535 Incorrect authentication data (set_id=signal@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-16 09:27:59 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:39742: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.51.99.38
country_id: 2017370
description:
[2026-06-16 09:28:17 +0000] info [cpaneld] 77.51.99.38 - festicstg "GET /login/?login_only=1&user=festicstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user festicstg (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-16 09:27:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:54540: 535 Incorrect authentication data (set_id=lyle@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.151.163.7
country_id: 690791
description:
[2026-06-16 09:27:25 +0000] info [cpaneld] 178.151.163.7 - matos "GET /login/?login_only=1&user=matos&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matos (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-16 09:28:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:52076: 535 Incorrect authentication data (set_id=007@ns5.netmaster.tg)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:09:28:53 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 16 09:28:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.57.52.220
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-includes/js/heartbeat.min.js?ver=6.9.4 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-16 09:28:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:63888: 535 Incorrect authentication data (set_id=syl@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.122.162
country_id: 2363686
description:
2026-06-16 09:29:04 dovecot_plain authenticator failed for H=([10.10.30.98]) [196.170.122.162]:44848: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-16 09:28:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:46082: 535 Incorrect authentication data (set_id=service@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.57.40.180
country_id: 290557
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/wp-content/plugins/rocket-lazy-load/assets/js/16.1/lazyload.min.js HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:09:28:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.90
country_id: 2077456
description:
103.108.92.90 - - [16/Jun/2026:09:28:54 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.90


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.143.143.150
country_id: 2542007
description:
[2026-06-16 09:28:23 +0000] info [cpaneld] 41.143.143.150 - festi "GET /login/?login_only=1&user=festi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user festi (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.90
country_id: 2077456
description:
103.108.92.90 - - [16/Jun/2026:09:28:53 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.90


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.95.26
country_id: 690791
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&ping=1&siteId=1&rec=1&rand=476457&h=17&m=28&s=42&url=http:/togodailynews.tg/diplomatie-le-premier-ambassadeur-du-kazakhstan-au-togo-a-pris-fonction/&uid=0&pid=16547&visitorId=82eae2ef0a569596&fvts=1781602108&vc=1&idn=0&refts=0&lvts=1781602108&fullRef=undefined&send_image=1&cookie=1&res=375x812&gtms=6364&pvId=BxYZOi&browser=Chrome_49&os=iOS_11.0.0&device=Mobile HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.201.254.152
country_id: 99237
description:
[2026-06-16 09:28:27 +0000] info [cpaneld] 62.201.254.152 - fest "GET /login/?login_only=1&user=fest&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fest (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.241.248.131
country_id: 2658434
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&ping=1&siteId=1&rec=1&rand=359916&h=17&m=28&s=57&url=http:/togodailynews.tg/diplomatie-le-premier-ambassadeur-du-kazakhstan-au-togo-a-pris-fonction/&uid=0&pid=16547&visitorId=82eae2ef0a569596&fvts=1781602108&vc=1&idn=0&refts=0&lvts=1781602108&fullRef=undefined&send_image=1&cookie=1&res=375x812&gtms=6364&pvId=BxYZOi&browser=Chrome_49&os=iOS_11.0.0&device=Mobile HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-16 09:29:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:42616: 535 Incorrect authentication data (set_id=cordova@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-16 09:29:56 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:33318: 535 Incorrect authentication data (set_id=us-east-1@ns5.netmaster.tg)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.165.143
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>le processus de d\xc3\xa9centralisation franchit une nouvelle \xc3\xa9tape cruciale au togo. l\xe2\x80\x99ex\xc3\xa9cutif togolais a officiellement lanc\xc3\xa9, le mardi 9 juin dernier, le projet \xc2\xab gnozou \xc2\xbb. dot\xc3\xa9 d\xe2\x80\x99une enveloppe financi\xc3\xa8re de pr\xc3\xa8s de cinq (05) milliards de fcfa, ce programme d\xe2\x80\x99envergure vise \xc3\xa0 transformer la gouvernance locale et \xc3\xa0 dynamiser l'\xc3\xa9conomie des territoires \xc3\xa0 la base.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\xc2\xab gnozou \xc2\xbb, \xe2\x80\x98\xe2\x80\x99d\xc3\xa9veloppement\xe2\x80\x99\xe2\x80\x99, en langue kaby\xc3\xa8, nom traduit en effet l'ambition du gouvernement togolais, qui n\xe2\x80\x99est autre que d\xe2\x80\x99insuffler une nouvelle dynamique de d\xc3\xa9veloppement territorial.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>le projet a pour mission principale de renforcer les comp\xc3\xa9tences et les capacit\xc3\xa9s des acteurs territoriaux (\xc3\xa9lus locaux, agents communaux, soci\xc3\xa9t\xc3\xa9 civile). l'objectif est de leur donner les outils n\xc3\xa9cessaires pour mieux valoriser les immenses potentialit\xc3\xa9s sociales et \xc3\xa9conomiques de leurs localit\xc3\xa9s respectives.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31146,\"width\":\"608px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/image-30-724x1024.png\" alt=\"\" class=\"wp-image-31146\" style=\"width:608px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>pour sa phase de mise en \xc5\x93uvre, le projet gnozou se concentre strat\xc3\xa9giquement sur le nord du pays, une zone cl\xc3\xa9 pour l'inclusion socio-\xc3\xa9conomique. il s\xe2\x80\x99agit des r\xc3\xa9gions de la kara et des savanes pour un budget global de 4,85 milliards de fcfa, environ 7,4 millions d\xe2\x80\x99euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ce financement devra permettre de d\xc3\xa9ployer des infrastructures, des formations et des outils de gestion moderne au sein des diff\xc3\xa9rentes communes des deux r\xc3\xa9gions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>pour garantir un impact r\xc3\xa9el sur les conditions de vie des populations \xc3\xa0 la base, quatre axes majeurs sont vis\xc3\xa9s par ledit projet.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>primo, l'am\xc3\xa9lioration de la planification locale. il sera question d\xe2\x80\x99aider les communes \xc3\xa0 concevoir des plans de d\xc3\xa9veloppement communaux (pdc) r\xc3\xa9alistes et ambitieux.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>secondo, la gestion des comp\xc3\xa9tences transf\xc3\xa9r\xc3\xa9e. il s\xe2\x80\x99agit d\xe2\x80\x99accompagner les collectivit\xc3\xa9s territoriales dans l'exercice de leurs nouvelles pr\xc3\xa9rogatives accord\xc3\xa9es par l'\xc3\x89tat central.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>tertio, le d\xc3\xa9veloppement \xc3\xa9conomique local, qui entendcr\xc3\xa9er des opportunit\xc3\xa9s d'affaires et stimuler les investissements dans les territoires.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>quarto, la transparence et la redevabilit\xc3\xa9 \xc3\xa0 travers la promotion d\xe2\x80\x99une culture de bonne gouvernance o\xc3\xb9 la participation citoyenne est au c\xc5\x93ur des d\xc3\xa9cisions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\xc2\xab ce projet ouvre une nouvelle phase o\xc3\xb9 les acquis institutionnels doivent produire des r\xc3\xa9sultats tangibles au profit des populations \xc2\xbb,</em> a insist\xc3\xa9 koamy gomado, ministre en charge du d\xc3\xa9veloppement local.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31156,\"width\":\"580px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/cf280d22-5566-4950-b6b8-986b4a8db8fc-724x1024.jpg\" alt=\"\" class=\"wp-image-31156\" style=\"width:580px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>notons que le lancement du projet gnozou n'est pas un fait isol\xc3\xa9. il s'inscrit dans la droite ligne avec la mise en \xc5\x93uvre progressive de la politique nationale de d\xc3\xa9centralisation (pona 2025-2034) du togo.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>cette feuille de route d\xc3\xa9cennale constitue le cadre de r\xc3\xa9f\xc3\xa9rence pour renforcer l\xe2\x80\x99autonomie financi\xc3\xa8re et administrative des collectivit\xc3\xa9s territoriales. en misant sur une d\xc3\xa9centralisation plus participative, inclusive et performante, le togo pose les fondations d'une croissance \xc3\xa9conomique qui ne laisse aucune communaut\xc3\xa9 de c\xc3\xb4t\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>la r\xc3\xa9daction</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 16 09:29:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-16 09:29:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:37602: 535 Incorrect authentication data (set_id=certificados@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-16 09:29:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:37606: 535 Incorrect authentication data (set_id=tes@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.92.8.241
country_id: 3895114
domain: togodailynews.tg:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg:80/?wmcAction=wmcTrack&action_name=Diplomatie : Le premier ambassadeur du Kazakhstan au Togo a pris fonction | TOGODAILYNEWS&siteId=1&rec=1&rand=999925&h=17&m=28&s=27&url=http:/togodailynews.tg/diplomatie-le-premier-ambassadeur-du-kazakhstan-au-togo-a-pris-fonction/&uid=0&pid=16547&visitorId=82eae2ef0a569596&fvts=1781602108&vc=1&idn=0&refts=0&lvts=1781602108&fullRef=undefined&send_image=1&cookie=1&res=375x812&gtms=6364&pvId=BxYZOi&browser=Chrome_49&os=iOS_11.0.0&device=Mobile HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.104.243.234
country_id: 3895114
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/20.jpeg HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-16 09:30:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:51960: 535 Incorrect authentication data (set_id=technologie@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-16 09:30:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:35580: 535 Incorrect authentication data (set_id=saba@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-16 09:30:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:23726: 535 Incorrect authentication data (set_id=narita@ns5.netmaster.tg)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.178.40.4
country_id: 2750405
domain: togodailynews.tg
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/145.0.0.0 Safari/537.36||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 16 09:30:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-16 09:31:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:14986: 535 Incorrect authentication data (set_id=felixmattick@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-16 09:31:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:26106: 535 Incorrect authentication data (set_id=building@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-16 09:32:15 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:21956: 535 Incorrect authentication data (set_id=phpmyadmin@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 16 09:31:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-16 09:31:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:43376: 535 Incorrect authentication data (set_id=bianca@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-16 09:32:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:19116: 535 Incorrect authentication data (set_id=arsenal@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 16 09:32:28 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-16 09:32:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:34734: 535 Incorrect authentication data (set_id=loredana@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-16 09:32:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:11822: 535 Incorrect authentication data (set_id=innovacion@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.155.137.17
country_id: 3469034
description:
[2026-06-16 09:33:44 +0000] info [cpaneld] 177.155.137.17 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [16/Jun/2026:09:33:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13278878&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781602436 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-16 09:33:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:39270: 535 Incorrect authentication data (set_id=taurus@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 46.161.50.108
country_id: 2017370
description:
46.161.50.108 - - [16/Jun/2026:09:33:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6986349&pdata=https%253A%252F%252F154.70.82.246&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781602409 HTTP/2.0" 302 0 154.70.82.246 "https://154.70.82.246/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:46.161.50.108


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.108.92.90
country_id: 2077456
description:
103.108.92.90 - - [16/Jun/2026:09:33:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9988754&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781602433 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.90


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.224.6.205
country_id: 99237
description:
[2026-06-16 09:33:54 +0000] info [cpaneld] 169.224.6.205 - tp "GET /login/?login_only=1&user=tp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tp (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 16 09:33:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.15.212.150
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/HTML/BODY/DIV[@id='page']/*[1][self::DIV]/*[9][self::MAIN]/*[1][self::DIV]/*[1][self::DIV]/*[1][self::ARTICLE]/*[3][self::DIV]/*[19][self::FIGURE]/*[1][self::IMG] HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.49
country_id: 3077311
description:
212.102.39.49 - - [16/Jun/2026:09:33:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10185369&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781602434 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.49


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-16 09:33:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:32682: 535 Incorrect authentication data (set_id=par@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-16 09:33:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:25224: 535 Incorrect authentication data (set_id=yardly@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-16 09:34:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:17544: 535 Incorrect authentication data (set_id=milda@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-16 09:34:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:5460: 535 Incorrect authentication data (set_id=clasic@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 16 09:34:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-16 09:34:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:16578: 535 Incorrect authentication data (set_id=brad@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.109.82.132
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/Grands-Lacs-Lome-consolide-la-centralite-de-la-mediation-africaine-248x300.webp 248w, http:/togodailynews.tg/wp-content/uploads/2026/06/Grands-Lacs-Lome-consolide-la-centralite-de-la-mediation-africaine-845x1024.webp 845w, http:/togodailynews.tg/wp-content/uploads/2026/06/Grands-Lacs-Lome-consolide-la-centralite-de-la-mediation-africaine-768x931.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/Grands-Lacs-Lome-consolide-la-centralite-de-la-mediation-africaine.webp 891w HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.192.170.9
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/2147435933 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-16 09:34:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:30640: 535 Incorrect authentication data (set_id=milda@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-16 09:35:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:8080: 535 Incorrect authentication data (set_id=pinhead@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.90.137.132
country_id: 192950
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1061172264 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 09:36:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:13574: 535 Incorrect authentication data (set_id=etienne@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 09:36:19 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.134.2.72
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/Thierno-Habib-Hann-PDG-de-ShafDB-sadresse-aux-medias-apres-avoir-devoile-la-nouvelle-identite-visuelle-de-la-banque-768x512.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/Thierno-Habib-Hann-PDG-de-ShafDB-sadresse-aux-medias-apres-avoir-devoile-la-nouvelle-identite-visuelle-de-la-banque-300x200.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/Thierno-Habib-Hann-PDG-de-ShafDB-sadresse-aux-medias-apres-avoir-devoile-la-nouvelle-identite-visuelle-de-la-banque-1024x683.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/06/Thierno-Habib-Hann-PDG-de-ShafDB-sadresse-aux-medias-apres-avoir-devoile-la-nouvelle-identite-visuelle-de-la-banque-1536x1024.webp 1536w, http:/togodailynews.tg/wp-content/uploads/2026/06/Thierno-Habib-Hann-PDG-de-ShafDB-sadresse-aux-medias-apres-avoir-devoile-la-nouvelle-identite-visuelle-de-la-banque-2048x1365.webp 2048w HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-16 09:35:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:62942: 535 Incorrect authentication data (set_id=energia@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 16 09:35:29 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-16 09:35:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:22262: 535 Incorrect authentication data (set_id=voodoo@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.232.66.241
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/9c958e HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 09:36:10 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 09:36:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:30924: 535 Incorrect authentication data (set_id=piman@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 09:36:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:56996: 535 Incorrect authentication data (set_id=vlp@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-16 09:36:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:42190: 535 Incorrect authentication data (set_id=virtd@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 09:36:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 09:36:24 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 09:36:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:28472: 535 Incorrect authentication data (set_id=piman@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-16 09:36:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:54634: 535 Incorrect authentication data (set_id=celines@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 09:36:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.86.217.176
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/414854059 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-16 09:36:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:41156: 535 Incorrect authentication data (set_id=ws3@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 09:36:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:34210: 535 Incorrect authentication data (set_id=vlp@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-16 09:36:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:13846: 535 Incorrect authentication data (set_id=old-www@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-16 09:36:53 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:42130: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 09:36:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:1416: 535 Incorrect authentication data (set_id=etienne@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 16 09:36:30 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.39.248.250
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1268863084 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 139.135.44.154
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/866248 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 16 09:37:03 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 09:37:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:20078: 535 Incorrect authentication data (set_id=storage@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 09:37:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:48408: 535 Incorrect authentication data (set_id=vivien@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.89.151
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/05/WhatsApp-Image-2021-05-25-at-15.27.19-6.jpeg 1600w, http:/togodailynews.tg/wp-content/uploads/2021/05/WhatsApp-Image-2021-05-25-at-15.27.19-6-300x200.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2021/05/WhatsApp-Image-2021-05-25-at-15.27.19-6-768x512.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2021/05/WhatsApp-Image-2021-05-25-at-15.27.19-6-1024x682.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2021/05/WhatsApp-Image-2021-05-25-at-15.27.19-6-272x182.jpeg 272w HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-16 09:37:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:46380: 535 Incorrect authentication data (set_id=apptest@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 09:37:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:57432: 535 Incorrect authentication data (set_id=airbnb@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 09:37:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 16 09:37:28 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 16 09:37:20 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 09:37:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.32.132.190
country_id: 1819730
description:
2026-06-16 09:37:29 dovecot_plain authenticator failed for H=(dk3p581jx2ikpb8jbyxoxcusn) [152.32.132.190]:44964: 535 Incorrect authentication data (set_id=papson.fiatuwo@mesyscom.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-16 09:37:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:38288: 535 Incorrect authentication data (set_id=kelvin@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 09:37:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-16 09:37:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:32704: 535 Incorrect authentication data (set_id=face@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.32.132.190
country_id: 1819730
description:
Jun 16 09:37:27 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.32.132.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 09:38:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:6814: 535 Incorrect authentication data (set_id=chilly@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 09:38:27 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.201.243.94
country_id: 99237
description:
[2026-06-16 09:38:48 +0000] info [cpaneld] 62.201.243.94 - ar "GET /login/?login_only=1&user=ar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ar (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 193.25.167.124
country_id: 2750405
domain: civilemagazine.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:193.25.167.124||TA:193.25.167.124||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.181.141.140
country_id: 2635167
domain: civilemagazine.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:107.181.141.140||TA:107.181.141.140||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 09:38:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:39762: 535 Incorrect authentication data (set_id=batiment@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 09:38:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:49102: 535 Incorrect authentication data (set_id=mediacenter@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.175.208.158
country_id: 6252001
domain: civilemagazine.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:107.175.208.158||TA:107.175.208.158||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 16 09:38:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.209.209.97
country_id: 3895114
description:
[2026-06-16 09:38:37 +0000] info [cpaneld] 186.209.209.97 - arianatg "GET /login/?login_only=1&user=arianatg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user arianatg (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.252.193.232
country_id: 6251999
domain: civilemagazine.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:104.252.193.232||TA:104.252.193.232||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.8.34.111
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1881211656 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-16 09:38:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:29780: 535 Incorrect authentication data (set_id=mccaa@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 09:38:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:24602: 535 Incorrect authentication data (set_id=poli@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.112.143.247
country_id: 6251999
domain: civilemagazine.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:92.112.143.247||TA:92.112.143.247||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-16 09:38:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:29516: 535 Incorrect authentication data (set_id=treasurer@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 09:38:28 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.74.114.152
country_id: 3469034
description:
[2026-06-16 09:38:46 +0000] info [cpaneld] 187.74.114.152 - ari "GET /login/?login_only=1&user=ari&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ari (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.112.155.110
country_id: 2077456
domain: civilemagazine.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:92.112.155.110||TA:92.112.155.110||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 150.107.202.116
country_id: 458258
domain: civilemagazine.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:150.107.202.116||TA:150.107.202.116||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.173.137.249
country_id: 6252001
domain: civilemagazine.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:107.173.137.249||TA:107.173.137.249||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 1.55.210.101
country_id: 1562822
description:
[2026-06-16 09:38:32 +0000] info [cpaneld] 1.55.210.101 - ariana "GET /login/?login_only=1&user=ariana&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ariana (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.233.26.207
country_id: 6252001
domain: civilemagazine.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:104.233.26.207||TA:104.233.26.207||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 09:38:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.63.105.75
country_id: 3658394
description:
[2026-06-16 09:38:40 +0000] info [cpaneld] 200.63.105.75 - arian "GET /login/?login_only=1&user=arian&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user arian (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 16 09:38:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-16 09:38:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:38148: 535 Incorrect authentication data (set_id=dart@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 217.117.164.222
country_id: 6252001
domain: civilemagazine.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:217.117.164.222||TA:217.117.164.222||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 194.116.250.131
country_id: 3017382
domain: civilemagazine.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:194.116.250.131||TA:194.116.250.131||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 09:39:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:40662: 535 Incorrect authentication data (set_id=eeeeeeeeee@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 16 09:39:27 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 209.127.191.145
country_id: 6252001
domain: civilemagazine.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:209.127.191.145||TA:209.127.191.145||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.210.132.162
country_id: 6252001
domain: civilemagazine.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:192.210.132.162||TA:192.210.132.162||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 09:39:24 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 185.135.10.149
country_id: 2623032
domain: civilemagazine.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:185.135.10.149||TA:185.135.10.149||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 209.242.203.111
country_id: 3190538
domain: civilemagazine.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:209.242.203.111||TA:209.242.203.111||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 09:39:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:22666: 535 Incorrect authentication data (set_id=kentzhong@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-16 09:39:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:28628: 535 Incorrect authentication data (set_id=report@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.175.208.169
country_id: 6252001
domain: civilemagazine.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:107.175.208.169||TA:107.175.208.169||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 16 09:39:39 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 140.99.199.246
country_id: 3017382
domain: civilemagazine.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:140.99.199.246||TA:140.99.199.246||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.245
country_id: 1643084
description:
[2026-06-16 09:39:56 +0000] info [cpaneld] 185.213.83.245 - nwvfmxat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 09:39:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:15596: 535 Incorrect authentication data (set_id=yoga@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-16 09:39:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:21198: 535 Incorrect authentication data (set_id=pcevallos@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 09:39:24 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.175.56.194
country_id: 6252001
domain: civilemagazine.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:107.175.56.194||TA:107.175.56.194||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 161.123.215.59
country_id: 2077456
domain: civilemagazine.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:161.123.215.59||TA:161.123.215.59||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 213.169.215.11
country_id: 6252001
domain: civilemagazine.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:213.169.215.11||TA:213.169.215.11||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.233.26.241
country_id: 6252001
domain: civilemagazine.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:104.233.26.241||TA:104.233.26.241||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 193.187.115.81
country_id: 597427
domain: civilemagazine.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:193.187.115.81||TA:193.187.115.81||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 193.25.167.235
country_id: 2750405
domain: civilemagazine.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:193.25.167.235||TA:193.25.167.235||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-16 09:39:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:15618: 535 Incorrect authentication data (set_id=prouser@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 09:39:27 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.153.119.183
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/96a077 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.186.172.82
country_id: 6252001
domain: civilemagazine.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:192.186.172.82||TA:192.186.172.82||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 16 09:40:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 206.206.73.193
country_id: 6252001
domain: civilemagazine.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:206.206.73.193||TA:206.206.73.193||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 202.155.187.25
country_id: 2077456
domain: civilemagazine.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:202.155.187.25||TA:202.155.187.25||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-16 09:40:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:12170: 535 Incorrect authentication data (set_id=hsg@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 16 09:40:39 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-16 09:41:13 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:7954: 535 Incorrect authentication data (set_id=sylvia@ns5.netmaster.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.202.253.249
country_id: 2562770
domain: civilemagazine.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:142.202.253.249||TA:142.202.253.249||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 09:40:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:57788: 535 Incorrect authentication data (set_id=fuck@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 09:40:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:32630: 535 Incorrect authentication data (set_id=hjh@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 122.50.10.113
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/878f9b HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.173.93.117
country_id: 6252001
domain: civilemagazine.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:107.173.93.117||TA:107.173.93.117||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-16 09:40:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:35406: 535 Incorrect authentication data (set_id=beebee@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 09:40:30 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 09:40:34 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-16 09:40:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:21530: 535 Incorrect authentication data (set_id=recovery@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 09:40:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:22560: 535 Incorrect authentication data (set_id=ilyas@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 09:40:28 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 09:41:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:35610: 535 Incorrect authentication data (set_id=jacint@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 09:41:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:51996: 535 Incorrect authentication data (set_id=dup@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 16 09:41:40 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-16 09:41:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:13370: 535 Incorrect authentication data (set_id=pearl1@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 16 09:41:27 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.122.162
country_id: 2363686
description:
2026-06-16 09:42:09 dovecot_plain authenticator failed for H=([10.10.30.98]) [196.170.122.162]:43090: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-16 09:41:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:25662: 535 Incorrect authentication data (set_id=sylvia@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 09:41:24 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 09:41:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-16 09:41:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:26934: 535 Incorrect authentication data (set_id=irodriguez@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.144.3
country_id: 2363686
description:
2026-06-16 09:42:18 dovecot_login authenticator failed for H=(Yoga) [102.64.144.3]:52070: 535 Incorrect authentication data (set_id=contactcert@certlogisticstogo.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 09:41:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 09:41:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:13968: 535 Incorrect authentication data (set_id=recept@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 16 09:42:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-16 09:42:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:26998: 535 Incorrect authentication data (set_id=seki@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 09:42:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 09:42:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:43672: 535 Incorrect authentication data (set_id=rightfax@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 09:42:20 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 09:42:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:26608: 535 Incorrect authentication data (set_id=server.lab@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 16 09:42:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 09:42:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 198.163.195.93
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/6b5c53 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-16 09:42:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:31542: 535 Incorrect authentication data (set_id=fujise@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 09:42:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:5388: 535 Incorrect authentication data (set_id=rda@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-16 09:42:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:17096: 535 Incorrect authentication data (set_id=ver@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.214.3.138
country_id: 2245662
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/Grands-Lacs-Lome-consolide-la-centralite-de-la-mediation-africaine-768x931.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/Grands-Lacs-Lome-consolide-la-centralite-de-la-mediation-africaine-248x300.webp 248w, http:/togodailynews.tg/wp-content/uploads/2026/06/Grands-Lacs-Lome-consolide-la-centralite-de-la-mediation-africaine-845x1024.webp 845w, http:/togodailynews.tg/wp-content/uploads/2026/06/Grands-Lacs-Lome-consolide-la-centralite-de-la-mediation-africaine.webp 891w HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 09:43:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 09:43:28 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-16 09:43:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:8480: 535 Incorrect authentication data (set_id=zenek@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 16 09:43:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 09:43:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:35310: 535 Incorrect authentication data (set_id=firas@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-16 09:43:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:64318: 535 Incorrect authentication data (set_id=itsupport@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 09:43:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:61210: 535 Incorrect authentication data (set_id=surv@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.10.6.245
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/988679 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 09:43:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:5860: 535 Incorrect authentication data (set_id=linda@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 16 09:43:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-16 09:43:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:22946: 535 Incorrect authentication data (set_id=foto@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 09:43:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:5526: 535 Incorrect authentication data (set_id=frantic@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 09:43:28 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 196.168.103.160
country_id: 2363686
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/wp-content/plugins/onesignal-free-web-push-notifications/sdk_files/onesignalsdkworker.js?appid=8efd3276-8d5b-4b62-bbd3-6ed125ca9f51&sdkversion=160607||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-16 09:44:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:57250: 535 Incorrect authentication data (set_id=cpim@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 09:44:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [16/Jun/2026:09:44:34 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-16 09:44:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:64340: 535 Incorrect authentication data (set_id=chenyi@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 09:44:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 16 09:44:24 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-16 09:44:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:14466: 535 Incorrect authentication data (set_id=127@ns5.netmaster.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 103.108.92.90
country_id: 2077456
description:
103.108.92.90 - - [16/Jun/2026:09:44:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.90


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 09:44:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:52620: 535 Incorrect authentication data (set_id=sandbox1@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 09:44:32 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 09:44:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:27034: 535 Incorrect authentication data (set_id=fog@ns5.netmaster.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [16/Jun/2026:09:44:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 103.108.92.90
country_id: 2077456
description:
103.108.92.90 - - [16/Jun/2026:09:44:35 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.108.92.90


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 16 09:44:21 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 09:44:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:61006: 535 Incorrect authentication data (set_id=prl@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 09:45:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 09:45:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:43914: 535 Incorrect authentication data (set_id=poohbear@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.96.11.38
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/05/WhatsApp-Image-2021-05-25-at-15.27.19-1-1024x682.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2021/05/WhatsApp-Image-2021-05-25-at-15.27.19-1-300x200.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2021/05/WhatsApp-Image-2021-05-25-at-15.27.19-1-768x512.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2021/05/WhatsApp-Image-2021-05-25-at-15.27.19-1-272x182.jpeg 272w, http:/togodailynews.tg/wp-content/uploads/2021/05/WhatsApp-Image-2021-05-25-at-15.27.19-1.jpeg 1600w HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-16 09:45:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:5910: 535 Incorrect authentication data (set_id=simple@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 09:45:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:64084: 535 Incorrect authentication data (set_id=moore@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 09:45:21 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 16 09:45:24 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-16 09:45:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:47688: 535 Incorrect authentication data (set_id=aura@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-16 09:45:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:38084: 535 Incorrect authentication data (set_id=ellwangen@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 16 09:45:29 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 09:45:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:16358: 535 Incorrect authentication data (set_id=clement@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 09:45:35 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 09:45:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:35430: 535 Incorrect authentication data (set_id=poohbear@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 09:46:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-16 09:46:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:24138: 535 Incorrect authentication data (set_id=server.lab@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 16 09:46:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.112.8.130
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/c6c0b9 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 09:46:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:42938: 535 Incorrect authentication data (set_id=jonathan@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 09:46:34 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-16 09:46:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:40722: 535 Incorrect authentication data (set_id=ctcheng@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 09:46:40 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-16 09:46:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:30266: 535 Incorrect authentication data (set_id=showroom@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 16 09:46:27 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 09:46:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:26740: 535 Incorrect authentication data (set_id=gardien@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 09:46:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:10646: 535 Incorrect authentication data (set_id=voodoo@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 09:47:21 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 09:47:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:33870: 535 Incorrect authentication data (set_id=fukuoka@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-16 09:47:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:15540: 535 Incorrect authentication data (set_id=rcu@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 09:47:34 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 16 09:47:34 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-16 09:47:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:32412: 535 Incorrect authentication data (set_id=m030c137@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 16 09:47:32 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 09:47:40 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 09:47:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:26416: 535 Incorrect authentication data (set_id=ka@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-16 09:47:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:53242: 535 Incorrect authentication data (set_id=product@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 09:47:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:2690: 535 Incorrect authentication data (set_id=kny@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 09:47:48 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:13558: 535 Incorrect authentication data (set_id=kny@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 16 09:48:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 09:48:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:25534: 535 Incorrect authentication data (set_id=vedono@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-16 09:48:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:24192: 535 Incorrect authentication data (set_id=siva@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 09:48:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:17674: 535 Incorrect authentication data (set_id=kariya@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 09:48:42 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 09:48:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:9274: 535 Incorrect authentication data (set_id=junk1@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 09:48:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-16 09:48:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:13060: 535 Incorrect authentication data (set_id=celtic@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-16 09:48:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:7058: 535 Incorrect authentication data (set_id=joel@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 16 09:48:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 09:48:34 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-16 09:49:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:25864: 535 Incorrect authentication data (set_id=mihai@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 09:49:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:1038: 535 Incorrect authentication data (set_id=hellen@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 09:49:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:8946: 535 Incorrect authentication data (set_id=static5@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 16 09:49:38 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.62.167.237
country_id: 2921044
description:
[2026-06-16 09:49:48 +0000] info [cpaneld] 84.62.167.237 - togoagro "GET /login/?login_only=1&user=togoagro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoagro (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.237.123.139
country_id: 99237
description:
[2026-06-16 09:50:01 +0000] info [cpaneld] 212.237.123.139 - matwtogoorg "GET /login/?login_only=1&user=matwtogoorg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matwtogoorg (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 09:49:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.129.117.163
country_id: 2635167
description:
[2026-06-16 09:49:29 +0000] info [cpaneld] 86.129.117.163 - togoagropoles "GET /login/?login_only=1&user=togoagropoles&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoagropoles (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.215.235.19
country_id: 102358
description:
[2026-06-16 09:49:37 +0000] info [cpaneld] 212.215.235.19 - togoagropole "GET /login/?login_only=1&user=togoagropole&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoagropole (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.54.0.196
country_id: 3686110
description:
[2026-06-16 09:50:01 +0000] info [cpaneld] 181.54.0.196 - togoa "GET /login/?login_only=1&user=togoa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.244.235.154
country_id: 2264397
description:
[2026-06-16 09:50:04 +0000] info [cpaneld] 85.244.235.154 - togo "GET /login/?login_only=1&user=togo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togo (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 115.186.50.137
country_id: 1168579
domain: www.confortis.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.confortis.tg/NosPublications HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [16/Jun/2026:09:50:01 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10263188&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781603400 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.255.32.216
country_id: 1168579
description:
[2026-06-16 09:50:10 +0000] info [cpaneld] 72.255.32.216 - matwt "GET /login/?login_only=1&user=matwt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matwt (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 09:49:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:16508: 535 Incorrect authentication data (set_id=osama@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 09:49:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.104.28.251
country_id: 1282988
description:
[2026-06-16 09:49:54 +0000] info [cpaneld] 103.104.28.251 - togoagr "GET /login/?login_only=1&user=togoagr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoagr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.217.54.201
country_id: 2017370
description:
[2026-06-16 09:50:10 +0000] info [cpaneld] 178.217.54.201 - matwto "GET /login/?login_only=1&user=matwto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matwto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.217.187.6
country_id: 6251999
description:
[2026-06-16 09:50:14 +0000] info [cpaneld] 99.217.187.6 - matw "GET /login/?login_only=1&user=matw&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matw (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 16 09:49:29 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 09:49:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:12036: 535 Incorrect authentication data (set_id=shrill@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.7.15.133
country_id: 3932488
description:
[2026-06-16 09:49:58 +0000] info [cpaneld] 179.7.15.133 - togoag "GET /login/?login_only=1&user=togoag&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user togoag (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.0.230.177
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/04/Afreximbank-e1775648513640.webp 1000w, http:/togodailynews.tg/wp-content/uploads/2026/04/Afreximbank-e1775648513640-300x158.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/04/Afreximbank-e1775648513640-768x403.webp 768w HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-16 09:49:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:16028: 535 Incorrect authentication data (set_id=media4@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.206.36.22
country_id: 192950
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/Jamaica-Roadshow-June-2026-1024x684-1-300x200.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/Jamaica-Roadshow-June-2026-1024x684-1-768x513.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/Jamaica-Roadshow-June-2026-1024x684-1.webp 1024w HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.45.50.49
country_id: 102358
description:
[2026-06-16 09:49:52 +0000] info [cpaneld] 176.45.50.49 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 116.99.185.82
country_id: 1562822
description:
[2026-06-16 09:50:06 +0000] info [cpaneld] 116.99.185.82 - matwto "GET /login/?login_only=1&user=matwto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matwto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.54.76.16
country_id: 1512440
description:
[2026-06-16 09:50:06 +0000] info [cpaneld] 84.54.76.16 - matwtog "GET /login/?login_only=1&user=matwtog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matwtog (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.235.72.239
country_id: 6252001
description:
[2026-06-16 09:50:17 +0000] info [cpaneld] 73.235.72.239 - matw "GET /login/?login_only=1&user=matw&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user matw (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-16 09:49:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:27192: 535 Incorrect authentication data (set_id=demoadmin@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 09:49:36 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [16/Jun/2026:09:50:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6779037&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781603402 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.169.125.74
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/8f6b63 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 09:50:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 09:50:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:46468: 535 Incorrect authentication data (set_id=ccc@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 16 09:50:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.165.183.21
country_id: 290557
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/9c938e HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 09:50:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 09:50:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 09:50:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:44124: 535 Incorrect authentication data (set_id=edwin@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-16 09:50:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:18794: 535 Incorrect authentication data (set_id=st1@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 09:50:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:7584: 535 Incorrect authentication data (set_id=dc2@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-16 09:50:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:17368: 535 Incorrect authentication data (set_id=testdata@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.106.6.78
country_id: 6252001
description:
[2026-06-16 09:50:23 +0000] info [cpaneld] 68.106.6.78 - ma "GET /login/?login_only=1&user=ma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ma (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.5.38.49
country_id: 3895114
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/768073135 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-16 09:50:45 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:7804: 535 Incorrect authentication data (set_id=pc05@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 16 09:50:43 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 09:51:21 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 16 09:51:45 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 09:52:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:51842: 535 Incorrect authentication data (set_id=aladdin@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 09:51:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 09:51:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:11220: 535 Incorrect authentication data (set_id=t3@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 09:51:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:49258: 535 Incorrect authentication data (set_id=design3@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 16 09:51:30 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-16 09:52:04 +0000] info [cpaneld] 195.3.220.88 - a.mathey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user a.mathey (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-16 09:51:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:21464: 535 Incorrect authentication data (set_id=beeper@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 09:51:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-16 09:51:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:10168: 535 Incorrect authentication data (set_id=cera@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.79.190.218
country_id: 1512440
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/administration HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 09:51:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:37710: 535 Incorrect authentication data (set_id=monami@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-16 09:51:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:8816: 535 Incorrect authentication data (set_id=ipphone@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 16 09:52:24 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 16 09:52:24 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 09:52:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-16 09:52:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:13184: 535 Incorrect authentication data (set_id=kansascity@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.199.70
country_id: 2363686
description:
[2026-06-16 09:52:29 +0000] info [webmaild] 160.242.199.70 - tlemou@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 09:52:45 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 09:52:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 09:52:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:39112: 535 Incorrect authentication data (set_id=marathon@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-16 09:52:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:14648: 535 Incorrect authentication data (set_id=factures@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 09:52:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:41056: 535 Incorrect authentication data (set_id=sq@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 09:52:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:54626: 535 Incorrect authentication data (set_id=asia@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.245
country_id: 1643084
description:
[2026-06-16 09:52:32 +0000] info [cpaneld] 185.213.83.245 - ayhhhyhk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayhhhyhk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-16 09:52:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:64746: 535 Incorrect authentication data (set_id=samborsky@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.134.255.17
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/190259433 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.123.32.47
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/07/image3.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2023/07/image3-300x200.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2023/07/image3-768x512.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2023/07/image3-272x182.jpeg 272w HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 16 09:53:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 09:53:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 09:53:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:20604: 535 Incorrect authentication data (set_id=appraisal@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 09:53:21 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 09:53:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-16 09:53:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:38464: 535 Incorrect authentication data (set_id=adminpanel@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 09:53:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:45726: 535 Incorrect authentication data (set_id=qwerasdf@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 16 09:53:24 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 09:53:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:21860: 535 Incorrect authentication data (set_id=hz@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.199.70
country_id: 2363686
description:
[2026-06-16 09:53:30 +0000] info [webmaild] 160.242.199.70 - tlemou@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-16 09:53:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:51706: 535 Incorrect authentication data (set_id=vdr@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-16 09:53:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:6208: 535 Incorrect authentication data (set_id=m100c069@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 09:54:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:26120: 535 Incorrect authentication data (set_id=darcy@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-16 09:54:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:43512: 535 Incorrect authentication data (set_id=crew@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 09:54:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:37018: 535 Incorrect authentication data (set_id=ly@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 09:54:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 09:54:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 09:54:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:41654: 535 Incorrect authentication data (set_id=ly@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 16 09:54:30 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 09:54:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:13738: 535 Incorrect authentication data (set_id=micro@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 16 09:54:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-16 09:54:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:29858: 535 Incorrect authentication data (set_id=gls@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-16 09:54:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:62320: 535 Incorrect authentication data (set_id=southeastasia1-a@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 130.12.182.63
country_id: 3190538
description:
[2026-06-16 09:54:56 +0000] info [webmaild] 130.12.182.63 - stephane@sitewebofficiel.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 09:54:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.164
country_id: 1880251
description:
47.128.121.164 - - [16/Jun/2026:09:54:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7301984&pdata=https%253A%252F%252Ftogomedia24.tg%252F2023%252F02%252F06%252Fcrise-securitaire-le-burkina-faso-tire-la-sonnette-dalarme%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781603675 HTTP/2.0" 302 0 togomedia24.tg "https://togomedia24.tg/2023/02/06/crise-securitaire-le-burkina-faso-tire-la-sonnette-dalarme/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.164


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 90.40.214.243
country_id: 3017382
description:
90.40.214.243 - - [16/Jun/2026:09:55:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7300716&pdata=https%253A%252F%252Fwebmail.batika.free.netmaster.tg%252F%253Flocale%253Dfil&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781603729 HTTP/2.0" 302 0 webmail.batika.free.netmaster.tg "https://webmail.batika.free.netmaster.tg/?locale=fil" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:90.40.214.243


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.44
country_id: 130758
description:
2026-06-16 09:55:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.44]:53910: 535 Incorrect authentication data (set_id=amir@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 09:55:21 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 09:55:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 09:55:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:40782: 535 Incorrect authentication data (set_id=haproxy-stage-1.net@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 09:55:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:17070: 535 Incorrect authentication data (set_id=michal@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.144
country_id: 130758
description:
2026-06-16 09:55:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.144]:16026: 535 Incorrect authentication data (set_id=magda@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 09:55:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:5366: 535 Incorrect authentication data (set_id=remoto123@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.49
country_id: 130758
description:
2026-06-16 09:55:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.49]:35304: 535 Incorrect authentication data (set_id=wildman1@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.49
country_id: 130758
description:
Jun 16 09:55:30 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.49 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.3.220.88
country_id: 798544
description:
[2026-06-16 09:56:16 +0000] info [cpaneld] 195.3.220.88 - whmcsadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user whmcsadmin (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 89.43.132.217
country_id: 719819
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1313243725 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.19.164.98
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/bab0b2 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 09:55:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.44
country_id: 130758
description:
Jun 16 09:55:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.44 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 137.59.218.39
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1100992348 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 09:56:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:8656: 535 Incorrect authentication data (set_id=\302\252@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 09:56:52 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 09:56:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 09:56:24 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 09:56:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:61476: 535 Incorrect authentication data (set_id=44444@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 09:56:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:59038: 535 Incorrect authentication data (set_id=44444@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.122.162
country_id: 2363686
description:
2026-06-16 09:56:47 dovecot_plain authenticator failed for H=([10.10.30.98]) [196.170.122.162]:39366: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.4
country_id: 6252001
description:
205.169.39.4 - - [16/Jun/2026:09:57:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7313261&pdata=http%253A%252F%252Fwww.davetechno.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781603835 HTTP/1.1" 302 0 www.davetechno.tg "http://www.davetechno.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.4


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 09:56:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:32078: 535 Incorrect authentication data (set_id=bulk@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.199.70
country_id: 2363686
description:
[2026-06-16 09:57:32 +0000] info [webmaild] 160.242.199.70 - tlemou@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.52.211.184
country_id: 1694008
description:
Jun 16 09:58:12 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.52.211.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 09:57:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 09:57:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:8370: 535 Incorrect authentication data (set_id=almoxarifado@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.4
country_id: 6252001
description:
205.169.39.4 - - [16/Jun/2026:09:57:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13277076&pdata=http%253A%252F%252Fdavetechno.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781603846 HTTP/1.1" 302 0 davetechno.tg "http://davetechno.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.4


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 09:57:28 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 09:57:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:52894: 535 Incorrect authentication data (set_id=sujata@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 09:57:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 09:57:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:23678: 535 Incorrect authentication data (set_id=itm@ns5.netmaster.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [16/Jun/2026:09:57:41 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [16/Jun/2026:09:57:42 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 223.24.226.228
country_id: 1605651
description:
[2026-06-16 09:58:24 +0000] info [cpaneld] 223.24.226.228 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 09:58:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:64332: 535 Incorrect authentication data (set_id=minor@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.228.131.114
country_id: 2029969
description:
Jun 16 09:58:36 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.228.131.114 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.190.6.78
country_id: 3469034
description:
[2026-06-16 09:58:37 +0000] info [cpaneld] 45.190.6.78 - cen "GET /login/?login_only=1&user=cen&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cen (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.191.83.153
country_id: 1210997
description:
[2026-06-16 09:58:43 +0000] info [cpaneld] 160.191.83.153 - ce "GET /login/?login_only=1&user=ce&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ce (has_cpuser_file failed)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 09:58:58 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:10858: 535 Incorrect authentication data (set_id=cimbom@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.52.211.184
country_id: 1694008
description:
Jun 16 09:58:28 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.52.211.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 09:58:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:44810: 535 Incorrect authentication data (set_id=pap@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 09:58:28 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 09:58:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:15220: 535 Incorrect authentication data (set_id=kraken@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 09:58:27 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 09:58:28 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 09:59:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.31.119.176
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/10/t\xc3\xa9l\xc3\xa9chargement-18.jpeg 275w, http:/togodailynews.tg/wp-content/uploads/2021/10/t\xc3\xa9l\xc3\xa9chargement-18-272x182.jpeg 272w HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 09:59:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:56048: 535 Incorrect authentication data (set_id=nvr@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.139.63.44
country_id: 248816
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/10/t\xc3\xa9l\xc3\xa9chargement-21.jpeg 275w, http:/togodailynews.tg/wp-content/uploads/2021/10/t\xc3\xa9l\xc3\xa9chargement-21-272x182.jpeg 272w HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 09:59:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:6408: 535 Incorrect authentication data (set_id=adver@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 09:59:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:36594: 535 Incorrect authentication data (set_id=hockey@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.172.110.226
country_id: 783754
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/07/Bahamas-Charity-Group-Photo-resized-1024x308-1.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/07/Bahamas-Charity-Group-Photo-resized-1024x308-1-300x90.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2024/07/Bahamas-Charity-Group-Photo-resized-1024x308-1-768x231.jpg 768w HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 09:59:28 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.91.233.238
country_id: 3469034
description:
Jun 16 09:59:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.91.233.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 09:59:28 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 10:00:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:47272: 535 Incorrect authentication data (set_id=warriors@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 10:00:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.243
country_id: 2287781
description:
2026-06-16 10:00:48 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.243]:15619: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 10:00:28 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 10:00:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.43.116
country_id: 1814991
description:
Jun 16 10:00:34 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.43.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 10:01:12 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:35088: 535 Incorrect authentication data (set_id=photo3@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 10:00:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:62582: 535 Incorrect authentication data (set_id=bor@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 10:00:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:28322: 535 Incorrect authentication data (set_id=server33@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 10:01:27 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 10:01:28 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 10:01:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:53976: 535 Incorrect authentication data (set_id=citrix1@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 10:01:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:38772: 535 Incorrect authentication data (set_id=tintin@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.166.141.66
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/2097377517 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 10:01:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:20122: 535 Incorrect authentication data (set_id=fire@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.186.250.146
country_id: 248816
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/961819955 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.243
country_id: 2287781
description:
2026-06-16 10:01:43 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.243]:11264: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 10:01:35 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 10:02:37 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.63.178.27
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/862826655 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.255.105.76
country_id: 3895114
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/IMG_20220601_081550-scaled-1-300x225.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/IMG_20220601_081550-scaled-1-1024x768.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/06/IMG_20220601_081550-scaled-1-768x576.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/IMG_20220601_081550-scaled-1-1536x1152.webp 1536w, http:/togodailynews.tg/wp-content/uploads/2026/06/IMG_20220601_081550-scaled-1-2048x1536.webp 2048w HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.80.22.205
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1369111099 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 10:02:35 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 10:02:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:30228: 535 Incorrect authentication data (set_id=hideip-uk@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 10:02:39 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:11866: 535 Incorrect authentication data (set_id=ace@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 10:03:16 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:3130: 535 Incorrect authentication data (set_id=marina@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 10:02:32 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 10:02:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:45226: 535 Incorrect authentication data (set_id=eproc@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 138.252.186.139
country_id: 1210997
description:
138.252.186.139 - - [16/Jun/2026:10:02:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9925019&pdata=https%253A%252F%252Feducplusmedia.tg%252Fpage%252F10%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781604152 HTTP/2.0" 302 0 educplusmedia.tg "https://educplusmedia.tg/page/10/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.5895.1522 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:138.252.186.139


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.179.125.125
country_id: 1210997
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/199910723 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 10:03:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:3506: 535 Incorrect authentication data (set_id=streaming@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.200.235.167
country_id: 2589581
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/HJ6JWlDXEAAE-Hn-300x240.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/HJ6JWlDXEAAE-Hn-1024x819.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/06/HJ6JWlDXEAAE-Hn-768x614.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/HJ6JWlDXEAAE-Hn-1536x1229.webp 1536w, http:/togodailynews.tg/wp-content/uploads/2026/06/HJ6JWlDXEAAE-Hn.webp 1600w HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 10:03:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 10:03:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 10:03:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:21664: 535 Incorrect authentication data (set_id=uit@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 10:03:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:24360: 535 Incorrect authentication data (set_id=pem@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 10:03:39 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.55.146.14
country_id: 1210997
description:
[2026-06-16 10:04:20 +0000] info [cpaneld] 103.55.146.14 - cloudetracks "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.113.94.208
country_id: 2328926
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/982367459 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.183.152.254
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/9e9591 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.15.180.79
country_id: 1269750
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/12/colombia_2025.webp 800w, http:/togodailynews.tg/wp-content/uploads/2025/12/colombia_2025-300x188.webp 300w, http:/togodailynews.tg/wp-content/uploads/2025/12/colombia_2025-768x480.webp 768w HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 10:04:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.143
country_id: 1880251
description:
47.128.121.143 - - [16/Jun/2026:10:05:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13135468&pdata=https%253A%252F%252Fdirect7.tg%252Ftag%252Fanne-dubus%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781604298 HTTP/2.0" 302 0 direct7.tg "https://direct7.tg/tag/anne-dubus/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.143


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.161.231
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/05/WhatsApp-Image-2021-05-25-at-15.27.19-2-1024x682.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2021/05/WhatsApp-Image-2021-05-25-at-15.27.19-2-300x200.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2021/05/WhatsApp-Image-2021-05-25-at-15.27.19-2-768x512.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2021/05/WhatsApp-Image-2021-05-25-at-15.27.19-2-272x182.jpeg 272w, http:/togodailynews.tg/wp-content/uploads/2021/05/WhatsApp-Image-2021-05-25-at-15.27.19-2.jpeg 1600w HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.7.203.215
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/05/Photo-togocom-offre-750x375.jpg 750w, http:/togodailynews.tg/wp-content/uploads/2022/05/Photo-togocom-offre-750x375-300x150.jpg 300w HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.49.61
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/Integration-regionale-le-President-du-Conseil-recoit-un-emissaire-du-President-senegalais-3-768x592.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/Integration-regionale-le-President-du-Conseil-recoit-un-emissaire-du-President-senegalais-3-300x231.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/Integration-regionale-le-President-du-Conseil-recoit-un-emissaire-du-President-senegalais-3.webp 800w HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [16/Jun/2026:10:04:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9671838&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781604268 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 10:04:30 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 10:04:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:28148: 535 Incorrect authentication data (set_id=nam@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [16/Jun/2026:10:04:31 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13013911&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781604269 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 10:04:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:13004: 535 Incorrect authentication data (set_id=pop@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 10:04:41 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 10:04:44 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:5954: 535 Incorrect authentication data (set_id=info@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 10:05:35 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 10:05:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:7714: 535 Incorrect authentication data (set_id=spammail@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 10:05:47 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:51544: 535 Incorrect authentication data (set_id=modid@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 10:05:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:19870: 535 Incorrect authentication data (set_id=spammail@ns5.netmaster.tg)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.49.41.168
country_id: 1269750
domain: ucao-uut.tg
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:87471.ucao-uut.tg||ServerName:ucao-uut.tg||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4367175137820ca1541bb3bf9bfda1574af95b33||Title:0x1bf07263||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 10:05:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:4338: 535 Incorrect authentication data (set_id=t3@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 10:05:45 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 10:05:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 10:06:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:41864: 535 Incorrect authentication data (set_id=hacker@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 10:06:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:3688: 535 Incorrect authentication data (set_id=aukcje@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 10:06:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 10:06:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:45082: 535 Incorrect authentication data (set_id=andrea@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 10:06:29 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 10:06:40 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.115.199.211
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1771763827 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 111.119.167.41
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/Diplomatie-Faure-Essozimna-Gnassingbe-recoit-Romuald-Wadagni-en-visite-officielle-au-Tog-300x240.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/Diplomatie-Faure-Essozimna-Gnassingbe-recoit-Romuald-Wadagni-en-visite-officielle-au-Tog-768x614.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/Diplomatie-Faure-Essozimna-Gnassingbe-recoit-Romuald-Wadagni-en-visite-officielle-au-Tog.webp 800w HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 10:07:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:47624: 535 Incorrect authentication data (set_id=abba@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 10:07:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:50160: 535 Incorrect authentication data (set_id=balaji@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.184.93.227
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/12/eau-potable.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2022/12/eau-potable-300x225.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2022/12/eau-potable-768x576.jpg 768w HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.117.212.127
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/02/CEET-siege.jpg 1280w, http:/togodailynews.tg/wp-content/uploads/2025/02/CEET-siege-300x187.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2025/02/CEET-siege-1024x638.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2025/02/CEET-siege-768x479.jpg 768w HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 10:07:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 10:07:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:2096: 535 Incorrect authentication data (set_id=accost@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 10:07:52 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:43380: 535 Incorrect authentication data (set_id=jerome@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 58.65.214.94
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/797274 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 10:07:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 10:07:24 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 10:08:20 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 10:08:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:30994: 535 Incorrect authentication data (set_id=old.store@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 10:08:21 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 10:08:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:39144: 535 Incorrect authentication data (set_id=harima@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 10:08:30 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 10:08:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:58050: 535 Incorrect authentication data (set_id=vadmin@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 10:09:24 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 10:09:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.182.63.241
country_id: 1210997
description:
[2026-06-16 10:09:41 +0000] info [cpaneld] 103.182.63.241 - snbtg "GET /login/?login_only=1&user=snbtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user snbtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.141.76.161
country_id: 2542007
description:
[2026-06-16 10:09:46 +0000] info [cpaneld] 41.141.76.161 - sn "GET /login/?login_only=1&user=sn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sn (has_cpuser_file failed)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 10:10:06 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:28978: 535 Incorrect authentication data (set_id=sonny@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 10:09:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:30736: 535 Incorrect authentication data (set_id=marissa@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 10:09:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:22458: 535 Incorrect authentication data (set_id=honda@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 10:09:30 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 10:09:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:49764: 535 Incorrect authentication data (set_id=testfax@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.6.183.165
country_id: 6254930
description:
[2026-06-16 10:09:34 +0000] info [cpaneld] 213.6.183.165 - snb "GET /login/?login_only=1&user=snb&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user snb (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.82.207.142
country_id: 2245662
description:
[2026-06-16 10:10:41 +0000] info [cpaneld] 41.82.207.142 - snc "GET /login/?login_only=1&user=snc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user snc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.231.218.85
country_id: 285570
description:
[2026-06-16 10:10:45 +0000] info [cpaneld] 37.231.218.85 - sn "GET /login/?login_only=1&user=sn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.97.239.178
country_id: 3625428
description:
[2026-06-16 10:10:30 +0000] info [cpaneld] 190.97.239.178 - sncom "GET /login/?login_only=1&user=sncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sncom (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 10:10:32 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.122.162
country_id: 2363686
description:
2026-06-16 10:11:11 dovecot_login authenticator failed for H=(SCRPMKD) [196.170.122.162]:52180: 535 Incorrect authentication data


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.97.178.248
country_id: 2635167
description:
[2026-06-16 10:11:16 +0000] info [cpaneld] 88.97.178.248 - mouss "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mouss (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 10:10:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:13878: 535 Incorrect authentication data (set_id=facebook@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 10:10:28 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 54.71.187.124
country_id: 6252001
description:
54.71.187.124 - - [16/Jun/2026:10:10:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051210&pdata=http%253A%252F%252F154-70-82-246.cpanel.site&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781604643 HTTP/1.1" 302 0 154-70-82-246.cpanel.site "http://154-70-82-246.cpanel.site/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:54.71.187.124


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 10:10:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 10:10:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:22260: 535 Incorrect authentication data (set_id=akta@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 52.34.76.65
country_id: 6252001
description:
52.34.76.65 - - [16/Jun/2026:10:10:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10066798&pdata=https%253A%252F%252F154-70-82-246.cpanel.site&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781604636 HTTP/2.0" 302 0 154-70-82-246.cpanel.site "https://154-70-82-246.cpanel.site/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:52.34.76.65


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.23.156.14
country_id: 3865483
description:
[2026-06-16 10:10:30 +0000] info [cpaneld] 181.23.156.14 - sncom "GET /login/?login_only=1&user=sncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sncom (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 10:10:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:41504: 535 Incorrect authentication data (set_id=kristin@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.36.219.76
country_id: 102358
description:
[2026-06-16 10:10:37 +0000] info [cpaneld] 51.36.219.76 - snco "GET /login/?login_only=1&user=snco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user snco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.78.236.146
country_id: 3469034
description:
[2026-06-16 10:10:37 +0000] info [cpaneld] 189.78.236.146 - snco "GET /login/?login_only=1&user=snco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user snco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.6.101.192
country_id: 3932488
description:
[2026-06-16 10:10:40 +0000] info [cpaneld] 179.6.101.192 - snc "GET /login/?login_only=1&user=snc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user snc (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 10:11:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 10:11:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:5336: 535 Incorrect authentication data (set_id=kulagina@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.77.213.90
country_id: 1282988
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1532471514 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 10:11:24 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 10:11:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:25706: 535 Incorrect authentication data (set_id=sapl@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 10:11:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:13656: 535 Incorrect authentication data (set_id=beijing@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 10:11:24 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 10:12:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.245
country_id: 1643084
description:
[2026-06-16 10:12:56 +0000] info [cpaneld] 185.213.83.245 - 2002281 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 10:12:24 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.122.162
country_id: 2363686
description:
2026-06-16 10:12:28 dovecot_plain authenticator failed for H=([10.10.30.98]) [196.170.122.162]:45758: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [16/Jun/2026:10:13:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 10:12:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:13570: 535 Incorrect authentication data (set_id=autodiscovery@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 10:12:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:17408: 535 Incorrect authentication data (set_id=bac@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 10:12:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:61216: 535 Incorrect authentication data (set_id=everdene@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 10:12:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 10:12:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:24916: 535 Incorrect authentication data (set_id=bac@ns5.netmaster.tg)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [16/Jun/2026:10:13:19 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.155.20.194
country_id: 1282988
description:
2026-06-16 10:13:31 dovecot_plain authenticator failed for H=(white-ways.com) [103.155.20.194]:41892: 535 Incorrect authentication data (set_id=home@white-ways.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 10:13:34 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 10:13:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:16062: 535 Incorrect authentication data (set_id=amministrazione@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 10:13:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 10:13:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 89.40.30.83
country_id: 587116
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/53385690 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 10:13:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:61226: 535 Incorrect authentication data (set_id=christel@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 10:13:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:52942: 535 Incorrect authentication data (set_id=tudo@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.149.42.20
country_id: 3595528
domain: ca-togo.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ca-togo.org/prubeneficial.tg HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 10:14:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:64390: 535 Incorrect authentication data (set_id=pierre@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 10:14:21 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 10:14:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 10:14:26 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 10:14:28 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:44628: 535 Incorrect authentication data (set_id=mexal@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 10:14:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:38524: 535 Incorrect authentication data (set_id=ufo@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.120.254.139
country_id: 3625428
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/c69bdd61-dc3f-494d-b0d2-ff8e19f7501e-1024x768-1-300x225.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/c69bdd61-dc3f-494d-b0d2-ff8e19f7501e-1024x768-1-768x576.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/c69bdd61-dc3f-494d-b0d2-ff8e19f7501e-1024x768-1.webp 1024w HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 10:14:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:61288: 535 Incorrect authentication data (set_id=ufo@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.185.243.96
country_id: 953987
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/7b716b HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.228.238
country_id: 6252001
description:
47.77.228.238 - - [16/Jun/2026:10:16:06 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13027529&pdata=http%253A%252F%252F154.70.82.246%253A2086%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781604963 HTTP/1.1" 302 0 154.70.82.246 "http://154.70.82.246:2086/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.77.228.238


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 10:15:27 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.188.82
country_id: 6252001
description:
47.251.188.82 - - [16/Jun/2026:10:16:16 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9661333&pdata=http%253A%252F%252Ftogomedia24.tg%253A2086%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781604973 HTTP/1.1" 302 0 togomedia24.tg "http://togomedia24.tg:2086/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.188.82


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.88.94.125
country_id: 6252001
description:
47.88.94.125 - - [16/Jun/2026:10:16:18 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7106918&pdata=http%253A%252F%252Fsia-togo.tg%253A2086%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781604975 HTTP/1.1" 302 0 sia-togo.tg "http://sia-togo.tg:2086/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.88.94.125


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 10:15:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:44466: 535 Incorrect authentication data (set_id=vale@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 10:15:29 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.90.48
country_id: 6252001
description:
47.251.90.48 - - [16/Jun/2026:10:16:17 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12938092&pdata=http%253A%252F%252Farse.tg%253A2086%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781604974 HTTP/1.1" 302 0 arse.tg "http://arse.tg:2086/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.90.48


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 10:15:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:62912: 535 Incorrect authentication data (set_id=weber@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 10:15:31 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 10:15:33 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:36338: 535 Incorrect authentication data (set_id=rda@ns5.netmaster.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.25.191.198
country_id: 3439705
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2021/10/images-10.jpeg 301w, http:/togodailynews.tg/wp-content/uploads/2021/10/images-10-300x167.jpeg 300w HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.227.227
country_id: 6252001
description:
47.77.227.227 - - [16/Jun/2026:10:16:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7511240&pdata=http%253A%252F%252Fcafe.tg%253A2086%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781604982 HTTP/1.1" 302 0 cafe.tg "http://cafe.tg:2086/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.77.227.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 10:16:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 10:16:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:54134: 535 Incorrect authentication data (set_id=exchange@ns5.netmaster.tg)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.169.20.246
country_id: 2363686
description:
[2026-06-16 10:17:10 +0000] info [webmaild] 196.169.20.246 - agou1@agou1.mairie.tg "POST /cpsess3618670588/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.169.2.206] != Current IP Address [196.169.20.246]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 119.13.157.26
country_id: 1831722
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2020/07/IMG-20200728-WA0102.jpg 486w, http:/togodailynews.tg/wp-content/uploads/2020/07/IMG-20200728-WA0102-300x230.jpg 300w HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 10:16:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:44636: 535 Incorrect authentication data (set_id=pat@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 10:16:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 10:16:30 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 10:16:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:28056: 535 Incorrect authentication data (set_id=olaussen@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 10:16:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:41972: 535 Incorrect authentication data (set_id=exchange@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 10:17:29 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 10:17:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:19874: 535 Incorrect authentication data (set_id=wjw@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 10:17:31 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:45332: 535 Incorrect authentication data (set_id=jfernandez@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 10:17:34 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:36242: 535 Incorrect authentication data (set_id=cio@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 10:17:32 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 10:17:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 10:18:28 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 10:18:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:36532: 535 Incorrect authentication data (set_id=uni@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 10:18:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:27902: 535 Incorrect authentication data (set_id=brookside@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 10:18:43 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:9274: 535 Incorrect authentication data (set_id=pbx@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 10:18:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 10:18:35 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:11690: 535 Incorrect authentication data (set_id=pbx@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 10:18:34 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [16/Jun/2026:10:19:05 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10000487&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781605144 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [16/Jun/2026:10:19:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12937828&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781605146 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 10:19:34 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 10:19:36 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 10:19:36 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:3200: 535 Incorrect authentication data (set_id=reception@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 10:19:38 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:19444: 535 Incorrect authentication data (set_id=dan@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 10:19:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:20626: 535 Incorrect authentication data (set_id=chenhong@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 10:19:30 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 181.55.23.252
country_id: 3686110
description:
181.55.23.252 - - [16/Jun/2026:10:20:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9804134&pdata=https%253A%252F%252Ftogodailynews.tg%252Feducation-de-qualite-au-togo-letat-fait-accroitre-autant-quil-peut-leffectif-des-enseignants%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781605206 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/education-de-qualite-au-togo-letat-fait-accroitre-autant-quil-peut-leffectif-des-enseignants/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.4754.1612 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:181.55.23.252


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.98.130.184
country_id: 1282988
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/Thierno-Habib-Hann-MD-SHAFDB-1-768x495.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/Thierno-Habib-Hann-MD-SHAFDB-1-300x193.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/Thierno-Habib-Hann-MD-SHAFDB-1-1024x660.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/06/Thierno-Habib-Hann-MD-SHAFDB-1-1536x991.webp 1536w, http:/togodailynews.tg/wp-content/uploads/2026/06/Thierno-Habib-Hann-MD-SHAFDB-1-2048x1321.webp 2048w HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.71
country_id: 6252001
description:
[2026-06-16 10:20:46 +0000] info [cpaneld] 64.44.59.71 NEW wcnyaruu:blrwXspSqdHxkwqt address=64.44.59.71,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 10:20:50 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:52740: 535 Incorrect authentication data (set_id=yohan@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 10:20:40 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:10982: 535 Incorrect authentication data (set_id=yohan@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.243
country_id: 2287781
description:
2026-06-16 10:21:04 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.243]:13952: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.226.139.83
country_id: 3686110
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/339071000 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 10:20:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:59374: 535 Incorrect authentication data (set_id=accepted@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 10:20:38 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.54.70.49
country_id: 1512440
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2023/12/memoire_enseignants_1.jpg 1280w, http:/togodailynews.tg/wp-content/uploads/2023/12/memoire_enseignants_1-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2023/12/memoire_enseignants_1-1024x682.jpg 1024w, http:/togodailynews.tg/wp-content/uploads/2023/12/memoire_enseignants_1-768x512.jpg 768w, http:/togodailynews.tg/wp-content/uploads/2023/12/memoire_enseignants_1-272x182.jpg 272w HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 10:20:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:12120: 535 Incorrect authentication data (set_id=s200@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 10:20:30 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 10:20:40 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.165.143
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>dans le secteur du commerce international, la rigueur documentaire est un pilier incontournable. ayant constat\xc3\xa9 une recrudescence de pratiques irr\xc3\xa9guli\xc3\xa8res concernant la gestion des cargaisons, l'office togolais des recettes (otr) hausse le ton.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>par la note officielle n\xc2\xb0010/2026/otr/cg/cddi/del, le commissaire des douanes et droits indirects (cddi), t\xc3\xa9i konzi, tape du poing sur la table, et rappelle \xc3\xa0 l'ordre l'ensemble des acteurs de la cha\xc3\xaene logistique.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>selon ledit communiqu\xc3\xa9, il a \xc3\xa9t\xc3\xa9 constat\xc3\xa9 que de nombreux op\xc3\xa9rateurs \xc3\xa9conomiques, notamment des d\xc3\xa9clarants en douane et des consignataires, introduisent de mani\xc3\xa8re r\xc3\xa9p\xc3\xa9t\xc3\xa9e des requ\xc3\xaates visant \xc3\xa0 modifier les manifestes de cargaison.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31006,\"sizeslug\":\"full\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-full\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/otr_ferer-pour-batir-1.jpg\" alt=\"\" class=\"wp-image-31006\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>mais probl\xc3\xa8me&nbsp;: ces demandes interviennent au-del\xc3\xa0 du d\xc3\xa9lai l\xc3\xa9gal fix\xc3\xa9 par la r\xc3\xa9glementation douani\xc3\xa8re en vigueur. ce qui constitue une pratique qui perturbe le bon d\xc3\xa9roulement des op\xc3\xa9rations de contr\xc3\xb4le et fragilise la transparence des flux marchands.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>en effet, l'administration douani\xc3\xa8re est formelle : le manifeste est un document juridique qui engage la responsabilit\xc3\xa9 de celui qui l'\xc3\xa9met. ainsi que le rappelle de l'article 357, alin\xc3\xa9a 7 de la loi n\xc2\xb02018-007 du 25 juin 2018 portant code des douanes national : <em>\xc2\xab&nbsp;toute erreur ou omission constat\xc3\xa9e dans les manifestes constitue une infraction douani\xc3\xa8re caract\xc3\xa9ris\xc3\xa9e&nbsp;\xc2\xbb.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>il ne s'agit donc pas d'une simple formalit\xc3\xa9 administrative, mais d'un manquement grave \xc3\xa0 la l\xc3\xa9gislation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>face \xc3\xa0 cette situation, la direction des douanes tape fort. l'interdiction de modifier les \xc3\xa9critures dans le manifeste apr\xc3\xa8s les d\xc3\xa9lais est d\xc3\xa9sormais absolue.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>cette mesure s'applique de mani\xc3\xa8re stricte \xc3\xa0 tout le monde, notamment les commissionnaires en douane agr\xc3\xa9\xc3\xa9s (transitaires) ; les consignataires ; et les agents du commissariat des douanes et droits indirects (cddi) eux-m\xc3\xaames.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31146,\"width\":\"642px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/image-30-724x1024.png\" alt=\"\" class=\"wp-image-31146\" style=\"width:642px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong>les risques encourus\xe2\x80\xa6</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>toute personne (agent public ou op\xc3\xa9rateur priv\xc3\xa9), qui bravera cette interdiction ou facilitera une modification hors d\xc3\xa9lai, s'expose \xc3\xa0 des poursuites et des sanctions disciplinaires et p\xc3\xa9nales pour complicit\xc3\xa9 de fraude.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>il est donc attendu des op\xc3\xa9rateurs \xc3\xa9conomiques de redoubler de vigilance lors de la saisie initiale des donn\xc3\xa9es, au respect scrupuleux des d\xc3\xa9lais, mais aussi de faire preuve du civisme fiscal. c\xe2\x80\x99est dire que le civisme fiscal et le respect scrupuleux des proc\xc3\xa9dures ne sont pas n\xc3\xa9gociables.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>la r\xc3\xa9daction</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.243
country_id: 2287781
description:
2026-06-16 10:22:04 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.243]:18180: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.30.113.9
country_id: 3175395
description:
Jun 16 10:22:17 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.30.113.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 10:21:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:3572: 535 Incorrect authentication data (set_id=uaa@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 10:21:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:2276: 535 Incorrect authentication data (set_id=asdfghjkl@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 10:21:44 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.30.113.9
country_id: 3175395
description:
2026-06-16 10:22:19 dovecot_login authenticator failed for H=(185.30.113.9) [185.30.113.9]:41550: 535 Incorrect authentication data (set_id=adegunle.bikounle@togosem.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 10:21:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 10:21:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:52892: 535 Incorrect authentication data (set_id=kitti@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 10:21:35 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.243
country_id: 2287781
description:
2026-06-16 10:23:04 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.243]:18182: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 10:22:22 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 10:22:40 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 10:22:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:58002: 535 Incorrect authentication data (set_id=prod@ns5.netmaster.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 10:23:05 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:63486: 535 Incorrect authentication data (set_id=rsm@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 10:22:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:58096: 535 Incorrect authentication data (set_id=mercator@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 10:22:24 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 10:22:26 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:60018: 535 Incorrect authentication data (set_id=wilda@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 10:23:40 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 10:23:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:51756: 535 Incorrect authentication data (set_id=tt@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 10:23:33 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.243
country_id: 2287781
description:
2026-06-16 10:24:06 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.243]:7040: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 10:23:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 10:23:27 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:36588: 535 Incorrect authentication data (set_id=m6@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 10:23:42 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:40904: 535 Incorrect authentication data (set_id=aad@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.243
country_id: 2287781
description:
2026-06-16 10:25:07 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.243]:3968: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 10:24:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 10:24:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:22286: 535 Incorrect authentication data (set_id=ishop@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 10:24:40 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 114.119.156.206
country_id: 1880251
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/foganne-une-grande-carriere-musicale-en-vue-apres-the-voice-afrique-francophone/<script async src||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.108.240.64
country_id: 2017370
description:
2026-06-16 10:25:17 dovecot_plain authenticator failed for H=(0pjharxhkbj64ov05ke0a) [176.108.240.64]:42185: 535 Incorrect authentication data (set_id=sessou.e@inger.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 10:25:14 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:36488: 535 Incorrect authentication data (set_id=audit3@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.108.240.64
country_id: 2017370
description:
Jun 16 10:25:15 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.108.240.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 10:24:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:41560: 535 Incorrect authentication data (set_id=notspam@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 10:24:24 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 10:24:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:43236: 535 Incorrect authentication data (set_id=av2@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 10:25:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 10:25:27 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-16 10:25:37 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:38282: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 10:25:41 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:32002: 535 Incorrect authentication data (set_id=bob@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.243
country_id: 2287781
description:
2026-06-16 10:26:06 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.243]:18944: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 10:25:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:34584: 535 Incorrect authentication data (set_id=smtp03@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 10:25:29 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:20120: 535 Incorrect authentication data (set_id=natalka@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 10:25:39 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 10:26:22 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:14218: 535 Incorrect authentication data (set_id=lpm@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 10:26:21 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:19256: 535 Incorrect authentication data (set_id=exch@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 10:26:25 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 10:26:30 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:26312: 535 Incorrect authentication data (set_id=mapy@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.122.162
country_id: 2363686
description:
2026-06-16 10:26:39 dovecot_plain authenticator failed for H=([10.10.30.98]) [196.170.122.162]:48894: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.243
country_id: 2287781
description:
2026-06-16 10:27:07 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.243]:2562: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 10:26:27 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 10:26:28 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-16 10:27:09 +0000] info [webmaild] 102.176.253.226 - secre.gene@ucao-uut.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.176.253.226
country_id: 2363686
description:
[2026-06-16 10:27:23 +0000] info [webmaild] 102.176.253.226 - secre.gene@ucao-uut.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 8.231.213.114
country_id: 6252001
domain: dankpen1.mairie.tg
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.17||T:APACHE||MV:/wp-includes/id3/license.txt/wp-json/wp/v2/users/||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.158
country_id: 130758
description:
Jun 16 10:27:23 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 10:27:23 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:16372: 535 Incorrect authentication data (set_id=factory@ns5.netmaster.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.158
country_id: 130758
description:
2026-06-16 10:27:25 dovecot_login authenticator failed for H=(localhost) [81.30.98.158]:60948: 535 Incorrect authentication data (set_id=sz@ns5.netmaster.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.62
country_id: 130758
description:
Jun 16 10:27:21 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.30.98.142
country_id: 130758
description:
Jun 16 10:27:30 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.30.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.243
country_id: 2287781
description:
2026-06-16 10:28:09 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.243]:2564: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 81.30.98.62
country_id: 130758
description:
2026-06-16 10:27:24 dovecot_login authenticator failed for H=(localhost) [81.30.98.62]:5564: 535 Incorrect authentication data (set_id=factory@ns5.netmaster.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 138.84.63.233
country_id: 3865483
description:
138.84.63.233 - - [16/Jun/2026:10:27:27 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9619298&pdata=https%253A%252F%252Ftogodailynews.tg%252Fproximite-entre-forces-de-securite-et-habitants-au-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781605644 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/proximite-entre-forces-de-securite-et-habitants-au-togo/" "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.3600.1584 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:138.84.63.233


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.142
country_id: 130758
description:
2026-06-16 10:27:32 dovecot_login authenticator failed for H=(localhost) [81.30.98.142]:17954: 535 Incorrect authentication data (set_id=innovation@ns5.netmaster.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.181.68.187
country_id: 6252001
description:
[2026-06-16 10:29:20 +0000] info [cpaneld] 217.181.68.187 - ljrwwgxg "POST /execute/Fileman/save_file_content?dir=public_html&path=public_html&from_charset=UTF-8&content=%3C%3Fphp+%24s+%3D+%22false%22%3Bif+%28mail%28%24_COOKIE%5B%22email_send_id%22%5D%2C%22Shell+Send+%23%22.%24_COOKIE%5B%22it_id%22%5D%2C%22Cp+Send+Working+..+%23%22.%24_COOKIE%5B%22it_id%22%5D.%22%5CnHash%3A+%22.md5%28time%28%29.uniqid%28%29%29%29%29+%7B%24s+%3D+%22true%22%3B%7Decho+%24s%3B%3F%3E&file=test123Cp.php&file_name=test123Cp.php HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [16/Jun/2026:10:28:34 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [16/Jun/2026:10:28:35 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.243
country_id: 2287781
description:
2026-06-16 10:29:09 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.243]:2566: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.243
country_id: 2287781
description:
2026-06-16 10:30:10 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.243]:2570: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.243
country_id: 2287781
description:
2026-06-16 10:30:43 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.243]:2573: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.168.76.90
country_id: 1733045
description:
[2026-06-16 10:31:52 +0000] info [cpaneld] 202.168.76.90 - vitrinenews "GET /login/?login_only=1&user=vitrinenews&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitrinenews (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.139.17.231
country_id: 3865483
description:
[2026-06-16 10:32:05 +0000] info [cpaneld] 186.139.17.231 - vitrinen "GET /login/?login_only=1&user=vitrinen&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitrinen (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.173.5.64
country_id: 3895114
description:
[2026-06-16 10:32:12 +0000] info [cpaneld] 152.173.5.64 - vitrin "GET /login/?login_only=1&user=vitrin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitrin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.243
country_id: 2287781
description:
2026-06-16 10:32:14 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.243]:18304: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.131.254.163
country_id: 3865483
description:
[2026-06-16 10:32:19 +0000] info [cpaneld] 186.131.254.163 - vitr "GET /login/?login_only=1&user=vitr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 148.224.10.80
country_id: 3996063
description:
[2026-06-16 10:32:02 +0000] info [cpaneld] 148.224.10.80 - vitrinene "GET /login/?login_only=1&user=vitrinene&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitrinene (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.180.146.220
country_id: 3469034
description:
[2026-06-16 10:32:09 +0000] info [cpaneld] 45.180.146.220 - vitrine "GET /login/?login_only=1&user=vitrine&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitrine (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 60.49.69.89
country_id: 1733045
description:
[2026-06-16 10:31:48 +0000] info [cpaneld] 60.49.69.89 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.70.13.60
country_id: 285570
description:
[2026-06-16 10:31:56 +0000] info [cpaneld] 188.70.13.60 - vitrinenewstg "GET /login/?login_only=1&user=vitrinenewstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vitrinenewstg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.190.125.72
country_id: 3625428
description:
[2026-06-16 10:32:30 +0000] info [cpaneld] 38.190.125.72 - vi "GET /login/?login_only=1&user=vi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.250.61.221
country_id: 3469034
description:
[2026-06-16 10:32:27 +0000] info [cpaneld] 167.250.61.221 - vit "GET /login/?login_only=1&user=vit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.153.117.218
country_id: 3625428
description:
[2026-06-16 10:32:26 +0000] info [cpaneld] 190.153.117.218 - vi "GET /login/?login_only=1&user=vi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.243
country_id: 2287781
description:
2026-06-16 10:33:12 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.243]:2176: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.243
country_id: 2287781
description:
2026-06-16 10:34:14 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.243]:13696: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 94.154.127.122
country_id: 174982
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:94.154.127.122||TA:94.154.127.122||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [16/Jun/2026:10:34:39 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6723018&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781606077 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [16/Jun/2026:10:34:40 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6317461&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781606077 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.222.123.96
country_id: 2921044
description:
2026-06-16 10:35:01 dovecot_plain authenticator failed for H=(fmk02zd354lfhiddrmrnr9t9uhk6n) [89.222.123.96]:36038: 535 Incorrect authentication data (set_id=contact@dany2.mairie.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.243
country_id: 2287781
description:
2026-06-16 10:35:15 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.243]:13057: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.243
country_id: 2287781
description:
2026-06-16 10:36:18 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.243]:13060: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.153.197
country_id: 2635167
description:
[2026-06-16 10:36:57 +0000] info [cpaneld] 5.230.153.197 NEW ifxmoxbf:yKMVK9NavrV5tsRw address=5.230.153.197,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.133.223
country_id: 2635167
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.845998131957168.php||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.243
country_id: 2287781
description:
2026-06-16 10:37:19 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.243]:4224: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.243
country_id: 2287781
description:
2026-06-16 10:38:19 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.243]:7552: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-16 10:37:32 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:35808: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.243
country_id: 2287781
description:
2026-06-16 10:39:29 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.243]:13056: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-16 10:39:40 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:36934: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 91.134.142.208
country_id: 3017382
description:
91.134.142.208 - - [16/Jun/2026:10:40:26 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6581141&pdata=http%253A%252F%252Fafrique-distribution.net&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781606423 HTTP/1.1" 302 0 afrique-distribution.net "http://afrique-distribution.net/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:91.134.142.208


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.243
country_id: 2287781
description:
2026-06-16 10:40:29 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.243]:15232: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.152.14.128
country_id: 192950
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1150518248 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.243
country_id: 2287781
description:
2026-06-16 10:41:30 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.243]:10240: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.122.162
country_id: 2363686
description:
2026-06-16 10:41:46 dovecot_plain authenticator failed for H=([10.10.30.98]) [196.170.122.162]:38610: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.248.146.251
country_id: 192950
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/09/WhatsApp-Image-2024-09-21-at-21.45.32-1024x683.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/09/WhatsApp-Image-2024-09-21-at-21.45.32-300x200.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2024/09/WhatsApp-Image-2024-09-21-at-21.45.32-768x512.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2024/09/WhatsApp-Image-2024-09-21-at-21.45.32-272x182.jpeg 272w, http:/togodailynews.tg/wp-content/uploads/2024/09/WhatsApp-Image-2024-09-21-at-21.45.32.jpeg 1080w HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [16/Jun/2026:10:42:24 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [16/Jun/2026:10:42:25 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.243
country_id: 2287781
description:
2026-06-16 10:42:31 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.243]:10243: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.243
country_id: 2287781
description:
2026-06-16 10:43:30 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.243]:10246: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.176.142.4
country_id: 3017382
description:
[2026-06-16 10:43:30 +0000] info [cpaneld] 88.176.142.4 - mftogotg "GET /login/?login_only=1&user=mftogotg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mftogotg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.34.111.158
country_id: 1282988
description:
[2026-06-16 10:43:39 +0000] info [cpaneld] 27.34.111.158 - mfto "GET /login/?login_only=1&user=mfto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mfto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.190.187.34
country_id: 1694008
description:
[2026-06-16 10:43:44 +0000] info [cpaneld] 180.190.187.34 - mft "GET /login/?login_only=1&user=mft&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mft (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.243
country_id: 2287781
description:
2026-06-16 10:44:32 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.243]:10249: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 51.91.156.252
country_id: 3017382
description:
51.91.156.252 - - [16/Jun/2026:10:46:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855325&pdata=https%253A%252F%252Fafrique-distribution.net&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781606795 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:149.0) Gecko/20100101 Firefox/149.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:51.91.156.252


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.28.222.16
country_id: 660013
description:
Jun 16 10:46:40 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.28.222.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.222.16
country_id: 660013
description:
2026-06-16 10:46:42 dovecot_plain authenticator failed for H=(hp6jcurcwvisjcvkr0wu9nh7o4c9l6) [104.28.222.16]:42922: 535 Incorrect authentication data (set_id=admin@togocarrierebetons.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.226.52.29
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/09/WhatsApp-Image-2024-09-21-at-21.45.29.jpeg 1600w, http:/togodailynews.tg/wp-content/uploads/2024/09/WhatsApp-Image-2024-09-21-at-21.45.29-300x200.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2024/09/WhatsApp-Image-2024-09-21-at-21.45.29-1024x683.jpeg 1024w, http:/togodailynews.tg/wp-content/uploads/2024/09/WhatsApp-Image-2024-09-21-at-21.45.29-768x512.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2024/09/WhatsApp-Image-2024-09-21-at-21.45.29-1536x1024.jpeg 1536w, http:/togodailynews.tg/wp-content/uploads/2024/09/WhatsApp-Image-2024-09-21-at-21.45.29-272x182.jpeg 272w HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.202
country_id: 1880251
description:
47.128.96.202 - - [16/Jun/2026:10:46:29 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6593686&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fsos-village-denfants%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781606787 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/sos-village-denfants/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.202


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.243
country_id: 2287781
description:
2026-06-16 10:49:06 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.243]:12544: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [16/Jun/2026:10:49:51 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6710425&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781606990 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [16/Jun/2026:10:49:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10012614&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781606994 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.243
country_id: 2287781
description:
2026-06-16 10:50:07 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.243]:6272: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 41.78.138.46
country_id: 2363686
description:
[2026-06-16 10:50:26 +0000] info [webmaild] 41.78.138.46 - controleur.interne@ucao-uut.tg "POST /cpsess5006793826/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [102.176.253.226] != Current IP Address [41.78.138.46]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.219.243
country_id: 2287781
description:
2026-06-16 10:51:17 dovecot_login authenticator failed for H=(ELISABETH) [102.209.219.243]:10624: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.193.90.42
country_id: 290557
description:
[2026-06-16 10:52:14 +0000] info [cpaneld] 5.193.90.42 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.100.109.105
country_id: 3658394
description:
[2026-06-16 10:52:17 +0000] info [cpaneld] 157.100.109.105 - nps "GET /login/?login_only=1&user=nps&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nps (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.212.29
country_id: 2661886
description:
2026-06-16 10:53:06 dovecot_login authenticator failed for H=90-230-212-29-no2550.tbcn.telia.com (testmft.sedgwick.com) [90.230.212.29]:47440: 535 Incorrect authentication data (set_id=pascaljoseph.panassi@sodigaz.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.230.212.29
country_id: 2661886
description:
Jun 16 10:53:04 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.230.212.29 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 203.99.145.42
country_id: 1210997
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/uploads/images/5.jpeg HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.39.81.98
country_id: 732800
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/695173311 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.223
country_id: 2635167
description:
[2026-06-16 10:56:10 +0000] info [cpaneld] 5.230.133.223 NEW wcnyaruu:GR3SHfmprnhgn95C address=5.230.133.223,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [16/Jun/2026:10:55:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [16/Jun/2026:10:55:33 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 89.249.195.215
country_id: 6252001
domain: dankpen1.mairie.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:89.249.195.215||TA:89.249.195.215||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.137.89.135
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/948979 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.217.19.79
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/575642785 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.109.234.10
country_id: 3923057
description:
[2026-06-16 10:58:34 +0000] info [cpaneld] 190.109.234.10 - brmn "GET /login/?login_only=1&user=brmn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user brmn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.131.54.0
country_id: 3469034
description:
[2026-06-16 10:58:42 +0000] info [cpaneld] 177.131.54.0 - brm "GET /login/?login_only=1&user=brm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user brm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.22.43.26
country_id: 1605651
description:
[2026-06-16 10:58:46 +0000] info [cpaneld] 184.22.43.26 - br "GET /login/?login_only=1&user=br&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user br (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.98.73.247
country_id: 102358
description:
[2026-06-16 11:00:45 +0000] info [cpaneld] 94.98.73.247 - snbtg "GET /login/?login_only=1&user=snbtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user snbtg (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.151.139.104
country_id: 3996063
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/09/cc88f2d6d7efb87c36fab36d95f2f33a_L.jpg 600w, http:/togodailynews.tg/wp-content/uploads/2024/09/cc88f2d6d7efb87c36fab36d95f2f33a_L-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2024/09/cc88f2d6d7efb87c36fab36d95f2f33a_L-272x182.jpg 272w HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.119.158
country_id: 1880251
description:
47.128.119.158 - - [16/Jun/2026:11:01:55 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7105386&pdata=https%253A%252F%252Fmediatopnews.tg%252Fwp-content%252Fuploads%252F2026%252F05%252FTOF-AN-ENVI-2.jpeg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781607714 HTTP/2.0" 302 0 mediatopnews.tg "https://mediatopnews.tg/wp-content/uploads/2026/05/TOF-AN-ENVI-2.jpeg" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.119.158


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.107.77.97
country_id: 1210997
description:
103.107.77.97 - - [16/Jun/2026:11:02:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9686122&pdata=https%253A%252F%252Ftdn.tg%252Ftogo-liste-ope-recensement-biometrique%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781607778 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/togo-liste-ope-recensement-biometrique/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.6151.1249 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.107.77.97


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.170.66.202
country_id: 2363686
description:
[2026-06-16 11:02:33 +0000] info [cpaneld] 196.170.66.202 NEW ingertgsarl:hH3sfjuozGXozyD8 address=196.170.66.202,app=cpaneld,creator=ingertgsarl,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.62.228
country_id: 6252001
description:
[2026-06-16 11:03:30 +0000] info [cpaneld] 64.44.62.228 NEW wcnyaruu:LgkBE83Cb5Ck_cP8 address=64.44.62.228,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.89
country_id: 2635167
description:
[2026-06-16 11:04:43 +0000] info [cpaneld] 5.230.133.89 NEW wcnyaruu:w5bWFcDpTui_pENf address=5.230.133.89,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 86.123.237.50
country_id: 798549
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2024-01-10-a-13.05.06_ef5f3e5b-768x512.webp 768w, http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2024-01-10-a-13.05.06_ef5f3e5b-300x200.webp 300w, http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2024-01-10-a-13.05.06_ef5f3e5b-1024x682.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2024-01-10-a-13.05.06_ef5f3e5b-1536x1023.webp 1536w, http:/togodailynews.tg/wp-content/uploads/2026/06/WhatsApp-Image-2024-01-10-a-13.05.06_ef5f3e5b.webp 1600w HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.123.42.8
country_id: 1168579
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/09/Page-3A-1.jpg 800w, http:/togodailynews.tg/wp-content/uploads/2022/09/Page-3A-1-300x225.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2022/09/Page-3A-1-768x576.jpg 768w HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.127.214.136
country_id: 3437598
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2024/09/Communique-de-la-conference-des-eveques-du-Togo-CET-au-sujet-du-deces-de-leclesiatique-696x464-1.jpg 696w, http:/togodailynews.tg/wp-content/uploads/2024/09/Communique-de-la-conference-des-eveques-du-Togo-CET-au-sujet-du-deces-de-leclesiatique-696x464-1-300x200.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2024/09/Communique-de-la-conference-des-eveques-du-Togo-CET-au-sujet-du-deces-de-leclesiatique-696x464-1-272x182.jpg 272w HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.165.169.63
country_id: 1562822
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/09/Page-3A.jpg 800w, http:/togodailynews.tg/wp-content/uploads/2022/09/Page-3A-300x167.jpg 300w, http:/togodailynews.tg/wp-content/uploads/2022/09/Page-3A-768x427.jpg 768w HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.48.253.125
country_id: 3865483
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/75ad9f HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [16/Jun/2026:11:05:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9986157&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781607932 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [16/Jun/2026:11:05:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7181418&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781607935 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.122.162
country_id: 2363686
description:
2026-06-16 11:07:03 dovecot_plain authenticator failed for H=([10.10.30.98]) [196.170.122.162]:44674: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.137.30.25
country_id: 1269750
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/06/madagascarnewsroom-madagascar-assurance-agricole-ifc.webp 750w, http:/togodailynews.tg/wp-content/uploads/2026/06/madagascarnewsroom-madagascar-assurance-agricole-ifc-300x180.webp 300w HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.114.67.129
country_id: 1269750
description:
[2026-06-16 11:07:57 +0000] info [cpaneld] 103.114.67.129 - sococ "GET /login/?login_only=1&user=sococ&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sococ (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.164.174.237
country_id: 3508796
description:
[2026-06-16 11:07:46 +0000] info [cpaneld] 45.164.174.237 - sococim "GET /login/?login_only=1&user=sococim&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sococim (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.35.251.55
country_id: 783754
description:
[2026-06-16 11:07:49 +0000] info [cpaneld] 194.35.251.55 - sococim "GET /login/?login_only=1&user=sococim&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sococim (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.184.33.22
country_id: 6254930
description:
[2026-06-16 11:08:00 +0000] info [cpaneld] 85.184.33.22 - sococi "GET /login/?login_only=1&user=sococi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sococi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.121.219.51
country_id: 3625428
description:
[2026-06-16 11:08:03 +0000] info [cpaneld] 38.121.219.51 - sococ "GET /login/?login_only=1&user=sococ&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sococ (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.161.142.25
country_id: 290291
description:
[2026-06-16 11:08:17 +0000] info [cpaneld] 109.161.142.25 - so "GET /login/?login_only=1&user=so&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user so (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 147.235.221.154
country_id: 294640
description:
[2026-06-16 11:07:50 +0000] info [cpaneld] 147.235.221.154 - sococimtg "GET /login/?login_only=1&user=sococimtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sococimtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.188.8.162
country_id: 3996063
description:
[2026-06-16 11:07:53 +0000] info [cpaneld] 187.188.8.162 - sococi "GET /login/?login_only=1&user=sococi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sococi (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 129.222.187.65
country_id: 192950
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/09/Page-4-B-1.jpg 320w, http:/togodailynews.tg/wp-content/uploads/2022/09/Page-4-B-1-300x225.jpg 300w HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.51.60.216
country_id: 3508796
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2026/04/telechargement-3.webp 303w, http:/togodailynews.tg/wp-content/uploads/2026/04/telechargement-3-300x164.webp 300w HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.223.141.87
country_id: 933860
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/1866197720 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.82.55
country_id: 6252001
description:
[2026-06-16 11:08:57 +0000] info [cpaneld] 134.195.82.55 NEW wcnyaruu:kLl_JvxhpDlexto8 address=134.195.82.55,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.245.240.61
country_id: 6252001
domain: tdn.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:104.245.240.61||TA:104.245.240.61||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.165.143
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>l\xe2\x80\x99ex\xc3\xa9cutif togolais intensifie sa lutte pour le bien-\xc3\xaatre des populations. une vaste campagne de traitement de masse contre les maladies tropicales n\xc3\xa9glig\xc3\xa9es (mtn) est actuellement en cours dans plusieurs r\xc3\xa9gions du pays. pr\xc3\xa9vue pour se d\xc3\xa9rouler jusqu\xe2\x80\x99au 24 juin, cette initiative citoyenne et sanitaire, vise \xc3\xa0 prot\xc3\xa9ger les communaut\xc3\xa9s locales et \xc3\xa0 franchir un nouveau pas vers un togo sans mtn.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ladite campagne se d\xc3\xa9ploie \xc3\xa0 grande \xc3\xa9chelle et couvre une majeure partie du territoire national, \xc3\xa0 savoir les r\xc3\xa9gions des savanes, de la kara, centrale, et des plateaux.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>l'objectif principal de cette intervention est de pr\xc3\xa9munir les populations contre plusieurs maladies tropicales n\xc3\xa9glig\xc3\xa9es n\xc3\xa9cessitant une chimioth\xc3\xa9rapie pr\xc3\xa9ventive. les autorit\xc3\xa9s sanitaires vivent principalement l\xe2\x80\x99onchocercose (commun\xc3\xa9ment appel\xc3\xa9e la c\xc3\xa9cit\xc3\xa9 des rivi\xc3\xa8res), les g\xc3\xa9ohelminthiases (les infections par les vers intestinaux), et les schistosomiases (la bilharziose).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31006,\"sizeslug\":\"full\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-full\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/otr_ferer-pour-batir-1.jpg\" alt=\"\" class=\"wp-image-31006\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>la strat\xc3\xa9gie de cette campagne repose sur l\xe2\x80\x99administration gratuite de m\xc3\xa9dicaments adapt\xc3\xa9s aux profils des populations vuln\xc3\xa9rables. la distribution se structure de la mani\xc3\xa8re suivante&nbsp;: l\xe2\x80\x99albendazole est distribu\xc3\xa9 aux enfants \xc3\xa2g\xc3\xa9s de 5 \xc3\xa0 14 ans pour lutter contre les vers intestinaux, le praziquantel pour pr\xc3\xa9venir et traiter la schistosomiase dans cette m\xc3\xaame tranche d\xe2\x80\x99\xc3\xa2ge, alors que l\xe2\x80\x99ivermectine sera, quant \xc3\xa0 elle, administr\xc3\xa9e aux personnes \xc3\xa2g\xc3\xa9es de 5 ans et plus vivant dans les zones concern\xc3\xa9es par l\xe2\x80\x99onchocercose.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>pour r\xc3\xa9ussir ce pari sanitaire, l'engagement de chaque citoyen est indispensable. lors du lancement officiel, le secr\xc3\xa9taire g\xc3\xa9n\xc3\xa9ral du minist\xc3\xa8re de la sant\xc3\xa9, wotob\xc3\xa9 kokou, a d'ailleurs lanc\xc3\xa9 un appel vibrant \xc3\xa0 la population. <em>\xc2\xab en participant massivement \xc3\xa0 cette campagne, nous contribuons collectivement \xc3\xa0 prot\xc3\xa9ger la sant\xc3\xa9 de nos communaut\xc3\xa9s et \xc3\xa0 construire un togo d\xc3\xa9barrass\xc3\xa9 des maladies tropicales n\xc3\xa9glig\xc3\xa9es \xc2\xbb, </em>a-t-il soulign\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31146,\"width\":\"630px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/image-30-724x1024.png\" alt=\"\" class=\"wp-image-31146\" style=\"width:630px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>notons que cette nouvelle campagne s'inscrit dans la continuit\xc3\xa9 des succ\xc3\xa8s sanitaires remarquables du pays. tr\xc3\xa8s engag\xc3\xa9 sur cette th\xc3\xa9matique ces derni\xc3\xa8res ann\xc3\xa9es, le togo a d\xc3\xa9j\xc3\xa0 \xc3\xa9t\xc3\xa9 officiellement distingu\xc3\xa9 par l\xe2\x80\x99organisation mondiale de la sant\xc3\xa9 (oms) pour avoir \xc3\xa9radiqu\xc3\xa9 avec succ\xc3\xa8s quatre de ces affections (notamment la filariose lymphatique, le trachome, la trypanosomiase humaine africaine et la maladie du ver de guin\xc3\xa9e).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>mc</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 196.171.122.34
country_id: 2363686
description:
[2026-06-16 11:10:13 +0000] info [cpaneld] 196.171.122.34 NEW mvfxewjz:1MtvGA39FALd5Qrs address=196.171.122.34,app=cpaneld,creator=mvfxewjz,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-16 11:10:18 +0000] info [webmaild] 160.242.195.10 - tbassowa@caissederetraites.tg "GET /cpsess5972263390/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [16/Jun/2026:11:10:33 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.28.149.77
country_id: 3469034
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2022/09/Page-3A.jpeg 1040w, http:/togodailynews.tg/wp-content/uploads/2022/09/Page-3A-300x225.jpeg 300w, http:/togodailynews.tg/wp-content/uploads/2022/09/Page-3A-768x576.jpeg 768w, http:/togodailynews.tg/wp-content/uploads/2022/09/Page-3A-1024x768.jpeg 1024w HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-16 11:10:27 +0000] info [webmaild] 160.242.195.10 - tbassowa@caissederetraites.tg "GET /cpsess3370059187/3rdparty/roundcube/?_task=mail&_mbox=INBOX&_page=3 HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [16/Jun/2026:11:10:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.166.35.198
country_id: 3625428
description:
[2026-06-16 11:11:24 +0000] info [cpaneld] 38.166.35.198 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.243.41.254
country_id: 2017370
description:
[2026-06-16 11:11:31 +0000] info [cpaneld] 94.243.41.254 - sodiga "GET /login/?login_only=1&user=sodiga&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sodiga (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.105.243.126
country_id: 2589581
description:
[2026-06-16 11:11:35 +0000] info [cpaneld] 41.105.243.126 - sodigaztg "GET /login/?login_only=1&user=sodigaztg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sodigaztg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.186.30.219
country_id: 298795
description:
[2026-06-16 11:11:44 +0000] info [cpaneld] 78.186.30.219 - sodig "GET /login/?login_only=1&user=sodig&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sodig (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.106.56.53
country_id: 99237
description:
[2026-06-16 11:11:47 +0000] info [cpaneld] 91.106.56.53 - sodi "GET /login/?login_only=1&user=sodi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sodi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 90.39.106.35
country_id: 3017382
description:
[2026-06-16 11:11:51 +0000] info [cpaneld] 90.39.106.35 - sod "GET /login/?login_only=1&user=sod&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sod (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 93.175.42.227
country_id: 294640
description:
[2026-06-16 11:11:24 +0000] info [cpaneld] 93.175.42.227 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.140.114.29
country_id: 2017370
description:
[2026-06-16 11:11:27 +0000] info [cpaneld] 85.140.114.29 - sodigaz "GET /login/?login_only=1&user=sodigaz&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.207.216.6
country_id: 3996063
description:
[2026-06-16 11:11:29 +0000] info [cpaneld] 187.207.216.6 - sodigaztg "GET /login/?login_only=1&user=sodigaztg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sodigaztg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.248.56.107
country_id: 1210997
description:
[2026-06-16 11:11:40 +0000] info [cpaneld] 161.248.56.107 - sodi "GET /login/?login_only=1&user=sodi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sodi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.173.25.254
country_id: 3865483
description:
[2026-06-16 11:11:55 +0000] info [cpaneld] 190.173.25.254 - so "GET /login/?login_only=1&user=so&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user so (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.248.40.163
country_id: 192950
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/9b9497 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 205.209.64.173
country_id: 102358
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/bbb2b3 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.164.114.98
country_id: 3469034
description:
[2026-06-16 11:14:07 +0000] info [cpaneld] 45.164.114.98 - soeurndeto "GET /login/?login_only=1&user=soeurndeto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soeurndeto (has_cpuser_file failed)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.165.143
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>l\xe2\x80\x99ex\xc3\xa9cutif togolais intensifie sa lutte pour le bien-\xc3\xaatre des populations. une vaste campagne de traitement de masse contre les maladies tropicales n\xc3\xa9glig\xc3\xa9es (mtn) est actuellement en cours dans plusieurs r\xc3\xa9gions du pays. pr\xc3\xa9vue pour se d\xc3\xa9rouler jusqu\xe2\x80\x99au 24 juin, cette initiative citoyenne et sanitaire, vise \xc3\xa0 prot\xc3\xa9ger les communaut\xc3\xa9s locales et \xc3\xa0 franchir un nouveau pas vers un togo sans mtn.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ladite campagne se d\xc3\xa9ploie \xc3\xa0 grande \xc3\xa9chelle et couvre une majeure partie du territoire national, \xc3\xa0 savoir les r\xc3\xa9gions des savanes, de la kara, centrale, et des plateaux.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>l'objectif principal de cette intervention est de pr\xc3\xa9munir les populations contre plusieurs maladies tropicales n\xc3\xa9glig\xc3\xa9es n\xc3\xa9cessitant une chimioth\xc3\xa9rapie pr\xc3\xa9ventive. les autorit\xc3\xa9s sanitaires vivent principalement l\xe2\x80\x99onchocercose (commun\xc3\xa9ment appel\xc3\xa9e la c\xc3\xa9cit\xc3\xa9 des rivi\xc3\xa8res), les g\xc3\xa9ohelminthiases (les infections par les vers intestinaux), et les schistosomiases (la bilharziose).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31006,\"sizeslug\":\"full\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-full\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/otr_ferer-pour-batir-1.jpg\" alt=\"\" class=\"wp-image-31006\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>la strat\xc3\xa9gie de cette campagne repose sur l\xe2\x80\x99administration gratuite de m\xc3\xa9dicaments adapt\xc3\xa9s aux profils des populations vuln\xc3\xa9rables. la distribution se structure de la mani\xc3\xa8re suivante&nbsp;: l\xe2\x80\x99albendazole est distribu\xc3\xa9 aux enfants \xc3\xa2g\xc3\xa9s de 5 \xc3\xa0 14 ans pour lutter contre les vers intestinaux, le praziquantel pour pr\xc3\xa9venir et traiter la schistosomiase dans cette m\xc3\xaame tranche d\xe2\x80\x99\xc3\xa2ge, alors que l\xe2\x80\x99ivermectine sera, quant \xc3\xa0 elle, administr\xc3\xa9e aux personnes \xc3\xa2g\xc3\xa9es de 5 ans et plus vivant dans les zones concern\xc3\xa9es par l\xe2\x80\x99onchocercose.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>pour r\xc3\xa9ussir ce pari sanitaire, l'engagement de chaque citoyen est indispensable. lors du lancement officiel, le secr\xc3\xa9taire g\xc3\xa9n\xc3\xa9ral du minist\xc3\xa8re de la sant\xc3\xa9, wotob\xc3\xa9 kokou, a d'ailleurs lanc\xc3\xa9 un appel vibrant \xc3\xa0 la population. <em>\xc2\xab en participant massivement \xc3\xa0 cette campagne, nous contribuons collectivement \xc3\xa0 prot\xc3\xa9ger la sant\xc3\xa9 de nos communaut\xc3\xa9s et \xc3\xa0 construire un togo d\xc3\xa9barrass\xc3\xa9 des maladies tropicales n\xc3\xa9glig\xc3\xa9es \xc2\xbb, </em>a-t-il soulign\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31146,\"width\":\"630px\",\"height\":\"auto\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/image-30-724x1024.png\" alt=\"\" class=\"wp-image-31146\" style=\"width:630px;height:auto\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>notons que cette nouvelle campagne s'inscrit dans la continuit\xc3\xa9 des succ\xc3\xa8s sanitaires remarquables du pays. tr\xc3\xa8s engag\xc3\xa9 sur cette th\xc3\xa9matique ces derni\xc3\xa8res ann\xc3\xa9es, le togo a d\xc3\xa9j\xc3\xa0 \xc3\xa9t\xc3\xa9 officiellement distingu\xc3\xa9 par l\xe2\x80\x99organisation mondiale de la sant\xc3\xa9 (oms) pour avoir \xc3\xa9radiqu\xc3\xa9 avec succ\xc3\xa8s quatre de ces affections (notamment la filariose lymphatique, le trachome, la trypanosomiase humaine africaine et la maladie du ver de guin\xc3\xa9e).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>mc</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.141.175.118
country_id: 1733045
description:
[2026-06-16 11:13:59 +0000] info [cpaneld] 175.141.175.118 - soeurndetogocom "GET /login/?login_only=1&user=soeurndetogocom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soeurndetogocom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.172.110.236
country_id: 2017370
description:
[2026-06-16 11:14:00 +0000] info [cpaneld] 85.172.110.236 - soeurndetogocom "GET /login/?login_only=1&user=soeurndetogocom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soeurndetogocom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.218.121.120
country_id: 1210997
description:
[2026-06-16 11:14:20 +0000] info [cpaneld] 103.218.121.120 - soeurnd "GET /login/?login_only=1&user=soeurnd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soeurnd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.164.251.36
country_id: 1562822
description:
[2026-06-16 11:14:12 +0000] info [cpaneld] 14.164.251.36 - soeurndet "GET /login/?login_only=1&user=soeurndet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soeurndet (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 5.230.133.179
country_id: 2635167
description:
[2026-06-16 11:13:44 +0000] info [cpaneld] 5.230.133.179 NEW wcnyaruu:TEMdb5DqiaayrIzS address=5.230.133.179,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.234.220.148
country_id: 3658394
description:
[2026-06-16 11:14:25 +0000] info [cpaneld] 177.234.220.148 - soeurn "GET /login/?login_only=1&user=soeurn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soeurn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.54.191.196
country_id: 3469034
description:
[2026-06-16 11:14:28 +0000] info [cpaneld] 177.54.191.196 - soeu "GET /login/?login_only=1&user=soeu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soeu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.150.86.28
country_id: 3508796
description:
[2026-06-16 11:14:34 +0000] info [cpaneld] 186.150.86.28 - soe "GET /login/?login_only=1&user=soe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soe (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 64.44.59.244
country_id: 6252001
description:
[2026-06-16 11:15:17 +0000] info [cpaneld] 64.44.59.244 NEW ifxmoxbf:qwRwOaI5pjnp5G75 address=64.44.59.244,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 64.44.59.33
country_id: 6252001
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.593933174054431.php||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.205.101.231
country_id: 2589581
description:
[2026-06-16 11:14:37 +0000] info [cpaneld] 197.205.101.231 - soeu "GET /login/?login_only=1&user=soeu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soeu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.161.20.229
country_id: 6254930
description:
[2026-06-16 11:14:39 +0000] info [cpaneld] 188.161.20.229 - so "GET /login/?login_only=1&user=so&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user so (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-16 11:14:54 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:52620: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 6070
name: Attempt to upload malware through cPanel file manager
description:
Jun 16 11:14:47 ns5.netmaster.tg cpanel_fileman_hook[902312]: 0 BAILOUT malware detected when save 'test123Cp.php' in public_html for user libertepansel


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.115.98.122
country_id: 2542007
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/wp-content/uploads/2025/07/Gestion-des-refugies-au-Togo-le-HCR-felicite-le-President-du-Conseil-1.webp 1280w, http:/togodailynews.tg/wp-content/uploads/2025/07/Gestion-des-refugies-au-Togo-le-HCR-felicite-le-President-du-Conseil-1-300x240.webp 300w, http:/togodailynews.tg/wp-content/uploads/2025/07/Gestion-des-refugies-au-Togo-le-HCR-felicite-le-President-du-Conseil-1-1024x819.webp 1024w, http:/togodailynews.tg/wp-content/uploads/2025/07/Gestion-des-refugies-au-Togo-le-HCR-felicite-le-President-du-Conseil-1-768x614.webp 768w HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 103.164.183.122
country_id: 1831722
description:
[2026-06-16 11:15:21 +0000] info [cpaneld] 103.164.183.122 NEW libertepansel:yXJ_wnjyKnkOnAsl address=103.164.183.122,app=cpaneld,creator=libertepansel,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.211.215.89
country_id: 1733045
description:
[2026-06-16 11:16:33 +0000] info [cpaneld] 113.211.215.89 - kpm "GET /login/?login_only=1&user=kpm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kpm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.105.123.51
country_id: 3585968
description:
[2026-06-16 11:16:33 +0000] info [cpaneld] 143.105.123.51 - kpm "GET /login/?login_only=1&user=kpm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kpm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.189.163.183
country_id: 1210997
description:
[2026-06-16 11:16:36 +0000] info [cpaneld] 103.189.163.183 - kp "GET /login/?login_only=1&user=kp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.239.204.49
country_id: 3658394
description:
[2026-06-16 11:16:24 +0000] info [cpaneld] 170.239.204.49 - kpmg "GET /login/?login_only=1&user=kpmg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.230.86.188
country_id: 1512440
description:
[2026-06-16 11:16:29 +0000] info [cpaneld] 213.230.86.188 - kpmgtg "GET /login/?login_only=1&user=kpmgtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kpmgtg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.177.205.65
country_id: 1562822
description:
[2026-06-16 11:16:37 +0000] info [cpaneld] 113.177.205.65 - kp "GET /login/?login_only=1&user=kp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.176.34.115
country_id: 2542007
description:
[2026-06-16 11:16:21 +0000] info [cpaneld] 160.176.34.115 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.122.162
country_id: 2363686
description:
2026-06-16 11:18:19 dovecot_plain authenticator failed for H=([10.10.30.98]) [196.170.122.162]:45558: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.37.139.163
country_id: 3175395
domain: 4utech.com.cn
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/4utech.com.cn/index.asp HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 119.160.142.129
country_id: 1820814
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/944704515 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.98.225.126
country_id: 1522867
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/product/show/bitter-lemon HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.37.139.163
country_id: 3175395
domain: www.piscessolutions.org
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.piscessolutions.org/Diane_services.html HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.37.139.163
country_id: 3175395
domain: www.djama.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.djama.tg/product/show/chap-limonade HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [16/Jun/2026:11:19:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9671835&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781608753 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.24.152.92
country_id: 3439705
description:
[2026-06-16 11:19:41 +0000] info [cpaneld] 179.24.152.92 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.43.39.216
country_id: 3895114
description:
[2026-06-16 11:19:49 +0000] info [cpaneld] 181.43.39.216 - dkfoodtg "GET /login/?login_only=1&user=dkfoodtg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dkfoodtg (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 193.43.159.184
country_id: 163843
description:
193.43.159.184 - - [16/Jun/2026:11:19:58 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6711914&pdata=https%253A%252F%252Fwebmail.esme.free.netmaster.tg%252F%253Flocale%253Dnb&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781608796 HTTP/2.0" 302 0 webmail.esme.free.netmaster.tg "https://webmail.esme.free.netmaster.tg/?locale=nb" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:193.43.159.184


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.46.161.220
country_id: 2017370
description:
2026-06-16 11:20:02 dovecot_login authenticator failed for H=([171.229.53.229]) [178.46.161.220]:49849: 535 Incorrect authentication data (set_id=kmaithnard@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.46.161.220
country_id: 2017370
description:
Jun 16 11:20:00 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.46.161.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 16.112.128.183
country_id: 1269750
description:
2026-06-16 11:20:39 dovecot_plain authenticator failed for H=ec2-16-112-128-183.ap-south-2.compute.amazonaws.com (1pl7dy8v7hucztdaeqa) [16.112.128.183]:51588: 535 Incorrect authentication data (set_id=j.delbegue@tps.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 138.185.93.254
country_id: 3469034
description:
138.185.93.254 - - [16/Jun/2026:11:20:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9726575&pdata=https%253A%252F%252Fwebmail.express.free.netmaster.tg%252F%253Flocale%253Dzh_tw&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781608841 HTTP/2.0" 302 0 webmail.express.free.netmaster.tg "https://webmail.express.free.netmaster.tg/?locale=zh_tw" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:138.185.93.254


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.0.39.238
country_id: 163843
description:
[2026-06-16 11:21:38 +0000] info [cpaneld] 5.0.39.238 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.173.99.198
country_id: 1562822
description:
[2026-06-16 11:21:52 +0000] info [cpaneld] 113.173.99.198 - wage "GET /login/?login_only=1&user=wage&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wage (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 203.9.210.5
country_id: 1282988
description:
[2026-06-16 11:22:44 +0000] info [cpaneld] 203.9.210.5 - ese2i "GET /login/?login_only=1&user=ese2i&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ese2i (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.38.44.59
country_id: 290557
description:
[2026-06-16 11:23:03 +0000] info [cpaneld] 5.38.44.59 - es "GET /login/?login_only=1&user=es&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user es (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.188.136.115
country_id: 1210997
description:
[2026-06-16 11:22:51 +0000] info [cpaneld] 103.188.136.115 - ese2itg "GET /login/?login_only=1&user=ese2itg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ese2itg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.245.225.153
country_id: 3996063
description:
[2026-06-16 11:22:41 +0000] info [cpaneld] 177.245.225.153 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.56.86.36
country_id: 2635167
description:
[2026-06-16 11:22:44 +0000] info [cpaneld] 62.56.86.36 - ese2i "GET /login/?login_only=1&user=ese2i&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ese2i (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.8.87.45
country_id: 3895114
description:
[2026-06-16 11:22:51 +0000] info [cpaneld] 179.8.87.45 - ese2 "GET /login/?login_only=1&user=ese2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ese2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.94.173.98
country_id: 3469034
description:
[2026-06-16 11:22:55 +0000] info [cpaneld] 201.94.173.98 - ese2 "GET /login/?login_only=1&user=ese2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ese2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.202.30.84
country_id: 2589581
description:
[2026-06-16 11:22:57 +0000] info [cpaneld] 197.202.30.84 - ese "GET /login/?login_only=1&user=ese&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ese (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 16.112.4.92
country_id: 1269750
description:
2026-06-16 11:24:37 dovecot_plain authenticator failed for H=ec2-16-112-4-92.ap-south-2.compute.amazonaws.com (uwnn6r9lodgtz90u3wmtun) [16.112.4.92]:39032: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [16/Jun/2026:11:25:33 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [16/Jun/2026:11:25:32 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.5.108.126
country_id: 2186224
description:
Jun 16 11:25:40 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.5.108.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.122.162
country_id: 2363686
description:
2026-06-16 11:26:45 dovecot_plain authenticator failed for H=([10.10.30.98]) [196.170.122.162]:42538: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.122.147.229
country_id: 6252001
description:
34.122.147.229 - - [16/Jun/2026:11:28:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131862&pdata=https%253A%252F%252F154-70-82-246.cpanel.site&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781609286 HTTP/2.0" 302 0 154-70-82-246.cpanel.site "https://154-70-82-246.cpanel.site/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.122.147.229


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 104.197.69.115
country_id: 6252001
description:
104.197.69.115 - - [16/Jun/2026:11:27:30 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6932118&pdata=https%253A%252F%252F154-70-82-246.cpanel.site&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781609249 HTTP/2.0" 302 0 154-70-82-246.cpanel.site "https://154-70-82-246.cpanel.site/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:104.197.69.115


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.184.145.184
country_id: 1269750
description:
2026-06-16 11:30:01 dovecot_plain authenticator failed for H=(localhost) [223.184.145.184]:3306: 535 Incorrect authentication data (set_id=kido@cafe.tg)


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 89.251.0.49
country_id: 6251999
domain: ccl.tg
description:
IM360 WAF: Block interaction with malicious plugin||RSV:8.17||T:APACHE||SC:/home/udxjqqmt/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/up.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 89.251.0.49
country_id: 6251999
domain: ccl.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.17||T:APACHE||MV:/wp-admin/images/bootstrap.php||SC:/home/udxjqqmt/public_html/wp-admin||


plugin: modsec
rule: 77350392
name: IM360 WAF: Interaction with fake plugin
abuser: 89.251.0.49
country_id: 6251999
domain: ccl.tg
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/seoplugins/db.php?u||WPU:||RSV:8.17||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
	cpanel::cpsrvd::do_token_denied("login failed", HASH(0x21a81c0), undef, "jupiter") called at cpsrvd.pl line 5351


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 89.251.0.49
country_id: 6251999
domain: ccl.tg
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.17||T:APACHE||MV:/wp-includes/images/smilies/about.php||SC:/home/udxjqqmt/public_html/wp-includes||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 89.251.0.49
country_id: 6251999
domain: ccl.tg
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/udxjqqmt/public_html/wp-includes||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.254.130.58
country_id: 1562822
domain: www.arse.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tg/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.254.130.58
country_id: 1562822
domain: www.arse.tghttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.arse.tghttp/www.arse.tg/ HTTP/1.1||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [16/Jun/2026:11:34:43 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7051671&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781609681 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.152.99
country_id: 3469034
description:
2026-06-16 11:35:07 dovecot_plain authenticator failed for H=([192.168.15.9]) [104.28.152.99]:54645: 535 Incorrect authentication data (set_id=sergdev@dgdn-togo.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.63.15.252
country_id: 6252001
description:
[2026-06-16 11:35:22 +0000] info [cpaneld] 195.63.15.252 - ylhgcaui "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.72.153.110
country_id: 290557
description:
Jun 16 11:37:17 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.72.153.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.185.131.147
country_id: 1269750
description:
2026-06-16 11:38:01 dovecot_plain authenticator failed for H=(localhost) [223.185.131.147]:28395: 535 Incorrect authentication data (set_id=kido@cafe.tg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.72.153.110
country_id: 290557
description:
Jun 16 11:37:24 ns5 auth[4030142]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.72.153.110 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 204.217.130.55
country_id: 6252001
domain: sp-eau.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:11-38.204.217.130.55||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.138.122
country_id: 2921044
description:
2026-06-16 11:39:04 dovecot_login authenticator failed for H=(account.dgdn-togo.tg) [139.59.138.122]:50648: 535 Incorrect authentication data (set_id=contact@dgdn-togo.tg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.122.162
country_id: 2363686
description:
2026-06-16 11:41:43 dovecot_plain authenticator failed for H=([10.10.30.98]) [196.170.122.162]:48026: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [16/Jun/2026:11:42:33 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [16/Jun/2026:11:42:33 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.141.33.51
country_id: 3469034
description:
[2026-06-16 11:49:13 +0000] info [cpaneld] 192.141.33.51 - sprocatg "GET /login/?login_only=1&user=sprocatg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sprocatg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.228.99.251
country_id: 2017370
description:
[2026-06-16 11:49:21 +0000] info [cpaneld] 91.228.99.251 - spr "GET /login/?login_only=1&user=spr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user spr (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [16/Jun/2026:11:49:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7052644&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781610560 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.225.64.148
country_id: 3686110
description:
[2026-06-16 11:49:25 +0000] info [cpaneld] 181.225.64.148 - sp "GET /login/?login_only=1&user=sp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sp (has_cpuser_file failed)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 67.250.133.71
country_id: 6252001
domain: direct7.tg
description:
IM360 WAF: Possible XSS in arguments||MV:https://direct7.tg/wp-content/plugins/onesignal-free-web-push-notifications/sdk_files/onesignalsdkworker.js?appid=8efd3276-8d5b-4b62-bbd3-6ed125ca9f51&sdkversion=160205||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.245
country_id: 1643084
description:
[2026-06-16 11:54:02 +0000] info [cpaneld] 185.213.83.245 - rolle "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rolle (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.167.19.152
country_id: 6252001
domain: lct-togo.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:11-53.104.167.19.152||RSV:8.17||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 196.170.45.140
country_id: 2363686
description:
2026-06-16 11:55:21 H=([172.17.4.32]) [196.170.45.140]:58049 X=TLS1.3:TLS_AES_128_GCM_SHA256:128 F=<sadognon@wages.tg> rejected RCPT <smissoh@linkafric.com>: SMTP AUTH is required for message submission on port 465


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [16/Jun/2026:11:55:46 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [16/Jun/2026:11:55:45 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 190.83.65.157
country_id: 3865483
description:
190.83.65.157 - - [16/Jun/2026:11:55:56 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7302090&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fgroupe-facebook%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781610954 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/groupe-facebook/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.7404.1277 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:190.83.65.157


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 196.170.45.140
country_id: 2363686
description:
2026-06-16 11:57:18 H=([172.17.4.32]) [196.170.45.140]:58070 X=TLS1.3:TLS_AES_128_GCM_SHA256:128 F=<sadognon@wages.tg> rejected RCPT <smissoh@linkafric.com>: SMTP AUTH is required for message submission on port 465


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.253.27.219
country_id: 1880251
description:
[2026-06-16 11:57:20 +0000] info [cpaneld] 103.253.27.219 - web_tv "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user web_tv (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.122.162
country_id: 2363686
description:
2026-06-16 11:56:36 dovecot_plain authenticator failed for H=([10.10.30.98]) [196.170.122.162]:46496: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.185
country_id: 1880251
description:
47.128.96.185 - - [16/Jun/2026:11:56:38 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10053017&pdata=https%253A%252F%252Ftdn.tg%252Ftag%252Fresultats-du-bac-1-togo%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781610996 HTTP/2.0" 302 0 tdn.tg "https://tdn.tg/tag/resultats-du-bac-1-togo/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.185


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 196.168.0.186
country_id: 2363686
description:
2026-06-16 11:56:53 H=([172.17.4.32]) [196.168.0.186]:58069 X=TLS1.3:TLS_AES_128_GCM_SHA256:128 F=<sadognon@wages.tg> rejected RCPT <smissoh@linkafric.com>: SMTP AUTH is required for message submission on port 465


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - sandrine.a@cloud-et-racks.tg [06/16/2026:11:58:16 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: sandrine.a@cloud-et-racks.tg


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.61.130.187
country_id: 6252001
description:
[2026-06-16 11:58:02 +0000] info [cpaneld] 45.61.130.187 - abttogo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 196.168.0.186
country_id: 2363686
description:
2026-06-16 11:58:41 H=([172.17.4.32]) [196.168.0.186]:58078 X=TLS1.3:TLS_AES_128_GCM_SHA256:128 F=<sadognon@wages.tg> rejected RCPT <smissoh@linkafric.com>: SMTP AUTH is required for message submission on port 465


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [16/Jun/2026:11:58:48 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13080424&pdata=https%253A%252F%252Fsproca.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781611127 HTTP/2.0" 302 0 sproca.tg "https://sproca.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [16/Jun/2026:11:58:47 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9660313&pdata=https%253A%252F%252Fsproca.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781611117 HTTP/2.0" 404 561 sproca.tg "https://sproca.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [16/Jun/2026:11:59:14 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6659478&pdata=https%253A%252F%252Fsproca.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781611153 HTTP/2.0" 302 0 sproca.tg "https://sproca.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 199.101.136.165
country_id: 6252001
description:
[2026-06-16 12:01:19 +0000] info [whostmgrd] 199.101.136.165 - stephanetg "POST /login?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 178.20.55.16
country_id: 3017382
description:
178.20.55.16 - - [16/Jun/2026:12:01:46 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7235434&pdata=https%253A%252F%252F154-70-82-246.cpanel.site&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781611304 HTTP/2.0" 302 0 154-70-82-246.cpanel.site "https://154-70-82-246.cpanel.site/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:178.20.55.16


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - info@cloud-et-racks.tg [06/16/2026:12:02:22 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: info@cloud-et-racks.tg


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.61.245.113
country_id: 3686110
description:
[2026-06-16 12:04:11 +0000] info [cpaneld] 181.61.245.113 - delxia "GET /login/?login_only=1&user=delxia&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user delxia (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.128.144.82
country_id: 3469034
description:
[2026-06-16 12:04:11 +0000] info [cpaneld] 177.128.144.82 - delxia "GET /login/?login_only=1&user=delxia&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user delxia (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.84.57.12
country_id: 3469034
description:
[2026-06-16 12:04:16 +0000] info [cpaneld] 170.84.57.12 - delxi "GET /login/?login_only=1&user=delxi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user delxi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.37.64.171
country_id: 1269750
description:
[2026-06-16 12:04:20 +0000] info [cpaneld] 49.37.64.171 - delxi "GET /login/?login_only=1&user=delxi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user delxi (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [16/Jun/2026:12:03:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10195865&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781611428 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.77.185.33
country_id: 2542007
description:
[2026-06-16 12:04:13 +0000] info [cpaneld] 196.77.185.33 - delxiatg "GET /login/?login_only=1&user=delxiatg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user delxiatg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.68.23.230
country_id: 3686110
description:
[2026-06-16 12:04:14 +0000] info [cpaneld] 190.68.23.230 - delxiatg "GET /login/?login_only=1&user=delxiatg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user delxiatg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.9.34.229
country_id: 1643084
description:
[2026-06-16 12:04:25 +0000] info [cpaneld] 182.9.34.229 - delx "GET /login/?login_only=1&user=delx&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user delx (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.83.121
country_id: 6252001
description:
[2026-06-16 12:04:43 +0000] info [cpaneld] 134.195.83.121 NEW wcnyaruu:THnQUcWAptwkDoGA address=134.195.83.121,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 107.174.169.229
country_id: 6252001
description:
[2026-06-16 12:04:44 +0000] info [cpaneld] 107.174.169.229 NEW wcnyaruu:GvxTqzlLCM2nttQu address=107.174.169.229,app=cpaneld,creator=wcnyaruu,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 41.207.188.29
country_id: 2363686
description:
41.207.188.29 - - [16/Jun/2026:12:05:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6918505&pdata=https%253A%252F%252Frelanceinfo.tg%252F%253Fp%253D1871&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781611509 HTTP/2.0" 302 0 relanceinfo.tg "https://relanceinfo.tg/?p=1871" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:151.0) Gecko/20100101 Firefox/151.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:41.207.188.29


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.196.255.37
country_id: 3625428
description:
[2026-06-16 12:04:22 +0000] info [cpaneld] 38.196.255.37 - del "GET /login/?login_only=1&user=del&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user del (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.142.154.186
country_id: 1733045
description:
[2026-06-16 12:04:28 +0000] info [cpaneld] 161.142.154.186 - de "GET /login/?login_only=1&user=de&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user de (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 205.169.39.48
country_id: 6252001
description:
205.169.39.48 - - [16/Jun/2026:12:06:15 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10275995%26pdata=http://mail.togoartconnection.tg%26id=7fa3b767c460b54a2be4d49030b349c7%26ts=1781611555 HTTP/1.1" 404 561 mail.togoartconnection.tg "-" "Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.48


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 - - [16/Jun/2026:12:06:00 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10275995&pdata=http%253A%252F%252Fmail.togoartconnection.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781611555 HTTP/1.1" 302 0 mail.togoartconnection.tg "http://mail.togoartconnection.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.123.170.104


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 140.235.3.136
country_id: 6252001
domain: www.letabloid.tg
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142125r77142137||MV:12-06.140.235.3.136||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77433250
name: IM360 WAF: Track WordPress user self-registration
abuser: 140.235.3.136
country_id: 6252001
domain: www.letabloid.tg
description:
IM360 WAF: Track WordPress user self-registration||NewUser:nkyjade648306||Email:jade_jade9@jimova.durovmail.cv||RSV:8.17||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.107.118.141
country_id: 2017370
description:
[2026-06-16 12:08:34 +0000] info [cpaneld] 91.107.118.141 - cf "GET /login/?login_only=1&user=cf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cf (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.115.124.70
country_id: 1814991
description:
27.115.124.70 - - [16/Jun/2026:12:09:10 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6646678&pdata=https%253A%252F%252Fcloud-et-racks.tg%252Fwp-content%252Fplugins%252Fkk-star-ratings%252Ffreemius%252Ftemplates%252Fjs%252Finstall-feature.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781611748 HTTP/2.0" 302 0 cloud-et-racks.tg "https://cloud-et-racks.tg/wp-content/plugins/kk-star-ratings/freemius/templates/js/install-feature.php" "Mozilla/5.0 (Linux; Android 11; CPH2185) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.115.124.70


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.180.149.174
country_id: 3469034
description:
[2026-06-16 12:08:26 +0000] info [cpaneld] 45.180.149.174 - cfmitg "GET /login/?login_only=1&user=cfmitg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cfmitg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.85.37.80
country_id: 3469034
description:
[2026-06-16 12:08:32 +0000] info [cpaneld] 187.85.37.80 - cfm "GET /login/?login_only=1&user=cfm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cfm (has_cpuser_file failed)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [16/Jun/2026:12:11:07 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261 HTTP/2.0" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [16/Jun/2026:12:11:07 +0000] "GET /favicon.ico HTTP/2.0" 415 587 afrique-distribution.net "https://afrique-distribution.net/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212823&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781498261" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 83.70.219.20
country_id: 2963597
description:
[2026-06-16 12:12:10 +0000] info [cpaneld] 83.70.219.20 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.122.162
country_id: 2363686
description:
2026-06-16 12:12:02 dovecot_plain authenticator failed for H=([10.10.30.98]) [196.170.122.162]:47314: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.226.69.182
country_id: 3996063
description:
[2026-06-16 12:12:13 +0000] info [cpaneld] 189.226.69.182 - yanacom "GET /login/?login_only=1&user=yanacom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yanacom (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.236.107.19
country_id: 1210997
description:
103.236.107.19 - - [16/Jun/2026:12:11:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9672546&pdata=https%253A%252F%252Fmacite.tg%252F2026%252F03%252F09%252Fpage%252F2%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781611895 HTTP/2.0" 302 0 macite.tg "https://macite.tg/2026/03/09/page/2/" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2281.1163 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.236.107.19


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.164.91.144
country_id: 6252001
description:
[2026-06-16 12:13:20 +0000] info [whostmgrd] 141.164.91.144 - masfloy "POST /login?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.189.67.155
country_id: 3469034
description:
[2026-06-16 12:12:26 +0000] info [cpaneld] 179.189.67.155 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.137.205.18
country_id: 2264397
description:
[2026-06-16 12:12:30 +0000] info [cpaneld] 78.137.205.18 - yan "GET /login/?login_only=1&user=yan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yan (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.100.199.20
country_id: 289688
description:
[2026-06-16 12:12:33 +0000] info [cpaneld] 78.100.199.20 - ya "GET /login/?login_only=1&user=ya&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ya (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.252.141.4
country_id: 102358
description:
[2026-06-16 12:12:38 +0000] info [cpaneld] 51.252.141.4 - cecaptg "GET /login/?login_only=1&user=cecaptg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cecaptg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.102.17.4
country_id: 2017370
description:
[2026-06-16 12:12:45 +0000] info [cpaneld] 94.102.17.4 - cec "GET /login/?login_only=1&user=cec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.5.44.231
country_id: 3895114
description:
[2026-06-16 12:12:49 +0000] info [cpaneld] 190.5.44.231 - ce "GET /login/?login_only=1&user=ce&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ce (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-16 12:12:54 +0000] info [webmaild] 160.242.195.10 - fkossivi@caissederetraites.tg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 160.242.195.10
country_id: 2363686
description:
[2026-06-16 12:12:57 +0000] info [cpaneld] 160.242.195.10 NEW assedderetrm:0fGf1L3QfCQdDp0n address=160.242.195.10,app=cpaneld,creator=assedderetrm,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 150.228.221.133
country_id: 1522867
description:
[2026-06-16 12:12:29 +0000] info [cpaneld] 150.228.221.133 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.42.240.206
country_id: 3932488
description:
[2026-06-16 12:12:35 +0000] info [cpaneld] 190.42.240.206 - ceca "GET /login/?login_only=1&user=ceca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceca (has_cpuser_file failed)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 194.113.119.13
country_id: 2921044
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:194.113.119.13||TA:194.113.119.13||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.171.82.254
country_id: 6252001
description:
[2026-06-16 12:15:04 +0000] info [whostmgrd] 192.171.82.254 - c1565738c "POST /login?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.252.71.181
country_id: 3077311
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:104.252.71.181||TA:104.252.71.181||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.174.136.75
country_id: 6252001
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:107.174.136.75||TA:107.174.136.75||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 23.236.179.133
country_id: 6252001
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:23.236.179.133||TA:23.236.179.133||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 34.72.176.129
country_id: 6252001
description:
34.72.176.129 - - [16/Jun/2026:12:16:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923182&pdata=http%253A%252F%252Fmail.togoartconnection.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781612201 HTTP/1.1" 302 0 mail.togoartconnection.tg "http://mail.togoartconnection.tg/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:34.72.176.129


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 46.203.154.121
country_id: 6251999
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:46.203.154.121||TA:46.203.154.121||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.175.119.44
country_id: 6252001
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:107.175.119.44||TA:107.175.119.44||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 41.249.131.16
country_id: 2542007
description:
41.249.131.16 - - [16/Jun/2026:12:17:02 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13080733&pdata=https%253A%252F%252Fcpanel.supermercandotogo.free.netmaster.tg%252F%253Flocale%253Dsv&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781612220 HTTP/2.0" 302 0 cpanel.supermercandotogo.free.netmaster.tg "https://cpanel.supermercandotogo.free.netmaster.tg/?locale=sv" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:41.249.131.16


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 91.134.142.208
country_id: 3017382
description:
91.134.142.208 - - [16/Jun/2026:12:16:37 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13276105&pdata=https%253A%252F%252Fafrique-distribution.net&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781612196 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/" "Mozilla/5.0 (iPad; CPU OS 26_5_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 YaBrowser/26.4.5.511.11 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:91.134.142.208


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.174.194.99
country_id: 6252001
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:107.174.194.99||TA:107.174.194.99||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 191.96.170.111
country_id: 2658434
domain: afriquerevelation.tg
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.17||T:APACHE||RA:191.96.170.111||TA:191.96.170.111||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 212.102.39.87
country_id: 3077311
description:
212.102.39.87 - - [16/Jun/2026:12:18:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12752790&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781612298 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:212.102.39.87


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 176.98.30.7
country_id: 690791
description:
176.98.30.7 - - [16/Jun/2026:12:18:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10119369&pdata=https%253A%252F%252Ftogodailynews.tg%252Ftogo-un-presume-braqueur-neutralise-par-la-police-togolais%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781612286 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/togo-un-presume-braqueur-neutralise-par-la-police-togolais/" "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.9042.1287 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:176.98.30.7


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [16/Jun/2026:12:18:22 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6974576&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781612300 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 205.169.39.58
country_id: 6252001
description:
205.169.39.58 - - [16/Jun/2026:12:19:08 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10264163&pdata=https%253A%252F%252Fsproca.tg&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781612347 HTTP/2.0" 302 0 sproca.tg "https://sproca.tg/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:205.169.39.58


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 158.62.209.82
country_id: 6252001
description:
[2026-06-16 12:19:29 +0000] info [whostmgrd] 158.62.209.82 - netmastersarl "POST /login?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.24.105
country_id: 6252001
description:
47.251.24.105 - - [16/Jun/2026:12:19:57 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131608&pdata=http%253A%252F%252F154.70.82.244%253A2095%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781612392 HTTP/1.1" 302 0 154.70.82.244 "http://154.70.82.244:2095/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.24.105


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 196.171.133.76
country_id: 2363686
description:
[2026-06-16 12:22:32 +0000] info [webmaild] 196.171.133.76 - info@matosshop.tg "GET / HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [196.171.58.124] != Current IP Address [196.171.133.76]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.117.49.131
country_id: 2017370
description:
[2026-06-16 12:23:30 +0000] info [cpaneld] 87.117.49.131 - itstg "GET /login/?login_only=1&user=itstg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user itstg (has_cpuser_file failed)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 91.134.142.208
country_id: 3017382
description:
91.134.142.208 - - [16/Jun/2026:12:24:59 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9922411&pdata=https%253A%252F%252Fafrique-distribution.net&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781612697 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/" "Mozilla/5.0 (iPad; CPU OS 26_5_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 YaBrowser/26.4.5.511.11 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:91.134.142.208


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 91.134.142.208
country_id: 3017382
description:
91.134.142.208 - - [16/Jun/2026:12:26:20 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13276105&pdata=https%253A%252F%252Fafrique-distribution.net&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781612196 HTTP/2.0" 404 159 afrique-distribution.net "https://afrique-distribution.net/" "Mozilla/5.0 (iPhone; CPU iPhone OS 14_0_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:91.134.142.208


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 45.237.57.100
country_id: 3469034
description:
45.237.57.100 - - [16/Jun/2026:12:26:25 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6974576&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781612300 HTTP/1.1" 404 561 afrique-distribution.net "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.237.57.100


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.170.122.162
country_id: 2363686
description:
2026-06-16 12:27:34 dovecot_plain authenticator failed for H=([10.10.30.98]) [196.170.122.162]:41870: 535 Incorrect authentication data (set_id=sename.avegnon@arse.tg)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.227.46.173
country_id: 2017370
description:
[2026-06-16 12:27:36 +0000] info [cpaneld] 5.227.46.173 - metaa "GET /login/?login_only=1&user=metaa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user metaa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.64.173.162
country_id: 2017370
description:
[2026-06-16 12:27:38 +0000] info [cpaneld] 178.64.173.162 - meta "GET /login/?login_only=1&user=meta&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user meta (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.109.48.218
country_id: 2017370
description:
[2026-06-16 12:27:33 +0000] info [cpaneld] 89.109.48.218 - metaar "GET /login/?login_only=1&user=metaar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user metaar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.158.250.112
country_id: 2400553
description:
[2026-06-16 12:27:22 +0000] info [cpaneld] 41.158.250.112 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 59.153.16.207
country_id: 1210997
description:
[2026-06-16 12:27:46 +0000] info [cpaneld] 59.153.16.207 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.67.38.175
country_id: 3469034
description:
[2026-06-16 12:27:41 +0000] info [cpaneld] 177.67.38.175 - met "GET /login/?login_only=1&user=met&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user met (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 134.195.83.86
country_id: 6252001
description:
[2026-06-16 12:28:18 +0000] info [cpaneld] 134.195.83.86 NEW ifxmoxbf:jvHkfVsqOzvpBxCn address=134.195.83.86,app=cpaneld,creator=ifxmoxbf,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77609300
name: IM360 WAF: Possible phishing page detected
abuser: 5.230.153.125
country_id: 2635167
domain: togofarm.tg
description:
IM360 WAF: Possible phishing page detected||SC:/home/ifxmoxbf/public_html/.618070654511125.php||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 136.36.143.231
country_id: 6252001
description:
136.36.143.231 - - [16/Jun/2026:12:28:50 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10144363&pdata=https%253A%252F%252Fafrique-distribution.net%252Fgh%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781612929 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/gh/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:150.0) Gecko/20100101 Firefox/150.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:136.36.143.231


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 139.99.170.109
country_id: 2077456
description:
139.99.170.109 - - [16/Jun/2026:12:32:49 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10264424&pdata=https%253A%252F%252Fafrique-distribution.net%252Frosjhg.html&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781613167 HTTP/2.0" 302 0 afrique-distribution.net "https://afrique-distribution.net/rosjhg.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:139.99.170.109


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 103.114.99.15
country_id: 1210997
description:
103.114.99.15 - - [16/Jun/2026:12:33:42 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10067610&pdata=https%253A%252F%252Ftogodailynews.tg%252Fattaque-au-nord-du-togo-faure-gnassingbe-reaffirme-sa-determination-a-lutter-contre-le-terrorisme%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781613220 HTTP/2.0" 302 0 togodailynews.tg "https://togodailynews.tg/attaque-au-nord-du-togo-faure-gnassingbe-reaffirme-sa-determination-a-lutter-contre-le-terrorisme/" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.9959.1219 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:103.114.99.15


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - fkossivi@caissederetraites.tg [06/16/2026:12:34:30 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: fkossivi@caissederetraites.tg


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.153.124
country_id: 99237
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/b17a68 HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.20.207.59
country_id: 1643084
domain: togodailynews.tg
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/togodailynews.tg/907d6c HTTP/1.1||RSV:8.17||T:APACHE||


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 34.12.205.169
country_id: 2750405
domain: pub.soena.tg
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.17||T:APACHE||REQUEST_URI:/wordpress/wp-includes/wlwmanifest.xml||


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 104.232.222.55
country_id: 2802361
domain: lvdt.tg
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 12; M2004J19C Build/SP1A.210812.016; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/118.0.0.0 Mobile Safari/537.36 musical_ly_2022604030 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/musical_ly app_version/26.4.3 ByteLocale/ru-RU ByteFullLocale/ru-RU Region/US Spark/1.1.9.4-bugfix AppVersion/26.4.3 PIA/1.4.3 BytedanceWebview/d8a21c6||RSV:8.17||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 138.84.33.238
country_id: 3895114
description:
138.84.33.238 - - [16/Jun/2026:12:35:36 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13133253&pdata=https%253A%252F%252Fcpanel.ns1.netmaster.tg%252F%253Flocale%253Dde&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781613333 HTTP/2.0" 302 0 cpanel.ns1.netmaster.tg "https://cpanel.ns1.netmaster.tg/?locale=de" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:138.84.33.238


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 136.36.143.231
country_id: 6252001
description:
136.36.143.231 - - [16/Jun/2026:12:36:04 +0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10144363&pdata=https%253A%252F%252Fafrique-distribution.net%252Fgh%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1781612929 HTTP/2.0" 404 159 afrique-distribution.net "https://afrique-distribution.net/gh/" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_0_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 YaBrowser/26.4.1.655.10 YaApp_iOS/2604.1 YaApp_iOS_Browser/2604.1 Safari/604.1 SA/3 Version/18.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:136.36.143.231


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 102.64.165.143
country_id: 2363686
domain: macite.tg
description:
IM360 WAF: Possible XSS in arguments||MV:<!-- wp:paragraph -->\n<p><strong><em>lom\xc3\xa9 s'impose une fois de plus comme la capitale de l'int\xc3\xa9gration africaine. le lundi 15 juin dernier, la capitale togolaise a donn\xc3\xa9 le coup d'envoi de la premi\xc3\xa8re convention et exposition africaines du transport a\xc3\xa9rien.</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>pr\xc3\xa9sid\xc3\xa9e par le pr\xc3\xa9sident du conseil de la r\xc3\xa9publique togolaise, faure essozimna gnassingb\xc3\xa9, en sa qualit\xc3\xa9 de champion du march\xc3\xa9 unique du transport a\xc3\xa9rien africain (mutaa), cette rencontre de haut niveau r\xc3\xa9unit, jusqu\xe2\x80\x99au 19 juin prochain, un parterre de dirigeants exceptionnels, dont le pr\xc3\xa9sident rwandais paul kagam\xc3\xa9, l'ancien pr\xc3\xa9sident nig\xc3\xa9rian olusegun obasanjo, ainsi que les patrons de l'iata, de l'oaci et d'aci afrique.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>l\xe2\x80\x99initiative vise \xc3\xa0 transformer le ciel africain en un espace de libert\xc3\xa9, de croissance et de connectivit\xc3\xa9. pour y parvenir, le pr\xc3\xa9sident togolais a partag\xc3\xa9 quatre convictions strat\xc3\xa9giques dont nous livrons la quintessence.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>passer de l\xe2\x80\x99engagement politique \xc3\xa0 la r\xc3\xa9alit\xc3\xa9 op\xc3\xa9rationnelle</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>pour le leader togolais, le temps des simples discours est r\xc3\xa9volu. le mutaa doit entrer dans une phase concr\xc3\xa8te et palpable pour les citoyens et les entreprises.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31280,\"width\":\"686px\",\"height\":\"auto\",\"aspectratio\":\"1.4008755472170107\",\"sizeslug\":\"large\",\"linkdestination\":\"none\",\"align\":\"center\"} -->\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/3460d34e-ee0c-4a14-a528-eee38a50bba8-1024x731.jpg\" alt=\"\" class=\"wp-image-31280\" style=\"aspect-ratio:1.4008755472170107;width:686px;height:auto\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><em>\xc2\xab le march\xc3\xa9 unique du transport a\xc3\xa9rien africain doit entrer dans une phase plus concr\xc3\xa8te. il faut aligner les accords de services a\xc3\xa9riens, faciliter l\xe2\x80\x99ouverture effective des routes, mieux utiliser les droits de trafic et d\xc3\xa9velopper des corridors prioritaires. \xc2\xbb,</em> a expliqu\xc3\xa9 faure gnassingb\xc3\xa9.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>l'harmonisation des politiques a\xc3\xa9riennes entre les \xc3\x89tats et le renforcement de la coop\xc3\xa9ration op\xc3\xa9rationnelle sont d\xc3\xa9sormais les priorit\xc3\xa9s absolues pour fluidifier les \xc3\xa9changes intercontinentaux.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>rendre le transport a\xc3\xa9rien plus accessible et comp\xc3\xa9titif</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>le constat est partag\xc3\xa9 par tous : voyager en afrique co\xc3\xbbte encore trop cher et les lourdeurs administratives freinent la mobilit\xc3\xa9 des entrepreneurs, des \xc3\xa9tudiants et des touristes.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>pour b\xc3\xa2tir un \xc3\xa9cosyst\xc3\xa8me robuste, le champion du mutaa pr\xc3\xb4ne une action sur plusieurs leviers, \xc3\xa0 savoir&nbsp;: la modernisation des infrastructures a\xc3\xa9roportuaires, la transparence accrue dans les taxes et frais appliqu\xc3\xa9s aux billets d'avion, la digitalisation des syst\xc3\xa8mes et simplification des proc\xc3\xa9dures de voyage, et le renforcement des comp\xc3\xa9tences techniques et de la maintenance locale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>faire de l\xe2\x80\x99aviation un moteur de la transformation \xc3\xa9conomique</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>l'aviation ne doit plus \xc3\xaatre per\xc3\xa7ue uniquement sous le prisme du transport de passagers. elle est une infrastructure \xc3\xa9conomique majeure, particuli\xc3\xa8rement \xc3\xa0 l'\xc3\xa8re de la zone de libre-\xc3\xa9change continentale africaine (zlecaf).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>le pr\xc3\xa9sident du conseil a insist\xc3\xa9 sur le r\xc3\xb4le crucial du fret a\xc3\xa9rien pour soutenir des secteurs strat\xc3\xa9giques comme l\xe2\x80\x99agriculture et l\xe2\x80\x99agroindustrie, le commerce num\xc3\xa9rique (e-commerce), et les exportations \xc3\xa0 forte valeur ajout\xc3\xa9e.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>cette connectivit\xc3\xa9 a\xc3\xa9rienne doit \xc3\xaatre intelligemment articul\xc3\xa9e avec les r\xc3\xa9seaux routiers, ferroviaires et maritimes pour maximiser la comp\xc3\xa9titivit\xc3\xa9 du continent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31281,\"sizeslug\":\"large\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/06de7101-2b5e-44af-83e8-5c172b3cbb26-1024x762.jpg\" alt=\"\" class=\"wp-image-31281\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong>construire une industrie a\xc3\xa9ronautique africaine durable</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>la souverainet\xc3\xa9 de l'afrique passe aussi par la ma\xc3\xaetrise de son ciel et de ses technologies. faure gnassingb\xc3\xa9 a invit\xc3\xa9 les \xc3\x89tats \xc3\xa0 consid\xc3\xa9rer l\xe2\x80\x99aviation civile comme une v\xc3\xa9ritable fili\xc3\xa8re productive capable de g\xc3\xa9n\xc3\xa9rer des emplois qualifi\xc3\xa9s pour la jeunesse africaine.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>de plus, face aux d\xc3\xa9fis climatiques actuels, cette transition devra imp\xc3\xa9rativement int\xc3\xa9grer les exigences environnementales et les crit\xc3\xa8res de durabilit\xc3\xa9 pour s'inscrire dans l'avenir.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>un leadership salu\xc3\xa9 par l'union africaine</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>la vision du leader togolais fait l'unanimit\xc3\xa9 aupr\xc3\xa8s de ses pairs. le pr\xc3\xa9sident rwandais paul kagam\xc3\xa9 a chaleureusement salu\xc3\xa9 cet engagement en rappelant qu'\xc2\xab <em>aucun pays ne peut r\xc3\xa9ussir seul ni prosp\xc3\xa9rer dans la fragmentation</em> \xc2\xbb.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>de son c\xc3\xb4t\xc3\xa9, l\xe2\x80\x99ancien pr\xc3\xa9sident nig\xc3\xa9rian olusegun obasanjo a f\xc3\xa9licit\xc3\xa9 le \xc2\xab <em>champion de la politique du ciel ouvert en afrique</em> \xc2\xbb pour les progr\xc3\xa8s r\xc3\xa9glementaires majeurs enregistr\xc3\xa9s.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>en reconnaissance de son leadership inspirant, un prix honorifique a \xc3\xa9t\xc3\xa9 remis au chef de l'ex\xc3\xa9cutif togolais, par la commission de l'union africaine et la commission africaine de l'aviation civile.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":31282,\"sizeslug\":\"large\",\"linkdestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://macite.tg/wp-content/uploads/2026/06/f401f844-47ba-4a70-8242-5d8fe594564c-1024x789.jpg\" alt=\"\" class=\"wp-image-31282\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>notons que pendant cinq jours, la convention de lom\xc3\xa9 sera le th\xc3\xa9\xc3\xa2tre de discussions intenses et strat\xc3\xa9giques structur\xc3\xa9es autour de grands axes. au menu des tables rondes minist\xc3\xa9rielles sur l\xe2\x80\x99accessibilit\xc3\xa9 financi\xc3\xa8re des billets et taxes, des forums politiques et dialogues ex\xc3\xa9cutifs sur la facilitation de la mobilit\xc3\xa9 intra-africaine, des ateliers techniques sur l\xe2\x80\x99innovation, la technologie et le capital humain, et des n\xc3\xa9gociations bilat\xc3\xa9rales port\xc3\xa9es sur l\xe2\x80\x99investissement dans les infrastructures et corridors de fret.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>jpb</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a><strong><em>@macite.tg&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</em></strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>e-mail&nbsp;: </em></strong><a href=\"mailto:maciteinfo@gmail.com\"><strong><em>maciteinfo@gmail.com</em></strong></a><strong><em>; </em></strong><a href=\"mailto:bawela1@gmail.com\"><strong><em>bawela1@gmail.com</em></strong></a><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>pour vos annonces, publi-reportages, etc., joignez-nous au (00228)91515309/<strong>79872224 </strong><strong></strong></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>www.macite.tg, l\xe2\x80\x99information, la bonne&nbsp;!</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->||RSV:8.17||T:APACHE||


